Edit tour

Windows Analysis Report
PO_27052024.exe

Overview

General Information

Sample name:	PO_27052024.exe
Analysis ID:	1447834
MD5:	4199d8995c4b86f6053c43cb70a87aa9
SHA1:	ae7d740bc01ae87d643f98264efa3b995365a66f
SHA256:	74a7dd343c4fac52d9d695d8d189a1bf3d5e5578622099bdf731544df385b75d
Tags:	exeFormbook
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

PO_27052024.exe (PID: 2724 cmdline: "C:\Users\user\Desktop\PO_27052024.exe" MD5: 4199D8995C4B86F6053C43CB70A87AA9)

PO_27052024.exe (PID: 2352 cmdline: "C:\Users\user\Desktop\PO_27052024.exe" MD5: 4199D8995C4B86F6053C43CB70A87AA9)

PO_27052024.exe (PID: 5956 cmdline: "C:\Users\user\Desktop\PO_27052024.exe" MD5: 4199D8995C4B86F6053C43CB70A87AA9)

SgrmBroker.exe (PID: 2352 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.alitextile.com", "Username": "9@alitextile.com", "Password": "Myname321@"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.3686376787.000000000319D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3666284064.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3666284064.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1230653583.000000000390E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1230653583.000000000390E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PO_27052024.exe PID: 2724	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO_27052024.exe PID: 2724	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PO_27052024.exe PID: 2724	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PO_27052024.exe PID: 5956	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO_27052024.exe PID: 5956	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.PO_27052024.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.PO_27052024.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.PO_27052024.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.PO_27052024.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33f29:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33f9b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34025:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x340b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34121:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34193:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34229:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x342b9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO_27052024.exe.3949a00.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO_27052024.exe.3949a00.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO_27052024.exe.3949a00.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32129:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3219b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32225:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x322b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32321:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32393:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32429:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x324b9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO_27052024.exe.390e5e0.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO_27052024.exe.390e5e0.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO_27052024.exe.390e5e0.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32129:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3219b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32225:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x322b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32321:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32393:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32429:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x324b9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO_27052024.exe.390e5e0.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO_27052024.exe.390e5e0.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.PO_27052024.exe.390e5e0.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO_27052024.exe.390e5e0.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33f29:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f349:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xaa569:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33f9b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f3bb:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xaa5db:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34025:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f445:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xaa665:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x340b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f4d7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xaa6f7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34121:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f541:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xaa761:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34193:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f5b3:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xaa7d3:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34229:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f649:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xaa869:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.PO_27052024.exe.3949a00.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO_27052024.exe.3949a00.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.PO_27052024.exe.3949a00.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO_27052024.exe.3949a00.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33f29:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f149:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33f9b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f1bb:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34025:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f245:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x340b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f2d7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34121:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f341:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34193:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f3b3:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34229:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f449:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x342b9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6f4d9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 192.185.143.105, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\PO_27052024.exe, Initiated: true, ProcessId: 5956, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49707

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 4.2.PO_27052024.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.alitextile.com", "Username": "9@alitextile.com", "Password": "Myname321@"}

Multi AV Scanner detection for submitted file

Source: PO_27052024.exe	ReversingLabs: Detection: 39%
Source: PO_27052024.exe	Virustotal: Detection: 57%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: PO_27052024.exe

Joe Sandbox ML: detected

Source: PO_27052024.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49703 version: TLS 1.2

Source: PO_27052024.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4x nop then jmp 069F6F2Bh		0_2_069F6509
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4x nop then jmp 069F6F2Bh		0_2_069F6509

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.PO_27052024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_27052024.exe.390e5e0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_27052024.exe.3949a00.6.raw.unpack, type: UNPACKEDPE

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 192.185.143.105 192.185.143.105
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: mail.alitextile.com

Source: PO_27052024.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: PO_27052024.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: PO_27052024.exe	String found in binary or memory: http://feeds.soundcloud.com/users/soundcloud:users:38128127/sounds.rss
Source: PO_27052024.exe, 00000000.00000002.1230653583.000000000390E000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3666284064.0000000000402000.00000040.00000400.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.000000000318A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: PO_27052024.exe, 00000004.00000002.3686376787.00000000034DF000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.0000000003520000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.alitextile.com
Source: PO_27052024.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: PO_27052024.exe, 00000004.00000002.3697573375.0000000009E16000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3672764286.00000000012C5000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3672018222.0000000001246000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.000000000319D000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3696729505.0000000009D48000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.000000000322F000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.0000000003520000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: PO_27052024.exe, 00000004.00000002.3697573375.0000000009E16000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3672764286.00000000012C5000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3672018222.0000000001246000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.000000000319D000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3696729505.0000000009D48000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.000000000322F000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.0000000003520000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: PO_27052024.exe, 00000004.00000002.3686376787.000000000314B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PO_27052024.exe, 00000004.00000002.3697573375.0000000009E16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.o?
Source: PO_27052024.exe, 00000004.00000002.3697573375.0000000009E16000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3672764286.00000000012C5000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3672018222.0000000001246000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3692063718.0000000006B1D000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3697154303.0000000009DA1000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.0000000003520000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033F2000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3692189808.0000000006B57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: PO_27052024.exe, 00000004.00000002.3697573375.0000000009E16000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3672764286.00000000012C5000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3672018222.0000000001246000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3692063718.0000000006B1D000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3697154303.0000000009DA1000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.0000000003520000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033F2000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3692189808.0000000006B57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: PO_27052024.exe, 00000000.00000002.1230653583.000000000390E000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3666284064.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: PO_27052024.exe, 00000000.00000002.1230653583.000000000390E000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3666284064.0000000000402000.00000040.00000400.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.000000000314B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: PO_27052024.exe	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49703 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.PO_27052024.exe.3949a00.6.raw.unpack, 3DlgK9re6m.cs	.Net Code: TDa
Source: 0.2.PO_27052024.exe.390e5e0.5.raw.unpack, 3DlgK9re6m.cs	.Net Code: TDa

Installs a global keyboard hook

Source: C:\Users\user\Desktop\PO_27052024.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\PO_27052024.exe

Jump to behavior

Source: C:\Users\user\Desktop\PO_27052024.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.PO_27052024.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO_27052024.exe.3949a00.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO_27052024.exe.390e5e0.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO_27052024.exe.390e5e0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO_27052024.exe.3949a00.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.PO_27052024.exe.82d0000.10.raw.unpack, .cs	Large array initialization: : array initializer size 27103
Source: 0.2.PO_27052024.exe.27548cc.4.raw.unpack, .cs	Large array initialization: : array initializer size 27103

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: PO_27052024.exe

Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_04B7D5BC	0_2_04B7D5BC
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_068F02D8	0_2_068F02D8
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_068FAA80	0_2_068FAA80
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_068FAA90	0_2_068FAA90
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_069F3CA0	0_2_069F3CA0
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_069F40D8	0_2_069F40D8
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_069F40C9	0_2_069F40C9
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_069F21C0	0_2_069F21C0
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_069F25E8	0_2_069F25E8
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_069F95E0	0_2_069F95E0
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_069F4510	0_2_069F4510
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_069F4501	0_2_069F4501
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_014A41F0	4_2_014A41F0
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_014AB885	4_2_014AB885
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_014A4AC0	4_2_014A4AC0
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_014A3EA8	4_2_014A3EA8
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_06F466F8	4_2_06F466F8
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_06F4D69C	4_2_06F4D69C
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_06F47E80	4_2_06F47E80
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_06F452A0	4_2_06F452A0
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_06F459EF	4_2_06F459EF
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_06F4B987	4_2_06F4B987
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_06F43168	4_2_06F43168
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_06F477A0	4_2_06F477A0
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_06F4EBE2	4_2_06F4EBE2
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_06F4EBE8	4_2_06F4EBE8
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_06F42348	4_2_06F42348
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_06F4F8D6	4_2_06F4F8D6
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_06F40040	4_2_06F40040

Source: PO_27052024.exe

Static PE information: invalid certificate

Source: PO_27052024.exe, 00000000.00000002.1228902157.0000000002785000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs PO_27052024.exe
Source: PO_27052024.exe, 00000000.00000002.1227858084.000000000091E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PO_27052024.exe
Source: PO_27052024.exe, 00000000.00000002.1230653583.000000000390E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7f4f14b4-d46b-42ba-b19b-0932f3eca6e2.exe4 vs PO_27052024.exe
Source: PO_27052024.exe, 00000000.00000002.1230653583.000000000390E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs PO_27052024.exe
Source: PO_27052024.exe, 00000000.00000002.1228902157.0000000002731000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs PO_27052024.exe
Source: PO_27052024.exe, 00000000.00000002.1228902157.000000000277E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7f4f14b4-d46b-42ba-b19b-0932f3eca6e2.exe4 vs PO_27052024.exe
Source: PO_27052024.exe, 00000000.00000002.1233511401.00000000082D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs PO_27052024.exe
Source: PO_27052024.exe, 00000000.00000002.1232714365.0000000006960000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs PO_27052024.exe
Source: PO_27052024.exe, 00000004.00000002.3666284064.000000000043E000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7f4f14b4-d46b-42ba-b19b-0932f3eca6e2.exe4 vs PO_27052024.exe
Source: PO_27052024.exe, 00000004.00000002.3667608248.00000000010F9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PO_27052024.exe
Source: PO_27052024.exe	Binary or memory string: OriginalFilenamebYCc.exe" vs PO_27052024.exe

Source: PO_27052024.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.2.PO_27052024.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO_27052024.exe.3949a00.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO_27052024.exe.390e5e0.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO_27052024.exe.390e5e0.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO_27052024.exe.3949a00.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: PO_27052024.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.PO_27052024.exe.3949a00.6.raw.unpack, slKb.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO_27052024.exe.3949a00.6.raw.unpack, mAKJ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO_27052024.exe.3949a00.6.raw.unpack, xQRSe0Fg.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.PO_27052024.exe.3949a00.6.raw.unpack, n3rhMa.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.PO_27052024.exe.3949a00.6.raw.unpack, MQzE4FWn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO_27052024.exe.3949a00.6.raw.unpack, nSmgRyX5a1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO_27052024.exe.3949a00.6.raw.unpack, 6IMLmJtk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO_27052024.exe.3949a00.6.raw.unpack, 6IMLmJtk.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.PO_27052024.exe.3949a00.6.raw.unpack, 3HroK7qN.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO_27052024.exe.3949a00.6.raw.unpack, 3HroK7qN.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, VoLqNbH7NBw8DyPF6f.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, VoLqNbH7NBw8DyPF6f.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, VoLqNbH7NBw8DyPF6f.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, xthsvSKDBwCmlwX3sW.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/1@3/3

Source: C:\Users\user\Desktop\PO_27052024.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO_27052024.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\PO_27052024.exe

Mutant created: NULL

Source: PO_27052024.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PO_27052024.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO_27052024.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO_27052024.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO_27052024.exe	ReversingLabs: Detection: 39%
Source: PO_27052024.exe	Virustotal: Detection: 57%

Source: C:\Users\user\Desktop\PO_27052024.exe

File read: C:\Users\user\Desktop\PO_27052024.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PO_27052024.exe "C:\Users\user\Desktop\PO_27052024.exe"
Source: C:\Users\user\Desktop\PO_27052024.exe	Process created: C:\Users\user\Desktop\PO_27052024.exe "C:\Users\user\Desktop\PO_27052024.exe"
Source: C:\Users\user\Desktop\PO_27052024.exe	Process created: C:\Users\user\Desktop\PO_27052024.exe "C:\Users\user\Desktop\PO_27052024.exe"
Source: C:\Users\user\Desktop\PO_27052024.exe	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: C:\Users\user\Desktop\PO_27052024.exe	Process created: C:\Users\user\Desktop\PO_27052024.exe "C:\Users\user\Desktop\PO_27052024.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process created: C:\Users\user\Desktop\PO_27052024.exe "C:\Users\user\Desktop\PO_27052024.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO_27052024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\PO_27052024.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\PO_27052024.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: PO_27052024.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO_27052024.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: PO_27052024.exe, Form1.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: PO_27052024.exe, Form1.cs	.Net Code: InitializeComponent contains xor as well as GetObject
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, VoLqNbH7NBw8DyPF6f.cs	.Net Code: vHMcYp56Ig System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO_27052024.exe.82d0000.10.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO_27052024.exe.27548cc.4.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_04B7F110 pushad ; iretd	0_2_04B7F111
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_04B7F2F0 push esi; ret	0_2_04B7F2FA
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_04B7F2FB push edi; ret	0_2_04B7F30A
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_04B7F268 push ebx; ret	0_2_04B7F282
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_04B7F268 push esi; ret	0_2_04B7F2FA
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_04B7F30B push esp; ret	0_2_04B7F31A
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_068F0B01 push es; ret	0_2_068F0B10
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_068FF9D0 push eax; ret	0_2_068FFA2F
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_069F1EA3 pushad ; iretd	0_2_069F1EA4
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_069F1BE9 pushad ; iretd	0_2_069F1BEA
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 0_2_08082199 push eax; ret	0_2_080821A6
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_014AABA0 push esp; retf	4_2_014AAEE1
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_014A0C45 push ebx; retf	4_2_014A0C52
Source: C:\Users\user\Desktop\PO_27052024.exe	Code function: 4_2_014A0C6D push edi; retf	4_2_014A0C7A

Source: PO_27052024.exe

Static PE information: section name: .text entropy: 7.968838201538731

Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, GciElOgIAP9EdODLDH.cs	High entropy of concatenated method names: 'k6ItZ2hPW1', 'h0ttiwlENx', 'dNWtYQ21us', 'tjTtOwUkEf', 'KGmtLBkLYR', 'wxUtQRZqru', 'xKYtmSvG9G', 'U8CtdVLXqL', 'SdwtvcJh91', 'OdRtWIfvx1'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, QTm80DmE6Y15lg0D64q.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Uwae45wtFK', 'gqxeAq7cLO', 'OpleIVCe29', 'yYrexi9Vsn', 'QLqeSSOHX3', 'RbPeaPsKGD', 'z5xe55db13'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, YbCXITmol7Vq2TKq4r0.cs	High entropy of concatenated method names: 'Vm7hZ7l0Ia', 'FuvhiI78ee', 'AbEhYCbnZD', 'yUchODHywZ', 'hPChLP9Cr8', 'nWLhQaT3iW', 'bIUhm4EGPK', 'biyhdC2l84', 'Otkhvaex2C', 'hCQhWhKxyL'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, VoLqNbH7NBw8DyPF6f.cs	High entropy of concatenated method names: 'SZsrjkiaeo', 'lsHrEdFPEP', 'xg9rJUQese', 'n0Frgjx33c', 'xemrUggZ7h', 'EpArCWusUE', 'ArMrt00MOe', 'vNSrouH6Z6', 'xm3rRniXix', 'lR5rfh4Gc0'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, SGt4TNBQkPSXpMeN98.cs	High entropy of concatenated method names: 'GtMgOrWQsG', 'ft4gQ5YvlX', 'E5FgdCRHot', 'fw0gvOA4J8', 'X7SgqAJCn0', 'npVguc06cl', 'QbxgPkXsGw', 'ltQgyxcQyh', 'yqnghfYLj0', 'itege8NsXF'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, mybZBvs7EgbSXen7rX.cs	High entropy of concatenated method names: 'vwvPDoNMor', 'ijlP60UDPF', 'OPFyGmjZ3N', 'yFMyBPthbT', 'PspPnmJpq9', 'RgfPNLIV9s', 'lucPln07d0', 'k8pP4LaQmF', 'ahlPAtp03C', 'e0LPIJbZie'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, xthsvSKDBwCmlwX3sW.cs	High entropy of concatenated method names: 'eRJJ4uNjfJ', 'bCrJAe4I8Z', 'Cq9JIHWOyl', 'Hr7Jx5ExCa', 'aAnJSoVs3I', 'gtCJaLUi8R', 'xg1J5Ujrf5', 'BD4JDVVnyu', 'wVOJ9qsJQO', 'wKiJ6f6hPp'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, aPwWSDpaUA1QGKjjwR.cs	High entropy of concatenated method names: 'Dispose', 'QJ4B9sOS55', 'iH8VpRh2jp', 'Cd9KK3T0ap', 'i2hB6I1ZBa', 'VDUBz2rvJs', 'ProcessDialogKey', 'TXkVGGAZPc', 'WjDVBvHMLH', 'HQ2VVFv15u'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, njuXoX67fBSvw2wMrK.cs	High entropy of concatenated method names: 'FI5ULicVuw', 'ccoUmmHIXV', 'uVvgHPbI4P', 'bWIgkT9I7L', 'pAwgFgMOI4', 'AZMgs1V9tO', 'UVQg2NgWha', 'FCKg8wKrrN', 'wEVg3pFo06', 'ih8gbhirgc'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, aq4nKti5eNfmk0DeOS.cs	High entropy of concatenated method names: 'VTACjN1pdr', 'yEUCJ2UwQh', 'cQeCU1qhPm', 'w3GCtUVVBo', 'zPlComV8Lu', 'TcSUS1w3v4', 'y2BUaiWtCZ', 'gpJU56Wkhb', 'W9HUDTkNQJ', 'gsgU9o0KB5'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, zwiYDcWuwxgFBsJPy3.cs	High entropy of concatenated method names: 'knXBtcqiQt', 'IefBoaitMY', 'jOTBfZEivv', 'zgdBTCUKeg', 'IRqBquEFoi', 'goaBuR7rvr', 'Jm9TSOkT7fFgNIOq2v', 'deJiPUnCRBgym8Hwvw', 'cPvBBok55T', 'clRBrg9qBR'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, MkEOtB9gGpjMMw3c36.cs	High entropy of concatenated method names: 'eEqYtYQAE', 'SFUO0Wy3j', 'dcZQLSZ8p', 'EfXmEuWjF', 'zl1vb3XcW', 'JBJWjdtbd', 'JQ0PyEBMtCfaNNy27a', 'C8iCJ35L5W0LsGOUjq', 'THgyUrBaa', 'J6AeB7XCV'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, JV3k57zF8oQHbXICMF.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'BffhwibwkH', 'oBuhqFqHym', 'ynPhu6k5Ny', 'Iy2hP0raGn', 'txrhyGJgAQ', 'x4rhh39FQd', 'CA3hecdpqE'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, QoN9My8WQTEuxu9ZKJ.cs	High entropy of concatenated method names: 'ToString', 'rHsunI0yyV', 'viYuptJw1R', 'gEduHGusNp', 'P1fukHdni5', 'hHTuFesXZ9', 'cpHusbk7ft', 'jS0u2ThKPU', 'nUbu8k2PE9', 'REpu3jT7Bl'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, cAjlohqWXtUJ8iL54q.cs	High entropy of concatenated method names: 'bI1yE9p7Nn', 'QkKyJl2Oqd', 'hdhygofteJ', 'VMFyU8CDSM', 'XUWyCiJy19', 'pMaytPNqfB', 'N4Lyof4P2s', 'nXByRPwYKl', 'ICVyfKsoY4', 'bLoyTrAshO'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, ftFTQpjBy6MOLTpmFQ.cs	High entropy of concatenated method names: 'PcrqbajboY', 'smvqNUbdFw', 'pn3q4gX1xE', 'YiiqAY1WKm', 'Ex3qp4AExh', 'O15qHkPPVe', 'toAqkYsfyf', 'qBhqFnLIua', 'JJjqsYn5oG', 'm7Zq22b3cD'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, JYpWdCP46XBbxe9e7M.cs	High entropy of concatenated method names: 'GMZtE0bTRP', 'aDstgHUNCD', 'TBbtCZJgP9', 'ryxC649xSZ', 'aM9Cz0tG6A', 'eBGtG6rNiO', 'DxwtBOY2XM', 'Q1WtVUNPAT', 'POotrObywd', 'hZntcZaQAS'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, YNWEeTu2SO8XyCB4hS.cs	High entropy of concatenated method names: 'vdnhBZAfbG', 'SSdhrEqSDV', 'G18hc5A0og', 'CuLhEXdvRV', 'QqqhJaREfY', 'COohUgyfnG', 'bEihCOM5jY', 'lNqy50cKhI', 'DNByDyLsC2', 'kVBy9YmboO'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, gYrtxtYp5pmyJyb4Su.cs	High entropy of concatenated method names: 'y3iwd4Rs2s', 'm8XwvVCunl', 'af6w78EFxM', 'aPEwpjYgcZ', 'rGqwkJtq8g', 'sHNwFo3X6y', 'EdIw2v6woE', 'PYvw8aRmFA', 'pErwbmlt2h', 'lFIwnniWNv'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, zMuaUfCE70WhkmayNJ.cs	High entropy of concatenated method names: 'z4jy7f6VVo', 'cbkypFFu5P', 'ICbyHDEZ9L', 'wCYykJH6HJ', 'oJ5y4B9oOX', 'yEsyFmjD5P', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, BDlcfTMEkDcKRbkfWp.cs	High entropy of concatenated method names: 'VLEu4AJRhns3UV6YYZT', 'mxHoiaJbenJpGvomv4f', 'qqTCyGwZ0p', 'JBECh4jKIr', 'tHxCeXWmOL', 'buwq65JUg5ucgnXlve0', 'tyuP19JcBrBfhmgjPU1'
Source: 0.2.PO_27052024.exe.6960000.9.raw.unpack, zVxJRM2YpVt3GNQR4g.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'i9oV99AdB4', 'cDkV65WOEU', 'TwLVzhrRbG', 'lXCrGA50sO', 'Ax7rBm53uB', 'VSlrV4hvvv', 'sNorrNYZiG', 'hHm6Na2oCLQMy2POtri'

Source: C:\Users\user\Desktop\PO_27052024.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: PO_27052024.exe PID: 2724, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PO_27052024.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PO_27052024.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: PO_27052024.exe, 00000000.00000002.1230653583.000000000390E000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.000000000319D000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3666284064.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\PO_27052024.exe	Memory allocated: D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Memory allocated: 2730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Memory allocated: 2540000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Memory allocated: 8300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Memory allocated: 9300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Memory allocated: 94F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Memory allocated: A4F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Memory allocated: 1460000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Memory allocated: 3140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Memory allocated: 16D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 598806	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 598644	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 598421	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 595423	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 593860	Jump to behavior

Source: C:\Users\user\Desktop\PO_27052024.exe	Window / User API: threadDelayed 3338			Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Window / User API: threadDelayed 6464			Jump to behavior

Source: C:\Users\user\Desktop\PO_27052024.exe TID: 2516	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -598953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -598806s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -598644s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -598531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -598421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -598313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -99546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -99327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -99204s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -99078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -98968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -98859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -98749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -98640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -98521s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -98406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -98275s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -98165s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -98049s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -97701s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -97593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -97482s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -595656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -595547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -595423s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -595297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -595188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -595063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -594938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -594828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -594719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -594594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe TID: 5452	Thread sleep time: -593860s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\PO_27052024.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\PO_27052024.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_27052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 598806	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 598644	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 598421	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 99546	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 99327	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 99204	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 99078	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 98968	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 98749	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 98640	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 98521	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 98406	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 98275	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 98165	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 98049	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 97701	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 97593	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 97482	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 595423	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Thread delayed: delay time: 593860	Jump to behavior

Source: PO_27052024.exe, 00000004.00000002.3686376787.000000000319D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: PO_27052024.exe, 00000004.00000002.3666284064.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: PO_27052024.exe, 00000004.00000002.3666284064.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: PO_27052024.exe, 00000004.00000002.3672764286.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\PO_27052024.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\PO_27052024.exe

Code function: 4_2_014A7ED0 CheckRemoteDebuggerPresent,

4_2_014A7ED0

Source: C:\Users\user\Desktop\PO_27052024.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\PO_27052024.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\PO_27052024.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\PO_27052024.exe

Memory written: C:\Users\user\Desktop\PO_27052024.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\PO_27052024.exe	Process created: C:\Users\user\Desktop\PO_27052024.exe "C:\Users\user\Desktop\PO_27052024.exe"			Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Process created: C:\Users\user\Desktop\PO_27052024.exe "C:\Users\user\Desktop\PO_27052024.exe"			Jump to behavior

Source: C:\Users\user\Desktop\PO_27052024.exe	Queries volume information: C:\Users\user\Desktop\PO_27052024.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Queries volume information: C:\Users\user\Desktop\PO_27052024.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO_27052024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 4.2.PO_27052024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_27052024.exe.3949a00.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_27052024.exe.390e5e0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_27052024.exe.390e5e0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_27052024.exe.3949a00.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3666284064.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1230653583.000000000390E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_27052024.exe PID: 2724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO_27052024.exe PID: 5956, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\PO_27052024.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\PO_27052024.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\PO_27052024.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 4.2.PO_27052024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_27052024.exe.3949a00.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_27052024.exe.390e5e0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_27052024.exe.390e5e0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_27052024.exe.3949a00.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3686376787.000000000319D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3666284064.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1230653583.000000000390E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_27052024.exe PID: 2724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO_27052024.exe PID: 5956, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 4.2.PO_27052024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_27052024.exe.3949a00.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_27052024.exe.390e5e0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_27052024.exe.390e5e0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_27052024.exe.3949a00.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3666284064.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1230653583.000000000390E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_27052024.exe PID: 2724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO_27052024.exe PID: 5956, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	231 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	34 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	531 Security Software Discovery	Distributed Component Object Model	21 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	261 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	261 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO_27052024.exe	39%	ReversingLabs	ByteCode-MSIL.Trojan.Barys
PO_27052024.exe	57%	Virustotal		Browse
PO_27052024.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
api.ipify.org	1%	Virustotal	Browse
ip-api.com	0%	Virustotal	Browse
mail.alitextile.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://feeds.soundcloud.com/users/soundcloud:users:38128127/sounds.rss	0%	Virustotal		Browse
http://x1.c.lencr.o?	0%	Virustotal		Browse
http://feeds.soundcloud.com/users/soundcloud:users:38128127/sounds.rss	0%	Avira URL Cloud	safe
http://x1.c.lencr.o?	0%	Avira URL Cloud	safe
http://mail.alitextile.com	0%	Avira URL Cloud	safe
http://mail.alitextile.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false	1%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	true	0%, Virustotal, Browse	unknown
mail.alitextile.com	192.185.143.105	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	PO_27052024.exe, 00000000.00000002.1230653583.000000000390E000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3666284064.0000000000402000.00000040.00000400.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.000000000314B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	PO_27052024.exe, 00000000.00000002.1230653583.000000000390E000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3666284064.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	PO_27052024.exe, 00000004.00000002.3697573375.0000000009E16000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3672764286.00000000012C5000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3672018222.0000000001246000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3692063718.0000000006B1D000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3697154303.0000000009DA1000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.0000000003520000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033F2000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3692189808.0000000006B57000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	PO_27052024.exe, 00000004.00000002.3697573375.0000000009E16000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3672764286.00000000012C5000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3672018222.0000000001246000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3692063718.0000000006B1D000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3697154303.0000000009DA1000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.0000000003520000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033F2000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3692189808.0000000006B57000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.alitextile.com	PO_27052024.exe, 00000004.00000002.3686376787.00000000034DF000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.0000000003520000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033F2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://r3.o.lencr.org0	PO_27052024.exe, 00000004.00000002.3697573375.0000000009E16000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3672764286.00000000012C5000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3672018222.0000000001246000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.000000000319D000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3696729505.0000000009D48000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.000000000322F000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.0000000003520000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://feeds.soundcloud.com/users/soundcloud:users:38128127/sounds.rss	PO_27052024.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PO_27052024.exe, 00000004.00000002.3686376787.000000000314B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	PO_27052024.exe	false	URL Reputation: safe	unknown
http://x1.c.lencr.o?	PO_27052024.exe, 00000004.00000002.3697573375.0000000009E16000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://r3.i.lencr.org/0	PO_27052024.exe, 00000004.00000002.3697573375.0000000009E16000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3672764286.00000000012C5000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3672018222.0000000001246000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.000000000319D000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3696729505.0000000009D48000.00000004.00000020.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.000000000322F000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.0000000003520000.00000004.00000800.00020000.00000000.sdmp, PO_27052024.exe, 00000004.00000002.3686376787.00000000033F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
192.185.143.105	mail.alitextile.com	United States	46606	UNIFIEDLAYER-AS-1US	true
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447834
Start date and time:	2024-05-27 09:00:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO_27052024.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/1@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 111 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:01:00	API Interceptor	8600078x Sleep call for process: PO_27052024.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Reiven RFQ-27-05-2024.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	ev1NIvTd6f.exe	Get hash	malicious	Unknown	Browse	/json/
	https://mega.nz/file/wncXiYhZ#ABJEpmoiGH0hIeVVKQy7V_ALtGclDnJ4rFrDjwZ8kDE	Get hash	malicious	DCRat	Browse	ip-api.com/line/?fields=hosting
	uChcvn3L6R.exe	Get hash	malicious	DCRat	Browse	ip-api.com/line/?fields=hosting
	uChcvn3L6R.exe	Get hash	malicious	DCRat	Browse	ip-api.com/line/?fields=hosting
	SecuriteInfo.com.FileRepMalware.1834.13764.exe	Get hash	malicious	Discord Token Stealer, XWorm	Browse	ip-api.com/line/?fields=hosting
	NFs_468.msi	Get hash	malicious	VMdetect	Browse	ip-api.com/json/
	z23mypdfscanner-invoice3535.bat	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	2aFb7hE00o.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	documentos.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
192.185.143.105	PO_23052024.exe	Get hash	malicious	AgentTesla	Browse
	PO_21052024.exe	Get hash	malicious	AgentTesla	Browse
	PO_#20241705.exe	Get hash	malicious	AgentTesla	Browse
	PO_20240516.exe	Get hash	malicious	AgentTesla	Browse
	PO_202405014.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Purchase Order_#400086587.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Purchase Order_#400388875.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	cir0tBXcdO.exe	Get hash	malicious	AgentTesla	Browse
104.26.13.205	ReturnLegend.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RATX-gen.31127.4101.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	Reiven RFQ-27-05-2024.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	ev1NIvTd6f.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	https://mega.nz/file/wncXiYhZ#ABJEpmoiGH0hIeVVKQy7V_ALtGclDnJ4rFrDjwZ8kDE	Get hash	malicious	DCRat	Browse	208.95.112.1
	uChcvn3L6R.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	uChcvn3L6R.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	SecuriteInfo.com.FileRepMalware.1834.13764.exe	Get hash	malicious	Discord Token Stealer, XWorm	Browse	208.95.112.1
	NFs_468.msi	Get hash	malicious	VMdetect	Browse	208.95.112.1
	z23mypdfscanner-invoice3535.bat	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	2aFb7hE00o.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	documentos.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
api.ipify.org	Remittance#26856.html	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	https://interface01.nsxtlmv.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	http://christiantensen478345.pages.dev/help/contact/45367900411236/	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://louiss-comxinh.pages.dev/help/contact/388061959224233	Get hash	malicious	Unknown	Browse	172.67.74.152
	http://worker-office-onedrive.td5xtn-b1lv7f1ymscd0.workers.dev/favicon.ico	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	z23mypdfscanner-invoice3535.bat	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SOA APR 24.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	REF0000QWERT544FILE.vbe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Eaqiwpu.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	hesaphareketi-01.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
mail.alitextile.com	PO_23052024.exe	Get hash	malicious	AgentTesla	Browse	192.185.143.105
	PO_21052024.exe	Get hash	malicious	AgentTesla	Browse	192.185.143.105
	PO_#20241705.exe	Get hash	malicious	AgentTesla	Browse	192.185.143.105
	PO_20240516.exe	Get hash	malicious	AgentTesla	Browse	192.185.143.105
	PO_202405014.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.185.143.105
	Purchase Order_#400086587.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.185.143.105
	Purchase Order_#400388875.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.185.143.105
	cir0tBXcdO.exe	Get hash	malicious	AgentTesla	Browse	192.185.143.105

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	http://mzm.bgd.mybluehost.me/wp-content/thnewest/Recibir_paquete.php	Get hash	malicious	Unknown	Browse	162.241.225.111
	V4zFzdCyty.elf	Get hash	malicious	Mirai, Moobot	Browse	66.116.195.138
	http://www.mecanigo.com.br/LBP/mopolude-de/	Get hash	malicious	Unknown	Browse	162.240.81.59
	https://iratifibra.com.br/wp-includes/css/pyrgj/incqbifg	Get hash	malicious	HTMLPhisher	Browse	108.179.252.19
	https://uch.mrn.mybluehost.me/MS/DHLM/	Get hash	malicious	HTMLPhisher	Browse	50.87.170.127
	file.exe	Get hash	malicious	SystemBC	Browse	192.185.116.205
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse	192.185.16.114
	https://24hours-left.com/	Get hash	malicious	Unknown	Browse	162.240.159.179
	XVM5nluelx.exe	Get hash	malicious	Babuk, Djvu, SmokeLoader	Browse	192.185.16.114
	file.exe	Get hash	malicious	Babuk, Djvu, SmokeLoader	Browse	192.185.16.114
CLOUDFLARENETUS	#U0426#U0438#U0442#U0430#U0442#U0430.exe	Get hash	malicious	FormBook	Browse	172.64.41.3
	TEILll7BsZ.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	188.114.96.3
	https://verify-signinoutlexchangeadmin.com/MBill@microsoft.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	Pd3mM82Bs6.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	188.114.97.3
	https://paypalgiftcardgenerator.pages.dev/	Get hash	malicious	Unknown	Browse	104.16.242.248
	https://brownpluss.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	setup_CodecInstaller_full.exe	Get hash	malicious	EICAR	Browse	172.67.130.88
	MV XH DOLPHINPDF.exe	Get hash	malicious	Lokibot	Browse	104.21.85.101
	WQs56g5xeC.exe	Get hash	malicious	DCRat	Browse	172.67.25.118
	xA4LQYIndy.exe	Get hash	malicious	DCRat	Browse	172.67.19.24
TUT-ASUS	Reiven RFQ-27-05-2024.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	ev1NIvTd6f.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	https://mega.nz/file/wncXiYhZ#ABJEpmoiGH0hIeVVKQy7V_ALtGclDnJ4rFrDjwZ8kDE	Get hash	malicious	DCRat	Browse	208.95.112.1
	uChcvn3L6R.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	uChcvn3L6R.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	SecuriteInfo.com.FileRepMalware.1834.13764.exe	Get hash	malicious	Discord Token Stealer, XWorm	Browse	208.95.112.1
	NFs_468.msi	Get hash	malicious	VMdetect	Browse	208.95.112.1
	z23mypdfscanner-invoice3535.bat	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	2aFb7hE00o.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	documentos.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	01vwXiyQ8K.exe	Get hash	malicious	Quasar	Browse	104.26.13.205
	xA4LQYIndy.exe	Get hash	malicious	DCRat	Browse	104.26.13.205
	https://kruekanlogin.gitbook.io/	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://fbreview-requestnow.github.io/ajaz	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://mega.nz/file/wncXiYhZ#ABJEpmoiGH0hIeVVKQy7V_ALtGclDnJ4rFrDjwZ8kDE	Get hash	malicious	DCRat	Browse	104.26.13.205
	wtrD6RiHlm.exe	Get hash	malicious	RedLine	Browse	104.26.13.205
	https://newsklikdisini5bekbg0.3bsz4.xyz/	Get hash	malicious	Unknown	Browse	104.26.13.205
	http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	https://v2-ci8.pages.dev/appeal_case_ID/	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://piscinaveronza.com/app/online/	Get hash	malicious	Unknown	Browse	104.26.13.205

Process:	C:\Users\user\Desktop\PO_27052024.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.9615234029225865
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.98% Win32 Executable (generic) a (10002005/4) 49.93% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	PO_27052024.exe
File size:	676'360 bytes
MD5:	4199d8995c4b86f6053c43cb70a87aa9
SHA1:	ae7d740bc01ae87d643f98264efa3b995365a66f
SHA256:	74a7dd343c4fac52d9d695d8d189a1bf3d5e5578622099bdf731544df385b75d
SHA512:	e78a6a99ae8157f295a8c0cac9a0d72da5de4f4aa9e2fbaa131996e76eeb2906593d0e2bb6e82b8b733fd080cad5af1da5cea9b60be372942ac13122d6f5bbce
SSDEEP:	12288:iuxrYCFd6xhOIHq2tGUoa/Vyljum2dQbimFl8+IjkpqyhscnFQXkR:181xh7HqmGUosV2qQbim34EhRFQC
TLSH:	80E4225033BC9320CB3A1BF49AA116114BB96F527667D3099C8BB0FE653AF544E13B4B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Sf..............0.................. ... ....@.. .......................`............@................................

File Icon


Icon Hash:	040917344b4fd9cd

Static PE Info

General

Entrypoint:	0x4a1ace
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6653E1FE [Mon May 27 01:29:34 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 01:00:00 09/11/2021 00:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa1a7c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa2000	0x1a50	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xa1c00	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9fad4	0x9fc00	239d73e9c2d02b390b9ba0f83c570f4e	False	0.9662436424100157	data	7.968838201538731	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa2000	0x1a50	0x1c00	b3ba5d878d2c7e6f09660a13aa250796	False	0.8069196428571429	data	7.169486233479109	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa4000	0xc	0x200	bd6fc07f789b07e2dced6d7c2663137d	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xa2100	0x144d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9694054262074273
RT_GROUP_ICON	0xa3560	0x14	data	1.05
RT_VERSION	0xa3584	0x2cc	data	0.4301675977653631
RT_MANIFEST	0xa3860	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 09:01:03.593501091 CEST	49703	443	192.168.2.7	104.26.13.205
May 27, 2024 09:01:03.593542099 CEST	443	49703	104.26.13.205	192.168.2.7
May 27, 2024 09:01:03.593653917 CEST	49703	443	192.168.2.7	104.26.13.205
May 27, 2024 09:01:03.602706909 CEST	49703	443	192.168.2.7	104.26.13.205
May 27, 2024 09:01:03.602727890 CEST	443	49703	104.26.13.205	192.168.2.7
May 27, 2024 09:01:04.100577116 CEST	443	49703	104.26.13.205	192.168.2.7
May 27, 2024 09:01:04.100688934 CEST	49703	443	192.168.2.7	104.26.13.205
May 27, 2024 09:01:04.110878944 CEST	49703	443	192.168.2.7	104.26.13.205
May 27, 2024 09:01:04.110898018 CEST	443	49703	104.26.13.205	192.168.2.7
May 27, 2024 09:01:04.111294985 CEST	443	49703	104.26.13.205	192.168.2.7
May 27, 2024 09:01:04.153408051 CEST	49703	443	192.168.2.7	104.26.13.205
May 27, 2024 09:01:04.159626007 CEST	49703	443	192.168.2.7	104.26.13.205
May 27, 2024 09:01:04.206510067 CEST	443	49703	104.26.13.205	192.168.2.7
May 27, 2024 09:01:04.338947058 CEST	443	49703	104.26.13.205	192.168.2.7
May 27, 2024 09:01:04.339031935 CEST	443	49703	104.26.13.205	192.168.2.7
May 27, 2024 09:01:04.339493036 CEST	49703	443	192.168.2.7	104.26.13.205
May 27, 2024 09:01:04.344737053 CEST	49703	443	192.168.2.7	104.26.13.205
May 27, 2024 09:01:04.357269049 CEST	49705	80	192.168.2.7	208.95.112.1
May 27, 2024 09:01:04.362400055 CEST	80	49705	208.95.112.1	192.168.2.7
May 27, 2024 09:01:04.362497091 CEST	49705	80	192.168.2.7	208.95.112.1
May 27, 2024 09:01:04.362554073 CEST	49705	80	192.168.2.7	208.95.112.1
May 27, 2024 09:01:04.367635965 CEST	80	49705	208.95.112.1	192.168.2.7
May 27, 2024 09:01:04.833679914 CEST	80	49705	208.95.112.1	192.168.2.7
May 27, 2024 09:01:04.887787104 CEST	49705	80	192.168.2.7	208.95.112.1
May 27, 2024 09:01:06.073101044 CEST	49705	80	192.168.2.7	208.95.112.1
May 27, 2024 09:01:06.078418016 CEST	80	49705	208.95.112.1	192.168.2.7
May 27, 2024 09:01:06.078495979 CEST	49705	80	192.168.2.7	208.95.112.1
May 27, 2024 09:01:06.314575911 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:06.319488049 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:06.319564104 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:06.883760929 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:06.883930922 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:06.888889074 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:06.997371912 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:06.997693062 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:07.003170967 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:07.112205982 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:07.112565041 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:07.117511034 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:07.469686985 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:07.469747066 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:07.469785929 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:07.469901085 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:07.470099926 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:07.470431089 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:07.484626055 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:07.489816904 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:07.598262072 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:07.600922108 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:07.605865955 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:07.713583946 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:07.716625929 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:07.721554995 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:07.830171108 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:07.830548048 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:07.835524082 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:08.046979904 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:08.067811966 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:08.072829008 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:08.181256056 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:08.231529951 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:08.253045082 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:08.258064985 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:08.376226902 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:08.376435041 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:08.381339073 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:08.489114046 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:08.490050077 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:08.490127087 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:08.490148067 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:08.490263939 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:01:08.495102882 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:08.495297909 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:08.495326996 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:08.495354891 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:08.623452902 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:01:08.669032097 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:44.671274900 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:44.671281099 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:44.676321030 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:02:44.676460981 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:44.680823088 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:44.785044909 CEST	587	49707	192.185.143.105	192.168.2.7
May 27, 2024 09:02:44.785581112 CEST	49707	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:45.260534048 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:45.260819912 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:45.265852928 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:45.387728930 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:45.388814926 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:45.393781900 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:45.509056091 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:45.513381958 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:45.518390894 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:45.646044970 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:45.646090031 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:45.646126986 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:45.646140099 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:45.652009010 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:45.656871080 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:45.782196999 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:45.786926031 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:45.792085886 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:45.904063940 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:45.904578924 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:45.909574986 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:46.021348000 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:46.021712065 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:46.026643038 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.339037895 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.339433908 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.339512110 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.339764118 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.339829922 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.340426922 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.340696096 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.340696096 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.345890045 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.457734108 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.459007978 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.464443922 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.586591005 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.590220928 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.595118046 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.706296921 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.710907936 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.711025000 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.711112022 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.711194992 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.714025021 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.715818882 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.715862036 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.716001987 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.716063976 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.716079950 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.716123104 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.718921900 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.718983889 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.719202995 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.719247103 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.719276905 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.719291925 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.719305038 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.719319105 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.719329119 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.719341040 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.719358921 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.719372034 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.720659971 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.720705032 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.720735073 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.720772982 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.720809937 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.720853090 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.720963955 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.721003056 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.723907948 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.723968983 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.724384069 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.724438906 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.724461079 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.724492073 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.724503994 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.724529028 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.724536896 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.724569082 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.724575043 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.724611044 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.725878000 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.725936890 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.725964069 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.726005077 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.726070881 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.726111889 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.726141930 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.726176977 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.726181030 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.726219893 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.729216099 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.729902983 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.729989052 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.730113983 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.730165005 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.730292082 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.730386019 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.730529070 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731003046 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731015921 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731026888 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731074095 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731089115 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731100082 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731368065 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731411934 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731436968 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731447935 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731473923 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731542110 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731561899 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731574059 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731611967 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731657982 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731703043 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731717110 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731729984 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731812000 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731823921 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731837034 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.731849909 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:47.745942116 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:02:47.750929117 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:48.071542978 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:02:48.122541904 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:03.678265095 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:03.683315039 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:03:03.795427084 CEST	587	49716	192.185.143.105	192.168.2.7
May 27, 2024 09:03:03.795978069 CEST	49716	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:03.797213078 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:03.802186966 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:03.802248955 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:04.437592030 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:04.437851906 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:04.442789078 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:04.550570011 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:04.552681923 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:04.557590961 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:04.668086052 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:04.668874025 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:04.673820972 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:04.796624899 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:04.796643972 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:04.796654940 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:04.799264908 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:04.799264908 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:04.804259062 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:04.912386894 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:04.916790009 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:04.921828032 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.029244900 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.030239105 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:05.035151005 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.144419909 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.145014048 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:05.150087118 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.259921074 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.260869026 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:05.266060114 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.373836994 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.376892090 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:05.381974936 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.506247044 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.512722015 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:05.546415091 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.667531967 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.669017076 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:05.669017076 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:05.669126034 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:05.669126034 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:05.672729015 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:05.693394899 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.693413019 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.693456888 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:05.693763018 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.693820000 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.693870068 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:05.697315931 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.697339058 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.697375059 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:05.697400093 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:05.697832108 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.697896957 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:05.728530884 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:05.728615999 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:06.044404984 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:06.074099064 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:06.074157000 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:06.074189901 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:06.734751940 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:06.780121088 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:06.780189991 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:06.787853003 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:06.804023981 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:07.459199905 CEST	49719	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:07.501451015 CEST	587	49719	192.185.143.105	192.168.2.7
May 27, 2024 09:03:07.501554012 CEST	49719	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:07.856915951 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:07.879916906 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:08.098916054 CEST	587	49719	192.185.143.105	192.168.2.7
May 27, 2024 09:03:08.099049091 CEST	49719	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:08.157995939 CEST	587	49719	192.185.143.105	192.168.2.7
May 27, 2024 09:03:08.169728041 CEST	49719	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:08.258300066 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:08.272044897 CEST	587	49719	192.185.143.105	192.168.2.7
May 27, 2024 09:03:08.272243023 CEST	49719	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:08.518531084 CEST	587	49719	192.185.143.105	192.168.2.7
May 27, 2024 09:03:08.518711090 CEST	49719	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:08.766552925 CEST	587	49719	192.185.143.105	192.168.2.7
May 27, 2024 09:03:08.766793966 CEST	49719	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:09.357234955 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:09.856940031 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:09.949295998 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:11.359497070 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:11.364327908 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:11.371239901 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:11.939224005 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:12.044612885 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:12.158510923 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:12.158638954 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:12.378506899 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:12.378601074 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:12.465843916 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:12.846813917 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:12.847573042 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:12.857016087 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:12.871445894 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:12.984203100 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:12.984462023 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:12.989448071 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.104871988 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.105432034 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.114372969 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.283516884 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.283539057 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.283550024 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.283791065 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.289354086 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.294368982 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.411185980 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.416038036 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.423459053 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.540627003 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.540899038 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.544488907 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.545842886 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.551156998 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.551224947 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.556102037 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.556205034 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.556294918 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.562747955 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.562757969 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.562767029 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.562946081 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.567769051 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.567823887 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.567835093 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.567853928 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.567871094 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.567871094 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.574393034 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.574403048 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.574445009 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.574522972 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.574688911 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.581227064 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.581238031 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.581278086 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.581284046 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.581443071 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.587486029 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.587496996 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.587534904 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.587589025 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.587703943 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.594319105 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.594331026 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.594379902 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.594968081 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.595016003 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.602300882 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.602312088 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.602374077 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.602622032 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.602669001 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.610724926 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.610735893 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.610743046 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.610780954 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.617718935 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.617906094 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.617969036 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.622798920 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.622858047 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.627804041 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.627854109 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.635603905 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.635615110 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.635669947 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.644315004 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.644326925 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.644335032 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.644387960 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.644423962 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.644438028 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.644689083 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.652851105 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.652862072 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.652872086 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.652879953 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.652918100 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.652952909 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.652956009 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.653254032 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.660818100 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.661115885 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.663661957 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.663674116 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.663739920 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.664047956 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.664235115 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.667021990 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.667032003 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.667040110 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.667092085 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.670249939 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.672024965 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.672034979 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.672972918 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.676630974 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.681731939 CEST	587	49717	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.682132959 CEST	49717	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.944252014 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:13.944499016 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:13.976752996 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:14.044711113 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:14.090399027 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:14.090854883 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:14.127072096 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:14.258857965 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:14.259145021 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:14.297904015 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:14.411372900 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:14.411695004 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:14.411829948 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:14.411829948 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:14.411914110 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:14.441013098 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:14.441026926 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:14.441287994 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:14.441318989 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:14.442970991 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:14.857150078 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:14.911364079 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:14.911504984 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:14.911689043 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:15.341511965 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:15.373754978 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:15.374077082 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:15.407038927 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:15.407052040 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:15.857067108 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:16.544586897 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:17.842413902 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:19.563200951 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:19.628757000 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:19.628977060 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:20.221684933 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:20.221966028 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:20.247714043 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:20.291886091 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:20.408648968 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:20.408916950 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:20.682677984 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:20.682815075 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:20.700750113 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:20.764079094 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:20.883038044 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:20.884027004 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:20.957694054 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:21.087186098 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:21.087203026 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:21.087214947 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:21.087410927 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:21.088920116 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:21.150626898 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:21.264411926 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:21.265837908 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:21.550533056 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:21.552687883 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:21.560689926 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:21.630188942 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:21.750778913 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:21.751244068 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:21.772695065 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:21.830857038 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:21.836072922 CEST	49722	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:21.852350950 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:21.852885008 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:22.061315060 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:22.154511929 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:22.154932022 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:22.442518950 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:22.442740917 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:22.857079029 CEST	49722	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:22.935452938 CEST	587	49722	192.185.143.105	192.168.2.7
May 27, 2024 09:03:22.935570955 CEST	49722	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:23.018819094 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:23.018968105 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:23.946518898 CEST	587	49722	192.185.143.105	192.168.2.7
May 27, 2024 09:03:23.946846008 CEST	49722	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:24.138530016 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:24.138756037 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:25.060112000 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:25.120707989 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:25.120767117 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:25.121083975 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:25.962510109 CEST	587	49722	192.185.143.105	192.168.2.7
May 27, 2024 09:03:25.962850094 CEST	49722	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:26.341658115 CEST	49722	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:26.414751053 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:26.418577909 CEST	587	49722	192.185.143.105	192.168.2.7
May 27, 2024 09:03:26.418910027 CEST	587	49722	192.185.143.105	192.168.2.7
May 27, 2024 09:03:26.419073105 CEST	49722	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:26.574542046 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:26.576833010 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:26.634610891 CEST	587	49722	192.185.143.105	192.168.2.7
May 27, 2024 09:03:26.636801958 CEST	49722	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:26.854568958 CEST	587	49722	192.185.143.105	192.168.2.7
May 27, 2024 09:03:26.854692936 CEST	49722	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:27.437407017 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:28.182512045 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:29.281393051 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:29.339029074 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:29.339101076 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:29.560194016 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:29.615032911 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:29.615291119 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:30.040417910 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:30.044815063 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:30.226516962 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:30.226630926 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:30.230252981 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:30.230472088 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:30.360852957 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:30.415198088 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:30.475718975 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:30.510483980 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:30.510633945 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:30.535990000 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:30.536173105 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:30.553843975 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:30.617063046 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:30.690407991 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:30.690582037 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:30.740793943 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:30.741350889 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:30.787446022 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:30.833534956 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:30.906817913 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:30.907341957 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:30.962825060 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:30.962851048 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:30.962861061 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:30.962924957 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:30.964176893 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:30.994381905 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:31.037013054 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:31.127408028 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:31.127422094 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:31.127432108 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:31.127531052 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:31.129904985 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:31.156347036 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:31.157160044 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:31.178643942 CEST	587	49721	192.185.143.105	192.168.2.7
May 27, 2024 09:03:31.178759098 CEST	49721	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:31.185066938 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:31.201564074 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:31.301460981 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:31.302395105 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:31.320177078 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:31.320488930 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:31.339507103 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:31.357225895 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:31.454515934 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:31.454900980 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:31.465370893 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:35.479218006 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:35.479521036 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:35.487953901 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:35.594559908 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:35.595127106 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:35.604034901 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:35.631135941 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:35.631387949 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:35.648752928 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:35.724499941 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:35.724716902 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:35.732848883 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:35.772330046 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:35.772720098 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:35.782538891 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:35.850392103 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:35.850658894 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:35.913860083 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:35.916913033 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:36.094610929 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:36.094867945 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:36.154557943 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:36.156964064 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:36.247673035 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:36.247817039 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:36.347754955 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:36.352840900 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:36.653949976 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:36.654019117 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:36.842556953 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:36.842609882 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.288580894 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.288675070 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.342061996 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.342096090 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.463401079 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.463921070 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.463921070 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.463921070 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.464731932 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.468025923 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.468190908 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.541497946 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.541517973 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.541531086 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.541547060 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.541605949 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.542614937 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.619271994 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.619388103 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.667957067 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.668320894 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.668555975 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.668555975 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.668555975 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.683835030 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.683876038 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.683892012 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.684146881 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.730573893 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.741488934 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.741579056 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.742245913 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.742506981 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.807354927 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.807569027 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.808254957 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.808566093 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.873051882 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.873169899 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.873862028 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.874063015 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.947596073 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.947632074 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:37.947686911 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:37.947834969 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:38.062783957 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:38.251631021 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:38.296668053 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:38.298790932 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:38.345453978 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:38.345490932 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:38.345587969 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:38.345587969 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:38.747668028 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:38.747668982 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.353446960 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.362016916 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.362095118 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.368725061 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.368757963 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.368778944 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.368793964 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.376518965 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.376584053 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.376658916 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.383759022 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.383779049 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.383791924 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.383810997 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.383830070 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.383856058 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.390353918 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.390368938 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.390382051 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.390402079 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.390418053 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.390440941 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.401037931 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.401086092 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.401098013 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.401102066 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.401137114 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.401164055 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.409794092 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.409826040 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.409849882 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.409869909 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.415239096 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.415328979 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.422369957 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.422430038 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.427455902 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.427515030 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.434911013 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.435020924 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.439929962 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.439992905 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.442076921 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.442130089 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.455105066 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.455180883 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.467242002 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.467325926 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.478853941 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.478925943 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.483850956 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.483906984 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.483907938 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.483948946 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.483959913 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.483973026 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.483999014 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.484010935 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.484044075 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.484061956 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.484075069 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.484116077 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.492708921 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.492739916 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.492760897 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.492764950 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.492795944 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.492810965 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.492811918 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.492837906 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.492875099 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.492882013 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.492907047 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.492930889 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.492955923 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.506804943 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.506845951 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.506975889 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.507014990 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.738953114 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.857526064 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:39.991324902 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:39.994788885 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:40.044565916 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:40.242487907 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:40.242607117 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:40.746546030 CEST	587	49718	192.185.143.105	192.168.2.7
May 27, 2024 09:03:40.748764992 CEST	49718	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:42.544773102 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:44.623378992 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:44.671988964 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:44.675123930 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:44.716739893 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:44.716764927 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:44.718857050 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:45.122700930 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:45.186697960 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.186783075 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:45.255567074 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.255592108 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.255686998 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:45.328452110 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.328468084 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.328561068 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:45.401249886 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.401262999 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.401273966 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.401350021 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:45.401612043 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:45.468353033 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.468367100 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.468444109 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.468625069 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:45.536118031 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.536230087 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.536257029 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.536288023 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:45.536407948 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:45.603883982 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.603918076 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.604067087 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:45.606621981 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.606831074 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:45.668292999 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.668524981 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:45.673104048 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:45.673211098 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:46.122885942 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:46.189064026 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:46.190566063 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:46.260993004 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:46.261023045 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:46.261280060 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:46.716464996 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:47.419955015 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:47.452805996 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:47.461708069 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:47.464868069 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:47.505157948 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:03:47.505426884 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:47.518285036 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:47.518445969 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:47.518515110 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:47.935363054 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:48.716605902 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:48.777884960 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:48.779069901 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:48.849503040 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:48.849721909 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:48.854907990 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:48.914676905 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:48.918791056 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:48.970241070 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:48.970257044 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:48.970264912 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:48.970941067 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:49.018343925 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.018357992 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.018407106 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.022989988 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:49.061959028 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.061969995 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.061978102 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.064819098 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:49.079078913 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.079144955 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.079188108 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.085045099 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:49.092677116 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.096827030 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:49.102113962 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.102123976 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.102132082 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.102174997 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.105247974 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:49.110331059 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.110346079 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.110354900 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.110415936 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.110424995 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.110492945 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.110603094 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:49.110603094 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:03:49.115722895 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.115732908 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.115787029 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.115796089 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.115803957 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.115812063 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.115833998 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.115843058 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.120558977 CEST	587	49720	192.185.143.105	192.168.2.7
May 27, 2024 09:03:49.123080969 CEST	49720	587	192.168.2.7	192.185.143.105
May 27, 2024 09:04:06.420871019 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:04:44.232249022 CEST	49723	587	192.168.2.7	192.185.143.105
May 27, 2024 09:04:44.296643019 CEST	587	49723	192.185.143.105	192.168.2.7
May 27, 2024 09:04:44.296843052 CEST	49723	587	192.168.2.7	192.185.143.105

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 09:01:03.578519106 CEST	64818	53	192.168.2.7	1.1.1.1
May 27, 2024 09:01:03.585933924 CEST	53	64818	1.1.1.1	192.168.2.7
May 27, 2024 09:01:04.349803925 CEST	65110	53	192.168.2.7	1.1.1.1
May 27, 2024 09:01:04.356674910 CEST	53	65110	1.1.1.1	192.168.2.7
May 27, 2024 09:01:06.073719025 CEST	51077	53	192.168.2.7	1.1.1.1
May 27, 2024 09:01:06.313970089 CEST	53	51077	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 27, 2024 09:01:03.578519106 CEST	192.168.2.7	1.1.1.1	0xb353	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
May 27, 2024 09:01:04.349803925 CEST	192.168.2.7	1.1.1.1	0x6cdb	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
May 27, 2024 09:01:06.073719025 CEST	192.168.2.7	1.1.1.1	0xe2d9	Standard query (0)	mail.alitextile.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 27, 2024 09:01:03.585933924 CEST	1.1.1.1	192.168.2.7	0xb353	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
May 27, 2024 09:01:03.585933924 CEST	1.1.1.1	192.168.2.7	0xb353	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
May 27, 2024 09:01:03.585933924 CEST	1.1.1.1	192.168.2.7	0xb353	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
May 27, 2024 09:01:04.356674910 CEST	1.1.1.1	192.168.2.7	0x6cdb	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
May 27, 2024 09:01:06.313970089 CEST	1.1.1.1	192.168.2.7	0xe2d9	No error (0)	mail.alitextile.com	192.185.143.105	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49705	208.95.112.1	80	5956	C:\Users\user\Desktop\PO_27052024.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 09:01:04.362554073 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
May 27, 2024 09:01:04.833679914 CEST	175	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 07:01:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49703	104.26.13.205	443	5956	C:\Users\user\Desktop\PO_27052024.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 07:01:04 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-27 07:01:04 UTC	211	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 07:01:04 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 88a421ad5a5a43e0-EWR
2024-05-27 07:01:04 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 37 35 Data Ascii: 8.46.123.175

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 27, 2024 09:01:06.883760929 CEST	587	49707	192.185.143.105	192.168.2.7	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 02:01:06 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 09:01:06.883930922 CEST	49707	587	192.168.2.7	192.185.143.105	EHLO 124406
May 27, 2024 09:01:06.997371912 CEST	587	49707	192.185.143.105	192.168.2.7	250-cutlass.websitewelcome.com Hello 124406 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 09:01:06.997693062 CEST	49707	587	192.168.2.7	192.185.143.105	STARTTLS
May 27, 2024 09:01:07.112205982 CEST	587	49707	192.185.143.105	192.168.2.7	220 TLS go ahead
May 27, 2024 09:02:45.260534048 CEST	587	49716	192.185.143.105	192.168.2.7	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 02:02:45 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 09:02:45.260819912 CEST	49716	587	192.168.2.7	192.185.143.105	EHLO 124406
May 27, 2024 09:02:45.387728930 CEST	587	49716	192.185.143.105	192.168.2.7	250-cutlass.websitewelcome.com Hello 124406 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 09:02:45.388814926 CEST	49716	587	192.168.2.7	192.185.143.105	STARTTLS
May 27, 2024 09:02:45.509056091 CEST	587	49716	192.185.143.105	192.168.2.7	220 TLS go ahead
May 27, 2024 09:03:04.437592030 CEST	587	49717	192.185.143.105	192.168.2.7	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 02:03:04 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 09:03:04.437851906 CEST	49717	587	192.168.2.7	192.185.143.105	EHLO 124406
May 27, 2024 09:03:04.550570011 CEST	587	49717	192.185.143.105	192.168.2.7	250-cutlass.websitewelcome.com Hello 124406 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 09:03:04.552681923 CEST	49717	587	192.168.2.7	192.185.143.105	STARTTLS
May 27, 2024 09:03:04.668086052 CEST	587	49717	192.185.143.105	192.168.2.7	220 TLS go ahead
May 27, 2024 09:03:08.098916054 CEST	587	49719	192.185.143.105	192.168.2.7	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 02:03:08 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 09:03:08.099049091 CEST	49719	587	192.168.2.7	192.185.143.105	EHLO 124406
May 27, 2024 09:03:08.272044897 CEST	587	49719	192.185.143.105	192.168.2.7	250-cutlass.websitewelcome.com Hello 124406 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 09:03:08.518531084 CEST	587	49719	192.185.143.105	192.168.2.7	250-cutlass.websitewelcome.com Hello 124406 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 09:03:08.766552925 CEST	587	49719	192.185.143.105	192.168.2.7	250-cutlass.websitewelcome.com Hello 124406 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 09:03:11.939224005 CEST	587	49720	192.185.143.105	192.168.2.7	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 02:03:11 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 09:03:12.158510923 CEST	587	49720	192.185.143.105	192.168.2.7	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 02:03:11 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 09:03:12.378506899 CEST	587	49720	192.185.143.105	192.168.2.7	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 02:03:11 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 09:03:12.465843916 CEST	49720	587	192.168.2.7	192.185.143.105	EHLO 124406
May 27, 2024 09:03:12.846813917 CEST	587	49720	192.185.143.105	192.168.2.7	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 02:03:11 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 09:03:12.857016087 CEST	49720	587	192.168.2.7	192.185.143.105	EHLO 124406
May 27, 2024 09:03:12.984203100 CEST	587	49720	192.185.143.105	192.168.2.7	250-cutlass.websitewelcome.com Hello 124406 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 09:03:12.984462023 CEST	49720	587	192.168.2.7	192.185.143.105	STARTTLS
May 27, 2024 09:03:13.104871988 CEST	587	49720	192.185.143.105	192.168.2.7	220 TLS go ahead
May 27, 2024 09:03:20.221684933 CEST	587	49721	192.185.143.105	192.168.2.7	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 02:03:20 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 09:03:20.221966028 CEST	49721	587	192.168.2.7	192.185.143.105	EHLO 124406
May 27, 2024 09:03:20.408648968 CEST	587	49721	192.185.143.105	192.168.2.7	250-cutlass.websitewelcome.com Hello 124406 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 09:03:20.408916950 CEST	49721	587	192.168.2.7	192.185.143.105	STARTTLS
May 27, 2024 09:03:20.682677984 CEST	587	49721	192.185.143.105	192.168.2.7	250-cutlass.websitewelcome.com Hello 124406 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 09:03:20.700750113 CEST	49721	587	192.168.2.7	192.185.143.105	STARTTLS
May 27, 2024 09:03:20.883038044 CEST	587	49721	192.185.143.105	192.168.2.7	220 TLS go ahead
May 27, 2024 09:03:30.040417910 CEST	587	49718	192.185.143.105	192.168.2.7	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 02:03:29 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 09:03:30.044815063 CEST	49718	587	192.168.2.7	192.185.143.105	EHLO 124406
May 27, 2024 09:03:30.226516962 CEST	587	49718	192.185.143.105	192.168.2.7	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 02:03:29 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 09:03:30.230252981 CEST	587	49723	192.185.143.105	192.168.2.7	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 02:03:30 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 09:03:30.230472088 CEST	49723	587	192.168.2.7	192.185.143.105	EHLO 124406
May 27, 2024 09:03:30.360852957 CEST	49718	587	192.168.2.7	192.185.143.105	EHLO 124406
May 27, 2024 09:03:30.475718975 CEST	49723	587	192.168.2.7	192.185.143.105	EHLO 124406
May 27, 2024 09:03:30.510483980 CEST	587	49723	192.185.143.105	192.168.2.7	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 02:03:30 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 09:03:30.535990000 CEST	587	49718	192.185.143.105	192.168.2.7	250-cutlass.websitewelcome.com Hello 124406 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 09:03:30.536173105 CEST	49718	587	192.168.2.7	192.185.143.105	STARTTLS
May 27, 2024 09:03:30.690407991 CEST	587	49723	192.185.143.105	192.168.2.7	250-cutlass.websitewelcome.com Hello 124406 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 09:03:30.690582037 CEST	49723	587	192.168.2.7	192.185.143.105	STARTTLS
May 27, 2024 09:03:30.740793943 CEST	587	49718	192.185.143.105	192.168.2.7	220 TLS go ahead
May 27, 2024 09:03:30.906817913 CEST	587	49723	192.185.143.105	192.168.2.7	220 TLS go ahead

Target ID:	0
Start time:	03:01:00
Start date:	27/05/2024
Path:	C:\Users\user\Desktop\PO_27052024.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO_27052024.exe"
Imagebase:	0x350000
File size:	676'360 bytes
MD5 hash:	4199D8995C4B86F6053C43CB70A87AA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1230653583.000000000390E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1230653583.000000000390E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:01:01
Start date:	27/05/2024
Path:	C:\Users\user\Desktop\PO_27052024.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\PO_27052024.exe"
Imagebase:	0x40000
File size:	676'360 bytes
MD5 hash:	4199D8995C4B86F6053C43CB70A87AA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:01:02
Start date:	27/05/2024
Path:	C:\Users\user\Desktop\PO_27052024.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO_27052024.exe"
Imagebase:	0xc60000
File size:	676'360 bytes
MD5 hash:	4199D8995C4B86F6053C43CB70A87AA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3686376787.000000000319D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3666284064.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.3666284064.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:01:05
Start date:	27/05/2024
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff6f54a0000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	198
Total number of Limit Nodes:	12

Executed Functions

Function 068F02D8 Relevance: .9, Instructions: 931COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1232635150.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_68f0000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c280dc5f34caf8f34337484bc3ba21eabd7f1df4116b53fa36d81623d8a5cff9
Instruction ID: cb40f566e2af4c194ec421d9bc9d7d683ea71eb169704fd57456215a5c5cbcf9
Opcode Fuzzy Hash: c280dc5f34caf8f34337484bc3ba21eabd7f1df4116b53fa36d81623d8a5cff9
Instruction Fuzzy Hash: 1AA22831E102598FDB55DF68C8986EDB7B1FF89300F1482A9D90AA7350EB74AE85CF50

Function 08084B62 Relevance: 30.6, Strings: 24, Instructions: 565COMMON

Download Yara Rule

Strings

fq, xrefs: 08084C8C
XXq, xrefs: 08084F6C
XXq, xrefs: 08084FF9
fq, xrefs: 0808519B
Teq, xrefs: 08084E11
$q, xrefs: 08085280
fq, xrefs: 08084C72
fq, xrefs: 08084CFD
$q, xrefs: 080850CC
fq, xrefs: 080852F0
XXq, xrefs: 08084F7C
$q, xrefs: 080850DC
$q, xrefs: 080851AB
$q, xrefs: 08085290
XXq, xrefs: 08084E93
$q, xrefs: 080851CD
XXq, xrefs: 08084FC2
XXq, xrefs: 08084ED8
Teq, xrefs: 08085007
fq, xrefs: 08084C66
Teq, xrefs: 08085013
XXq, xrefs: 08084FB2
fq, xrefs: 08085300
$q, xrefs: 080851C1

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID: fq$ fq$ fq$ fq$ fq$ fq$ fq$Teq$Teq$Teq$XXq$XXq$XXq$XXq$XXq$XXq$XXq$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-744876897
Opcode ID: 8e5c7d7de1fbc4e1711610f433d927867c4fe2bb1b0aca8f68cdd0dd99d2787f
Instruction ID: f82165466f123e1180ffd7d10efbd1255c0139b557eb77d8f6c94bcf2be49cea
Opcode Fuzzy Hash: 8e5c7d7de1fbc4e1711610f433d927867c4fe2bb1b0aca8f68cdd0dd99d2787f
Instruction Fuzzy Hash: B2227430E0021DCFDB54EB99D855B6DB7B3BB89302F244569E842AF395CB709C82CB95

Function 080833E8 Relevance: 15.4, Strings: 12, Instructions: 432
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 08083841
Teq, xrefs: 080836CC
$q, xrefs: 080838E2
$q, xrefs: 080838EE
Teq, xrefs: 080836DC
Teq, xrefs: 08083491
Teq, xrefs: 0808366F
Teq, xrefs: 08083444
Teq, xrefs: 080835D7
Teq, xrefs: 0808355F
$q, xrefs: 08083835
Teq, xrefs: 0808367F

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID: Teq$Teq$Teq$Teq$Teq$Teq$Teq$Teq$$q$$q$$q$$q
API String ID: 0-104986846
Opcode ID: 3398c8961806f555e86e29c84f2f130818a89587a223d67365f9701ada9c3e96
Instruction ID: 62a4d3b7e72992fe3a13edf069c423a616d09d6e12c9754efb69c278fa3ba479
Opcode Fuzzy Hash: 3398c8961806f555e86e29c84f2f130818a89587a223d67365f9701ada9c3e96
Instruction Fuzzy Hash: ABF19474B00218DFEB14AB69D45976DBBE3BFC8B06F158429E542DB384CA74DC82CB91

Function 08084FF5 Relevance: 10.2, Strings: 8, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XXq, xrefs: 08084FF9
fq, xrefs: 0808519B
$q, xrefs: 080851AB
$q, xrefs: 08085280
Teq, xrefs: 08085007
$q, xrefs: 080850CC
fq, xrefs: 080852F0
$q, xrefs: 080851C1

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID: fq$ fq$Teq$XXq$$q$$q$$q$$q
API String ID: 0-3618247764
Opcode ID: f59b6b8a3edcc8f5951a6c54a6de25ba8adb80f999c71dbaae0afde6a1be58fc
Instruction ID: 53450956f99824b75eec56eafdecb8d53d357075039d605b0e304d4ab18fce6e
Opcode Fuzzy Hash: f59b6b8a3edcc8f5951a6c54a6de25ba8adb80f999c71dbaae0afde6a1be58fc
Instruction Fuzzy Hash: E4718530E04218DFDB649B98E945BADB7B3EB45313F18416AE482AB291C7309CC2CF55

Function 08084FDC Relevance: 10.2, Strings: 8, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XXq, xrefs: 08084FF9
fq, xrefs: 0808519B
$q, xrefs: 080851AB
$q, xrefs: 08085280
Teq, xrefs: 08085007
$q, xrefs: 080850CC
fq, xrefs: 080852F0
$q, xrefs: 080851C1

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID: fq$ fq$Teq$XXq$$q$$q$$q$$q
API String ID: 0-3618247764
Opcode ID: 9c04721374788a2795dd40a5627814ab9b2121a80a3abeaca7dc5a38d1f6adbf
Instruction ID: b863732aca7cb1f0d93a34f0fd79580056f12abcb080ba93024e500f246c6671
Opcode Fuzzy Hash: 9c04721374788a2795dd40a5627814ab9b2121a80a3abeaca7dc5a38d1f6adbf
Instruction Fuzzy Hash: D1716330E04218DFDB64AB98D945BADB7B3EB45313F19416AE982AB291C7309CC2CF55

Function 08088B50 Relevance: 7.7, Strings: 6, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LRq, xrefs: 08088C00
LRq, xrefs: 08088D27
$q, xrefs: 08088CC8
LRq, xrefs: 08088BF2
$q, xrefs: 08088CB8
LRq, xrefs: 08088D35

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID: LRq$LRq$LRq$LRq$$q$$q
API String ID: 0-108259318
Opcode ID: 0a90da0d2ac666be64bed850c3d7480573d045c50781c191c03635badf255f73
Instruction ID: 3fb6f71d773433978b6a03d6c8039a7dee18f8ffcf2c20fac1c4bdd16ef52505
Opcode Fuzzy Hash: 0a90da0d2ac666be64bed850c3d7480573d045c50781c191c03635badf255f73
Instruction Fuzzy Hash: CF718C71A04218CFD714AFADC4447ADBBF3EB85313F88C17AE496AB292C6349D80CB55

Function 08083C30 Relevance: 7.7, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LRq, xrefs: 08084499
$q, xrefs: 080844DC
LRq, xrefs: 080844A7
8q, xrefs: 08083DE9
8q, xrefs: 08083E20
8q, xrefs: 08083DF7

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID: 8q$8q$8q$LRq$LRq$$q
API String ID: 0-2554755
Opcode ID: 13d44a9f4c40569cd1f2d14c532dfce0fc17abbf963bc91f200a725352813ce2
Instruction ID: 17af51a4ac25bbe32a0b3cc2580192e290b463c1c7543e4a715080fb5b664cd6
Opcode Fuzzy Hash: 13d44a9f4c40569cd1f2d14c532dfce0fc17abbf963bc91f200a725352813ce2
Instruction Fuzzy Hash: 43515630608394DFD716662DA81536A7FD7AFC2A03F1584BED4C5CB3C6CA388882C792

Function 08088B4C Relevance: 3.9, Strings: 3, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LRq, xrefs: 08088D27
LRq, xrefs: 08088BF2
$q, xrefs: 08088CB8

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID: LRq$LRq$$q
API String ID: 0-3129049701
Opcode ID: 03ccb8c9d90da510d799969a0d75d9b84f5b1d4681c0764bd35e6398735f777c
Instruction ID: b680c755b3da58958dc42b557e9f721d9cb3ebe1eb6150273ae124e8ac6b5ddf
Opcode Fuzzy Hash: 03ccb8c9d90da510d799969a0d75d9b84f5b1d4681c0764bd35e6398735f777c
Instruction Fuzzy Hash: 05616C71A05218CFD754AFACC844BBDB7F3EB85353F89C17AE495AB292D23489C08B51

Function 08083707 Relevance: 2.7, Strings: 2, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 080838E2
$q, xrefs: 08083835

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 042050248628d7e1d639b30ca76ebcaf2ceb7b5300e604e5de79ebf3da1086f8
Instruction ID: f0a8423d20ccc9ae08694421eb71d1cb9a62303bdc2128e4ba8e952dceaec13f
Opcode Fuzzy Hash: 042050248628d7e1d639b30ca76ebcaf2ceb7b5300e604e5de79ebf3da1086f8
Instruction Fuzzy Hash: FD719274B00214DFDB24AB64E819B6D7BA3FFC4B46F158529F642DB384CA74C882CB91

Function 08083792 Relevance: 2.7, Strings: 2, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 080838E2
$q, xrefs: 08083835

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 0aa266a36827542d25b26c1ca67288a928adbaed64c36eaa67f8a54a82f9b5e9
Instruction ID: 5ce6cbd1fcccce474f6faeb41a301e02f595ec3e8e4b856cb00dd8a4b2c85046
Opcode Fuzzy Hash: 0aa266a36827542d25b26c1ca67288a928adbaed64c36eaa67f8a54a82f9b5e9
Instruction Fuzzy Hash: 5751A534B01214EFD714AB74E819B6D7BA3EFC4745F158529FA11DB384CA748C42CB91

Function 0808E450 Relevance: 2.7, Strings: 2, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Teq, xrefs: 0808E5D5
Teq, xrefs: 0808E596

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID: Teq$Teq
API String ID: 0-2938103587
Opcode ID: 39279552e629e2407c7de886effdb2a2f4c7e98d30d55ca3ee7a876f8df9b07f
Instruction ID: 025c948c39a43bc82e3bdd974bcabfcd624f5360482e1bb92661301675014675
Opcode Fuzzy Hash: 39279552e629e2407c7de886effdb2a2f4c7e98d30d55ca3ee7a876f8df9b07f
Instruction Fuzzy Hash: D461D4B4E04208CFDB04DFA9D844AEEBBB6FF88305F149029E919AB355DB705945CF50

Function 08085D10 Relevance: 2.6, Strings: 2, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

l.q, xrefs: 08086134
l.q, xrefs: 08086140

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID: l.q$l.q
API String ID: 0-1956521479
Opcode ID: 78cbee520b31c4b1432e647d8d29e428a485385bce5c379e5a7228a17761d6bd
Instruction ID: b12a3d9c5a884cced2a0ca6ae238f39e2c8246e98bed329c653f8b7670259971
Opcode Fuzzy Hash: 78cbee520b31c4b1432e647d8d29e428a485385bce5c379e5a7228a17761d6bd
Instruction Fuzzy Hash: EB31C831A05644CFC7159F2CCC456AEBBF2EF06312F44496AE8A5D73A1D334D891CB51

Function 08087180 Relevance: 2.6, Strings: 2, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 08087531
Hq, xrefs: 080873AF

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID: Hq$Hq
API String ID: 0-925789375
Opcode ID: f7b976b2c007cd56c7377cb0d8013fa1b6a762b72248070be61ca750b04a0dd0
Instruction ID: 14c328b6daa37a37b6f672cbbe1d638cd5d7c0a2ac019e0a885b31e45c4ad356
Opcode Fuzzy Hash: f7b976b2c007cd56c7377cb0d8013fa1b6a762b72248070be61ca750b04a0dd0
Instruction Fuzzy Hash: E221D870608390DFE722966CED54B6A7FB5EB85311F14046AF086CB696C2789D85C711

Function 069F51FD Relevance: 1.7, APIs: 1, Instructions: 247processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 069F543E

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 67a854452867b9ab89163996637b2fc67d6acee3a9ec10de04c4619aa83832a5
Instruction ID: 350d3261fdea0b74e0c50aff7959baa70b8289710b8852547cb837fe1414e3da
Opcode Fuzzy Hash: 67a854452867b9ab89163996637b2fc67d6acee3a9ec10de04c4619aa83832a5
Instruction Fuzzy Hash: B6A19C71D10719CFEB60CFA8C840BEDBBB2BF48310F1685A9D909A7240DB749981CF91

Function 069F5208 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 069F543E

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ce54caa3fff06e0b79db1cc723789c55ddc6bae8301343ca06af6b58eb78d38a
Instruction ID: 55b93a44a35abda52f3b3b1e78326b102cecb9c5df5f92c67adc388dce364f0b
Opcode Fuzzy Hash: ce54caa3fff06e0b79db1cc723789c55ddc6bae8301343ca06af6b58eb78d38a
Instruction Fuzzy Hash: 7E919C71D10719CFEB64CFA8C840BEDBBB2BF48310F1681A9E919A7640DB749985CF91

Function 04B744B0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 04B759C9

Memory Dump Source

Source File: 00000000.00000002.1231705458.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_PO_27052024.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0889c9419686f1edcf8793f35a1ab0d9aaf3694960218d94ffe10a0f58bf201f
Instruction ID: 9d0d66ea40cfea98920b883cb0a29884e06bd0bc4ae571f80226c7259deaaa7d
Opcode Fuzzy Hash: 0889c9419686f1edcf8793f35a1ab0d9aaf3694960218d94ffe10a0f58bf201f
Instruction Fuzzy Hash: 2041E071D00719DBEB24DFA9C84478DBBF1FF49304F20806AD418AB251DB756946CF90

Function 04B7590D Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 04B759C9

Memory Dump Source

Source File: 00000000.00000002.1231705458.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_PO_27052024.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3acb846924e0770b337f860d0fff0ac8f3b18126ee220ff0d507b0aeb0e0778e
Instruction ID: 1c4af992f72310d35b3a0da0a012ba33759e1c9c3a2e803e125b311b331be04a
Opcode Fuzzy Hash: 3acb846924e0770b337f860d0fff0ac8f3b18126ee220ff0d507b0aeb0e0778e
Instruction Fuzzy Hash: 3341EFB1D00719CBEB24DFA9C88478DBBF2BF49304F2081AAD418AB261DB756946CF40

Function 068F52A0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 068F523F

Memory Dump Source

Source File: 00000000.00000002.1232635150.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_68f0000_PO_27052024.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 02cbf47a6df8295c1270ff34cf2db256c48250b29d8953b2af1283f82d12d1d8
Instruction ID: 077ee6cdd2a597c6d997f1299ce5436d3d3f9047fe46880b1e5705c1a6c3d706
Opcode Fuzzy Hash: 02cbf47a6df8295c1270ff34cf2db256c48250b29d8953b2af1283f82d12d1d8
Instruction Fuzzy Hash: 7D214771D247405FD7308BAED8047AEFFE49F6A324F08816EE349C7542C275954ACB62

Function 04B7D751 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,04B7D656,?,?,?,?,?), ref: 04B7D717

Memory Dump Source

Source File: 00000000.00000002.1231705458.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_PO_27052024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3ddb7678af5b1b620f42e1cc0fac3f6f82887dabebac67096f727cddd53fbdeb
Instruction ID: bf18bc80bdf0a808173a754fcad3bdb62868bd6ba52999e93f19cde18b851fbb
Opcode Fuzzy Hash: 3ddb7678af5b1b620f42e1cc0fac3f6f82887dabebac67096f727cddd53fbdeb
Instruction Fuzzy Hash: CB317E78A403848FE304DF65E4447797BB2EBC8322F51856AE9129B3D5CABD4C45CB21

Function 068F5160 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 068F523F

Memory Dump Source

Source File: 00000000.00000002.1232635150.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_68f0000_PO_27052024.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 32a54966f4978859d083f3a6c4d13d37eea37a3cd52b16d169986d5471e4a090
Instruction ID: bcdb1fb6c86f884d6d22d3c203a05b4659d1df380f420b6fb2fb2250366ef035
Opcode Fuzzy Hash: 32a54966f4978859d083f3a6c4d13d37eea37a3cd52b16d169986d5471e4a090
Instruction Fuzzy Hash: 43216B769003499FDB11CFA9D840AAEBBF5EF58310F14841AEA55E7211C331E555CFA1

Function 069F4F78 Relevance: 1.6, APIs: 1, Instructions: 73injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 069F5010

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b8947a87f3c70dad0f39d9a6cd4bdf6aeb3b397ba3faea48e5c13012e7ac2c66
Instruction ID: 5ca4bf67fbf001d930434537c680b937a76f377d1749bb7e287e9946b14411b5
Opcode Fuzzy Hash: b8947a87f3c70dad0f39d9a6cd4bdf6aeb3b397ba3faea48e5c13012e7ac2c66
Instruction Fuzzy Hash: 6A212475D103499FDB20CFA9C881BEEBBF1FF48314F14842AE959A7240C7799941CBA0

Function 068F51A0 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 068F523F

Memory Dump Source

Source File: 00000000.00000002.1232635150.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_68f0000_PO_27052024.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 9b0056dde8e6d4c5c16f05c8b2aeef2cfcd711d2904a27bd1dba8158314fdb19
Instruction ID: 9ac269a79f78def7982cb8184ca28e1c31a287a766727d9fc3313fd585e0c152
Opcode Fuzzy Hash: 9b0056dde8e6d4c5c16f05c8b2aeef2cfcd711d2904a27bd1dba8158314fdb19
Instruction Fuzzy Hash: 2031DFB5D103099FDB10CF99D880AAEBBF5FF58320F24842AE919A7210D775A945CFA1

Function 068F51A8 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 068F523F

Memory Dump Source

Source File: 00000000.00000002.1232635150.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_68f0000_PO_27052024.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 7a4862bb0e1409e9b82f536cd400a9ece32408f989ae2de6b1ecfb3a900fe19f
Instruction ID: 8bda68f5245e160a2ea1861fc3b44340f8147a447dadad537c85d7ded5cf42fa
Opcode Fuzzy Hash: 7a4862bb0e1409e9b82f536cd400a9ece32408f989ae2de6b1ecfb3a900fe19f
Instruction Fuzzy Hash: 0E21EEB5D003099FDB10CF9AD884A9EFBF5FB58320F14842AEA19A7210D775A944CFA1

Function 069F4F80 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 069F5010

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b81975fe2e9015df3e602afaa489eb9865b86d21de6bcc92a5196c7fd4795d1a
Instruction ID: f0255966b762d0e27e13a25df3e998dfb5380e3ca8c1ba48b444f876c1ed094c
Opcode Fuzzy Hash: b81975fe2e9015df3e602afaa489eb9865b86d21de6bcc92a5196c7fd4795d1a
Instruction Fuzzy Hash: 30216671D003099FDB10CFAAC881BDEBBF5FF48310F50842AE919A7240C7799940CBA0

Function 069F4DE0 Relevance: 1.6, APIs: 1, Instructions: 67threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 069F4E66

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 2c2b72f01c2591d118ba91b648bd23326d2088a1a49488b47ef9c60cd657acb8
Instruction ID: ca5478acb9a642ef3fa7302f45f59ae629b5972ffe8d05e43a8fa216bea65c15
Opcode Fuzzy Hash: 2c2b72f01c2591d118ba91b648bd23326d2088a1a49488b47ef9c60cd657acb8
Instruction Fuzzy Hash: 48213471D003498FDB10DFAAC485BEEBBF4AF48224F64842AD569A7641CB789945CFA0

Function 069F506C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 069F50F0

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 997135c6942711c48c1b92327ffc35fe421051c483cd37d7c8d0fab97b9e673d
Instruction ID: ed5fa037d98804c0d010072974028f3d790cdbe483f17a062ce5b18ab2258e7b
Opcode Fuzzy Hash: 997135c6942711c48c1b92327ffc35fe421051c483cd37d7c8d0fab97b9e673d
Instruction Fuzzy Hash: 0E212271C003499FDB10DFAAC881BEEBBF5FF48310F51842AE919A7240C7799901CBA0

Function 04B7D27C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,04B7D656,?,?,?,?,?), ref: 04B7D717

Memory Dump Source

Source File: 00000000.00000002.1231705458.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_PO_27052024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ab455056b7bd95534671d89f7673978623e77a6a8cf3c7f673921a100a883805
Instruction ID: a9dc94637a401c26668b0cdcf5d37048acc10c766066a64800572f50ad1fceee
Opcode Fuzzy Hash: ab455056b7bd95534671d89f7673978623e77a6a8cf3c7f673921a100a883805
Instruction Fuzzy Hash: FA2105B5D00348AFDB10CF9AD884ADEBBF9EB48310F14805AE928B3310D375A940CFA5

Function 069F5070 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 069F50F0

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b51150771a944f84bdbf0a336b5fdcc479a630a97225c3faa2bb8683af7a62e8
Instruction ID: 126ec9e1675e5fc1b6493975782ba1806a069afa3f2a46345aa42c0c0f4859f0
Opcode Fuzzy Hash: b51150771a944f84bdbf0a336b5fdcc479a630a97225c3faa2bb8683af7a62e8
Instruction Fuzzy Hash: 47212571D003499FDB10DFAAC881BEEBBF5FF48310F51842AE919A7240C779A901CBA4

Function 069F4DE8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 069F4E66

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 11ffd4e6570c2d49d05c868fe0a018e7e7f58d40504e28759cc024151ed99b5c
Instruction ID: 2ffd7b03ae9a641e877d5cdce85f96941a7b57f24a206f0c4acb798f64e01fec
Opcode Fuzzy Hash: 11ffd4e6570c2d49d05c868fe0a018e7e7f58d40504e28759cc024151ed99b5c
Instruction Fuzzy Hash: 67213571D103098FDB10DFAAC485BEEBBF4EF48324F55842AD529A7241CB78A945CFA4

Function 04B7D68F Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,04B7D656,?,?,?,?,?), ref: 04B7D717

Memory Dump Source

Source File: 00000000.00000002.1231705458.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_PO_27052024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0a88a1ceb530e92ba37672c48bfabcc3893f5b3e9db1df72bb169ca29b2d8133
Instruction ID: 7f482c609ffdf19a9244dab44f9b07e7a896c4c1f3f65605c52d2dd7035496b8
Opcode Fuzzy Hash: 0a88a1ceb530e92ba37672c48bfabcc3893f5b3e9db1df72bb169ca29b2d8133
Instruction Fuzzy Hash: C521E4B5D002489FDB10CF9AD484ADEBFF5EB48310F14801AE928A3350C379A941CFA1

Function 069F4EB8 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 069F4F2E

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f74ad0848234a0b87382f191102d53e04327573385ba047c75ffa66f202532af
Instruction ID: d6904b500ab20f46451fd5bfdb232b2a1f0821f9919f3067182ad4edb72d4a1e
Opcode Fuzzy Hash: f74ad0848234a0b87382f191102d53e04327573385ba047c75ffa66f202532af
Instruction Fuzzy Hash: C4218631C002498FDB20CFAAD845BEEBFF1EF48320F208819E919A7250CB3A9501CF90

Function 04B7A130 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04B7B079,00000800,00000000,00000000), ref: 04B7B28A

Memory Dump Source

Source File: 00000000.00000002.1231705458.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_PO_27052024.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 13215e4dba4370c20524b861649c0e6bbb1d48300fba58222d302b33ef1a10c4
Instruction ID: b56fee9c9658e24aef4da7151d8daeb78c1e2fe4bd23ee077be6ed58b82aeb30
Opcode Fuzzy Hash: 13215e4dba4370c20524b861649c0e6bbb1d48300fba58222d302b33ef1a10c4
Instruction Fuzzy Hash: CF1133B6D043089FDB20CF9AC444BDEFBF4EB48314F10842AD929A7210C375A505CFA4

Function 069F4EC0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 069F4F2E

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ccfa93387f5ddefd1198ee9acb4aaa7418a137ab72119b3ba56167d209c1d16b
Instruction ID: 4415850cbfc809bea27222ed965808444a404a44481ec526d8fdc2dc8e310bbc
Opcode Fuzzy Hash: ccfa93387f5ddefd1198ee9acb4aaa7418a137ab72119b3ba56167d209c1d16b
Instruction Fuzzy Hash: C2112671D003499FDB20DFAAC845BDFBBF5EB48324F248419E519A7250CB75A941CFA0

Function 069F4D31 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 069F4D9A

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5cb8b845f147899a1ec5f36581617a976a30c3703b3d70b3cb93491410e9c90d
Instruction ID: 0f7eebae4886ca083278b9421a1626888ec3767abc934e183f20c4661be22a89
Opcode Fuzzy Hash: 5cb8b845f147899a1ec5f36581617a976a30c3703b3d70b3cb93491410e9c90d
Instruction Fuzzy Hash: 3E116475D003498FDB20DFAAD4457EEFBF5AF88224F24881EC559A7640CA796801CF94

Function 04B7B21F Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04B7B079,00000800,00000000,00000000), ref: 04B7B28A

Memory Dump Source

Source File: 00000000.00000002.1231705458.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_PO_27052024.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 17a3e0f4f3cc57e8baf6279d09d45f053408be6be44f4b7b7ca662f15efdede8
Instruction ID: e68cf9a90a1f24cd5ff2604bdd437d2034481c97fe613e98c07fc6f43c69b642
Opcode Fuzzy Hash: 17a3e0f4f3cc57e8baf6279d09d45f053408be6be44f4b7b7ca662f15efdede8
Instruction Fuzzy Hash: C31112B6C043098FDB20CF9AD444ADEFBF4EB48314F10842AD929A7210C779A545CFA5

Function 068F560C Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,068F7EB1,?,?), ref: 068F8058

Memory Dump Source

Source File: 00000000.00000002.1232635150.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_68f0000_PO_27052024.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2c98632d1940e41a97f782f3f9a58a372e3318ad054359e4b701f4de06092f03
Instruction ID: dcd7cc1797053d2cba4f310311a2e9f86bfc5d4c597e9020ae11e0db92df5309
Opcode Fuzzy Hash: 2c98632d1940e41a97f782f3f9a58a372e3318ad054359e4b701f4de06092f03
Instruction Fuzzy Hash: DB1158B18003498FDB20DF99C445BDEBBF4EB48320F108419D618A7240D779A944CFA4

Function 068F7FF8 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,068F7EB1,?,?), ref: 068F8058

Memory Dump Source

Source File: 00000000.00000002.1232635150.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_68f0000_PO_27052024.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9de6390cd091b96afcc8f26538d8d36b3ec9664e2efce6ff0ce1fbc2b9216967
Instruction ID: 55f4f688d092806ef7c8615a3c814c003f8c3b0230d3993640a978580d0556f8
Opcode Fuzzy Hash: 9de6390cd091b96afcc8f26538d8d36b3ec9664e2efce6ff0ce1fbc2b9216967
Instruction Fuzzy Hash: BF1146B58003498FCB20DF99C445BDEBFF4EB48320F10841ADA68A7241C779A545CFA1

Function 04B7A0CC Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,04B7ADC4), ref: 04B7AFFE

Memory Dump Source

Source File: 00000000.00000002.1231705458.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_PO_27052024.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0be2dc3f98d814cd96ad573302d51f2d68e362e0c14e9c0e1f70c27edb7b2dac
Instruction ID: 420a11bc129fbf88bc78a3d068f7e573ce2b199a2adaf8e0ab9ab979e5477609
Opcode Fuzzy Hash: 0be2dc3f98d814cd96ad573302d51f2d68e362e0c14e9c0e1f70c27edb7b2dac
Instruction Fuzzy Hash: F31102B5D047498FDB20DF9AC444BDEFBF4EB88314F10846AD529A7210D379A545CFA1

Function 069F79C8 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 069F7A2D

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 0eef282d797a8caa4234dec5289875c13a276fb66e055c27f5fac6bad74e74d4
Instruction ID: d03c3e329d16e090515d1f1152f8f254a39d8b63e8c669a80733d6573d485b4d
Opcode Fuzzy Hash: 0eef282d797a8caa4234dec5289875c13a276fb66e055c27f5fac6bad74e74d4
Instruction Fuzzy Hash: FB11F5B58003499FDB10DF9AD885BDEFFF8EB48324F21841AD518A7610C379AA44CFA1

Function 069F4D38 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 069F4D9A

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: faf3b3ef77272c96b6e537f4f3fdd7cebc6dbcd22064eec28ebf7168060091cb
Instruction ID: cf334028f3ac698c7536c54994a45494e5b1a1c4d7b4039c797341862433c62f
Opcode Fuzzy Hash: faf3b3ef77272c96b6e537f4f3fdd7cebc6dbcd22064eec28ebf7168060091cb
Instruction Fuzzy Hash: 46112571D003498FDB20DFAAC8457DEFBF5EB88224F24841AD519A7640CB79A941CBA4

Function 069F7278 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 069F7A2D

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 241421a182e2bce1c007cd80cfadda538c07e9c9f4510a0e22e1056cded9317d
Instruction ID: 6e5767e9be47a6afc1211e697f80f3db63ff1e73f3f0513e722243542c520569
Opcode Fuzzy Hash: 241421a182e2bce1c007cd80cfadda538c07e9c9f4510a0e22e1056cded9317d
Instruction Fuzzy Hash: 371133B58003489FDB20DF9AD845BDEFFF8EB48320F21841AE518A7610C375AA44CFA0

Function 04B7AF97 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,04B7ADC4), ref: 04B7AFFE

Memory Dump Source

Source File: 00000000.00000002.1231705458.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_PO_27052024.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a394574eb80080cb04cd5eba4a6587e400570acb126610d93e638db9025ed175
Instruction ID: fae0f2719fce0a33a13cdcd1e76cd4f32b4984eab5b8d5b37e6a9d2bcec6b112
Opcode Fuzzy Hash: a394574eb80080cb04cd5eba4a6587e400570acb126610d93e638db9025ed175
Instruction Fuzzy Hash: 3D11E0B6C046498FDB20DF9AD444BDEFBF4EB88324F10846AD529A7210D379A545CFA1

Function 080878F7 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

V, xrefs: 08087968

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID: V
API String ID: 0-1342839628
Opcode ID: d4cf0f2ef736cc2ac6870fe8a33d584c1d57392501a50c062155cb54b5d79902
Instruction ID: 1ed1c5758560aa7d1af63b5f58d68fb94d514adf7b40b440c441af11c4191592
Opcode Fuzzy Hash: d4cf0f2ef736cc2ac6870fe8a33d584c1d57392501a50c062155cb54b5d79902
Instruction Fuzzy Hash: 42516F30A45214DFDB14AF6DD9547BDBAF3EF44302F24806AE4E69A29AC7349AC0CB11

Function 08089B90 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Teq, xrefs: 08089BFB

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: eef9c87ce08fc60c8ace3b09ee3dc0d560e392245d24974fd188e16e4845d36f
Instruction ID: 09861d1b9f16de8deaeb44640a9557838424273aba9621e161d99f7fe74e05ed
Opcode Fuzzy Hash: eef9c87ce08fc60c8ace3b09ee3dc0d560e392245d24974fd188e16e4845d36f
Instruction Fuzzy Hash: 67112E31F00219CBCB64FBB998117FEBAF6AB88311B244079C544E7344EB358D51CBA5

Function 08082FE4 Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

0,Aq, xrefs: 08082FAD

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID: 0,Aq
API String ID: 0-777562071
Opcode ID: 5c05c76e71b91418735391aaaa01fbfa6ea49cf9d1f8691090a4f18e61b1208b
Instruction ID: fc74806b9b41199a1f10fc0f22219c972f72ddf1c570c56c3be8261a893fc02c
Opcode Fuzzy Hash: 5c05c76e71b91418735391aaaa01fbfa6ea49cf9d1f8691090a4f18e61b1208b
Instruction Fuzzy Hash: 30F02736B08314CFDB21AB65EC9056D7F22EFD0203B04815BC4828E226DB34A90AC751

Function 08082F88 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

0,Aq, xrefs: 08082FAD

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID: 0,Aq
API String ID: 0-777562071
Opcode ID: 4fbc1459b04c8d19c0580361568d57a85a8dab2b3ae7665fa3d4b4fadc71d1e4
Instruction ID: d277e07f5495945a78630e62efc7844e89d4586c8f22e5bef7a9ad93931d05ba
Opcode Fuzzy Hash: 4fbc1459b04c8d19c0580361568d57a85a8dab2b3ae7665fa3d4b4fadc71d1e4
Instruction Fuzzy Hash: 4AF0EC357007189BD724F625DC90D9FBB5BFFC4211B108519D5098F305CE306D0D8292

Function 08084762 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

)k^, xrefs: 08084762

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID: )k^
API String ID: 0-3255266018
Opcode ID: c15e69b0d27fddc8e9d0a6ed48cdf286e061500285c452ea5e2f2a3a05314d24
Instruction ID: abcf83eb8cd8e0da025637ab72cc428e471ac71507bf6a17f7cd70a41c7466d9
Opcode Fuzzy Hash: c15e69b0d27fddc8e9d0a6ed48cdf286e061500285c452ea5e2f2a3a05314d24
Instruction Fuzzy Hash: DCD02EA2B48A36CF8B2A3651590012C3ADFAA923A330810AFC5CA8A040D6004887831E

Function 08080040 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 132a8017974ee82de32bc880f5b43a94cc69725c7bccfa63bf4e6a015e4eb03b
Instruction ID: a275de3f6e9c1d809d402222be64adae684f817cb85f6df8090927e5f39e946c
Opcode Fuzzy Hash: 132a8017974ee82de32bc880f5b43a94cc69725c7bccfa63bf4e6a015e4eb03b
Instruction Fuzzy Hash: E481F338710A10CFCB44EF28D498A697BF6FF89605B1581A9E502CB375DB71EC45CB80

Function 080875D9 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d4d0b1c3cc1408938555d0d9ead43fc8f5b94dbe814b32fb4e6e8fc719d3375
Instruction ID: 79866e6443fe4852c7db2a891b8b3cfd24b9baf7146461d084401abe8a33d68e
Opcode Fuzzy Hash: 8d4d0b1c3cc1408938555d0d9ead43fc8f5b94dbe814b32fb4e6e8fc719d3375
Instruction Fuzzy Hash: 03719131A05205CFCB14DF5CC584A6DBBB3FF44312F658A9AD0969B6AAC370E891CB90

Function 08084ACC Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 003f8bb36df75308e70476300429419af74709d59ec0409cc945ca669a174c26
Instruction ID: 6cda612413e8b0979ebd25cdd546aa5c966ae385a7da4773308dcbc3edc5a8c5
Opcode Fuzzy Hash: 003f8bb36df75308e70476300429419af74709d59ec0409cc945ca669a174c26
Instruction Fuzzy Hash: 97512571A093859FC707EB388C9857E7FB6EE8325034A45DBC095CF193DA38990AC726

Function 0808ACE9 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c8b2ab220aceea97450c5a54c571330992cb65a097a180050f9e8e5f3a8798
Instruction ID: 6e94f69b4185909794a11837a51342eaf1e46db637973cff5a99f95c15f3da62
Opcode Fuzzy Hash: a3c8b2ab220aceea97450c5a54c571330992cb65a097a180050f9e8e5f3a8798
Instruction Fuzzy Hash: 15517834B00218DFE704EBA9C845BBE76B3FB84712F548526E585AB7C5DA348D81CB51

Function 08086F5A Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3bcc0360f71aaf4d95e93575d6c9bd2a6066df00f33e218181864ca6949fcf2
Instruction ID: b90e0cdd742bea5d6a52f3742421ac80e5cee96a5a1583cd135c67986383900c
Opcode Fuzzy Hash: d3bcc0360f71aaf4d95e93575d6c9bd2a6066df00f33e218181864ca6949fcf2
Instruction Fuzzy Hash: F64191A8409BC0CFC3239B79A5545417FF0EE8721274A89EFC4C5CFAA3C679985AC716

Function 08080540 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92319b6660347ed9a7b96c3fbc0ccf264b284d701df6a389b4343d546efdd95
Instruction ID: ac6389b8198734867fdbe20f08d6329732be18ecb9b1eda97d17cc16ad22a1b5
Opcode Fuzzy Hash: a92319b6660347ed9a7b96c3fbc0ccf264b284d701df6a389b4343d546efdd95
Instruction Fuzzy Hash: 4F41B074E00604CFEB64FBB8C4547AE7AB2EB88316F145429D542B7360DF3589C6CBA1

Function 08083C20 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77014ed3f3357fe7ed2fc4dfadc1e806963a990c107e08fca881bbc5b3012201
Instruction ID: 829b48db453a9746cbe5a81f13ebdb62ca53709fd5a69f5ec2ac3cc890ab2472
Opcode Fuzzy Hash: 77014ed3f3357fe7ed2fc4dfadc1e806963a990c107e08fca881bbc5b3012201
Instruction Fuzzy Hash: F2414870A04254DFD7119B6898146BEBBE3BBC5A13F16C0BAE6D5CB382C6768882C750

Function 080887F8 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5aacbb6d9011e48da0e9fc46a6b4b3bab6a4113566ba5c06c44072c5772c661
Instruction ID: deb80283e0ac2178d84c6f44f8877e5b4dbdb05ab57981b3bf5e8c4897b48392
Opcode Fuzzy Hash: f5aacbb6d9011e48da0e9fc46a6b4b3bab6a4113566ba5c06c44072c5772c661
Instruction Fuzzy Hash: 49415D70E05619DFDB54EF69C9102AEB7F2FF49312F84C13AD4EAA6284D3349581CAA1

Function 08080013 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3760f8312763b531544f589444b84bc0be3c862683c722efb945e3236d8f7dd6
Instruction ID: 72ca28786ca1f870736cbf9d95cbf1843781d1f8b8a738c38cec46eb2424ca02
Opcode Fuzzy Hash: 3760f8312763b531544f589444b84bc0be3c862683c722efb945e3236d8f7dd6
Instruction Fuzzy Hash: DB318D34B156518FC706EB38C8948AD7BF6AF4A60170940EAE841CF3B2DB71EC05CB92

Function 080861A0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45c6e5ef2b7b4ad621ab99a621ad9bc5b5d376ed8a9c5d21f6159ea86024006
Instruction ID: 64904e0207d2fc52a1acbaf741c87c2fa087ff5aff95c399cc08f3da0cda80ea
Opcode Fuzzy Hash: e45c6e5ef2b7b4ad621ab99a621ad9bc5b5d376ed8a9c5d21f6159ea86024006
Instruction Fuzzy Hash: 4931F570908659CFDB409FADC90567FBBF3EF95212F19816AE8B5D3283D2358480C751

Function 080861B0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7490f021dfd8e7ccb397b4e009616dde81f809bc304999d89325902c8d717fdd
Instruction ID: feeb9d97483ee35f3e8e51b64eac55714ebaeca7a93da5bb92cd701b7d632d3d
Opcode Fuzzy Hash: 7490f021dfd8e7ccb397b4e009616dde81f809bc304999d89325902c8d717fdd
Instruction Fuzzy Hash: 5531E570A04619CFDB449FADC90567FB7F3FF94212F19816AE8B5D3282D236C5818691

Function 0808BBF8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5edd7111cae9a7d9b43e84323afe5d2aeb98df960d99ce3ed1be614ba5d283
Instruction ID: 9de8bf27ed7412f13b93ac3d0b12cffde5e0a31cc95f908b9e10baec879cd731
Opcode Fuzzy Hash: 2c5edd7111cae9a7d9b43e84323afe5d2aeb98df960d99ce3ed1be614ba5d283
Instruction Fuzzy Hash: 23216D30704704DFD3246B15986572A7FA3AF89732F54887DE5878F382CE609C82C755

Function 008FD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1227773938.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8fd000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fe67288ecefa808907fc05580565f6e9422da52ecf8a76ce8b7d53fb5ac885e
Instruction ID: ec990e5a8a5eba7a3ce52017dae29793366f8b30e5dbc2b6394056db3997bc7d
Opcode Fuzzy Hash: 3fe67288ecefa808907fc05580565f6e9422da52ecf8a76ce8b7d53fb5ac885e
Instruction Fuzzy Hash: 18213371504308DFDB14DF20D9C0B26BF62FB98328F20C169EA098B246C336D816DAA2

Function 0090D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1227836643.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90d000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b6b3af36165226dc5f6345044241af8d7a201eea0741b9f1af66bc4b96e63a0
Instruction ID: 36e77b6a5847b714fc7edd4d1a13e2135150877fa5602dc488c6d375d1e07e4c
Opcode Fuzzy Hash: 6b6b3af36165226dc5f6345044241af8d7a201eea0741b9f1af66bc4b96e63a0
Instruction Fuzzy Hash: 69210771605300EFDB15DF98D9C0B25BB65FB84314F20C96DE8494B2D6C33AD846CB61

Function 0090D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1227836643.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90d000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f00b905c568a0b697ea51858cf2f429eab873c3ed4bd0254cece8987dd390b45
Instruction ID: 8237fd84bbc66ca6e00512538449576f9e0785d266c5358aee21eaaaafd0f12d
Opcode Fuzzy Hash: f00b905c568a0b697ea51858cf2f429eab873c3ed4bd0254cece8987dd390b45
Instruction Fuzzy Hash: C921F275605300DFDB14DF54D9C4B26BBB5EB84324F20C96DD84E4B286C33AD847CA62

Function 08080808 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17212a4b656c782b2557df404f25ecb266b7f68364ac4fa50557a03cc8e3f02c
Instruction ID: be189ea87f64e9fe24794225038127b97185b375a5af111fc57096597f8310ff
Opcode Fuzzy Hash: 17212a4b656c782b2557df404f25ecb266b7f68364ac4fa50557a03cc8e3f02c
Instruction Fuzzy Hash: 0521C571A10219EFDB05AFA4D844A9EBBB6FF89304F458515F101BB224DF34A845CB91

Function 08080807 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 180eb5807de860427510452b4613c7f1c800eb8cbabe4c283d851966712d2c79
Instruction ID: 54b5a95561de5c663867daf72c5825c0e03c6155c5cb191a54331f129a121082
Opcode Fuzzy Hash: 180eb5807de860427510452b4613c7f1c800eb8cbabe4c283d851966712d2c79
Instruction Fuzzy Hash: D121C571A10219EFDB05AFA4D884A9EBBB6FF89304F458515F101BB224DF34A845CB91

Function 0808BBE8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cb50bb201c717c5ed83d736132891fac1f82327593a2fd23215508bc3131b5c
Instruction ID: 6a15e779241cf181680d261cec05027536e73cf34f0f462c74ce008373aa1d93
Opcode Fuzzy Hash: 2cb50bb201c717c5ed83d736132891fac1f82327593a2fd23215508bc3131b5c
Instruction Fuzzy Hash: CC113A30744704EFD3206A159861B6E7FA3EF85732F44897EE5864F292CA7098C1C759

Function 08089C5F Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27cac80d83fd38daa2ed3b247a627890237733f186e21e8e68d862b15b17c9ee
Instruction ID: 6fe5ef6bf7137cf5e1eb6a18409aa7e11c18985c3711c228a55a0c57890a6be2
Opcode Fuzzy Hash: 27cac80d83fd38daa2ed3b247a627890237733f186e21e8e68d862b15b17c9ee
Instruction Fuzzy Hash: D6112375A007498F8B45FB7C8C404BFBBF7EEC5260714492DD968D7341EE3089068362

Function 0808EE48 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19bb63e6119be774d3068f81439391015e36127f4c279f4b58e52b9fffe92d87
Instruction ID: f61d9b0f14bd1bd5de2bfe1b6a6eb2b8fbf63256f9b0f4aefe86182a604208c9
Opcode Fuzzy Hash: 19bb63e6119be774d3068f81439391015e36127f4c279f4b58e52b9fffe92d87
Instruction Fuzzy Hash: 2521BDB4D04209DFCB44DF99D5809AEBBF6FB49301F609069D849A7715D7709E80CFA1

Function 08083B75 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa124054981894e9663ef8c7558b02c72ab1cb2ae15d368a55c94a29f0f8e3b
Instruction ID: 11314273f82dc48b7e08911010726de263a494aa510660cf245796166b88576e
Opcode Fuzzy Hash: 0fa124054981894e9663ef8c7558b02c72ab1cb2ae15d368a55c94a29f0f8e3b
Instruction Fuzzy Hash: AA11A3B4A08255CEC720DB6D84601BDFBF6AF85613F16C46BD2E2C7292D239D881C720

Function 008FD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1227773938.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8fd000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: 9bdb722c5d3f8799c499f0c7048c58fd495e660aa0222f5649ee066cb2ba151a
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: C6110376504384CFCB05CF10D5C0B26BF72FB98324F24C6A9DA494B256C336D85ACBA2

Function 0090D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1227836643.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90d000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: bbcc078f981f254e288ebc282d7bab997eebf1f4dbce4d1498cf9885f1a4b771
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 86118B75504280DFCB15CF54D5C4B15BBB2FB84324F24C6AAD8494B696C33AD84ACBA2

Function 0090D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1227836643.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90d000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 6fe5d3a8dbb709dccec73dd8c3432b0e9109c78b8ff78886c810c1ad7982cf6a
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 0611DD76505280DFDB05CF58C5C0B15FBB2FB84324F24C6ADD8494B696C33AD84ACB61

Function 080870A8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2dc0fb6a09813b05ce2aa8459d28d153f990831015e1981b845b56e1908a7b4
Instruction ID: 90154415630776a6a56e53d006f67c16810f9adebb2e5b938d3b9cf54e3bc4d8
Opcode Fuzzy Hash: a2dc0fb6a09813b05ce2aa8459d28d153f990831015e1981b845b56e1908a7b4
Instruction Fuzzy Hash: 69115E70508648CFC760DF68F5482297FB1FB4A315B3045EDD4CA8A647CA7788E2CB45

Function 080828C8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46029c49aebc18c175cacfe89839441007b8c1c8f9034caaafd3aa7346f6d323
Instruction ID: 90d38215e819e8111978442a88f66351377c111e3f488252c2ec60f8d09546b5
Opcode Fuzzy Hash: 46029c49aebc18c175cacfe89839441007b8c1c8f9034caaafd3aa7346f6d323
Instruction Fuzzy Hash: EA115B74D0020D9FDB41EFF8D841AAEBFB2FF48301F1085AAD155EB255EA341A06DB92

Function 080870B8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc1c40bcc7abf29b67d8b7a3da88f915ef8b6774b0be0a6b83255bc00261913
Instruction ID: 9de759d201fc671c96ea0efcd07683eb3200bc10552e2fce4f3a171df129d4e9
Opcode Fuzzy Hash: adc1c40bcc7abf29b67d8b7a3da88f915ef8b6774b0be0a6b83255bc00261913
Instruction Fuzzy Hash: 64015B70504608CFC760EF58F5482257BA1F74A316B7045EDD4CA86647CA7788F2CB45

Function 080805CA Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a81e850141b47ad34b9fe7882a6f404a748ee78c1487c3f7ca961263d6a079b
Instruction ID: 5c97ce6244994551ef04afef5f8ed6a1eb2e6bf0669d8c34244086055e9c74a3
Opcode Fuzzy Hash: 9a81e850141b47ad34b9fe7882a6f404a748ee78c1487c3f7ca961263d6a079b
Instruction Fuzzy Hash: 3F018470E40609CFEB54FFB9C4543AD79A2EB88312F144439D541B62A0CB7949C5CFA6

Function 080828D8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79fc2750f3d069a9716adea813351a9e6965e54fe70586783877a614c70326f0
Instruction ID: a0ae6cec707557b58c238bc137162c3605423e12d4c05d60563f2e5feddbb98b
Opcode Fuzzy Hash: 79fc2750f3d069a9716adea813351a9e6965e54fe70586783877a614c70326f0
Instruction Fuzzy Hash: 6C011E74D0020D9FDB45EFE8D440AAEBBB2FF48301F1085A9D155E7354EB351A069F81

Function 08087020 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae20eb83fb51fac1db8f65ba5518dc2c90a796295915db8d184ab59381ed5c3c
Instruction ID: c1e4ada7169aee9e03928b0a172f68d079c64987207b96fe2365a0bc581fc0b8
Opcode Fuzzy Hash: ae20eb83fb51fac1db8f65ba5518dc2c90a796295915db8d184ab59381ed5c3c
Instruction Fuzzy Hash: D6018070500F14CFC324DF1AF688912BBF0FB8972078189ADD5CA87A66DB71A4A5CB45

Function 0808297A Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bcd54ac11d4612cfeb27c6cc7bca5dc05ae02fb82c5af3622129a37c6ae3592
Instruction ID: 0d104917fe224d17c93f19c2eb6bfbf5386f03d312acf3795de4a31ec36029f8
Opcode Fuzzy Hash: 3bcd54ac11d4612cfeb27c6cc7bca5dc05ae02fb82c5af3622129a37c6ae3592
Instruction Fuzzy Hash: 5EF04F34D0020DDFDB15EBA4E844D9EBB76FF48302F1045A5E156AB614DF352A46DB81

Function 0808DC8C Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52d64d583131e1cd6c7bd2ca88befd1e1f86a33076b5c44f9e6e292cf8c15d58
Instruction ID: e69249f6bd455531b39dcba704a64fe054adbdf276cc1fa1df426d1e12b30ba5
Opcode Fuzzy Hash: 52d64d583131e1cd6c7bd2ca88befd1e1f86a33076b5c44f9e6e292cf8c15d58
Instruction Fuzzy Hash: FF016274E0D259CFDB50EB28C8856ED7BBAAF49202F0494E9D48D96257C67019C4CF12

Function 08089D34 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d5c5f4e974faa009a0233190171ec66f59e45aaa882a4c13cf071e7e79706b
Instruction ID: 53ce2eb407a6ee7ffdb5fe98c683ce05b6af6c0a83ec1c9fdbe70934d12bf181
Opcode Fuzzy Hash: b7d5c5f4e974faa009a0233190171ec66f59e45aaa882a4c13cf071e7e79706b
Instruction Fuzzy Hash: 04F0A92145F3C08FC303AB7888A81A93F72AE5720170A04CBC1C08F463C56804AEE32B

Function 0808DCD5 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03fe3a2a4a2e3d50c3cde763e0649199316c5ee836b6575f6c7e8f4caba557a
Instruction ID: 90edc7aa8438170a2ffd5d9b9541a9bb13fb0eb0a6dc8e031dfd94a0eab0ab23
Opcode Fuzzy Hash: e03fe3a2a4a2e3d50c3cde763e0649199316c5ee836b6575f6c7e8f4caba557a
Instruction Fuzzy Hash: C6F0B470E0A249CBC764EF58C8966EC7777AB00102F1095A9D08A9B1A6D6704DC4CF12

Function 08080625 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed8cc13e3c435aeceac5f5327aa9171773b534a806e564d293290db81ba33578
Instruction ID: 954ad6b5f2425d60e1b4c64b6fb0bc8b7a22ae2e16e33607aa4992547a73df83
Opcode Fuzzy Hash: ed8cc13e3c435aeceac5f5327aa9171773b534a806e564d293290db81ba33578
Instruction Fuzzy Hash: 72F01270E4070ACFEB54FFB994187AE7AA2AF84312F00843DC151AA2A1DF794495CF95

Function 0808EF98 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a6f9855bc21c9421aee1560f75900385dc94fcc2cb3fb2d0f93f03ba2add55
Instruction ID: 119e7d4c6164a20cb0535a1885c778c687db5e68d297039e06aa1edcacb91678
Opcode Fuzzy Hash: 06a6f9855bc21c9421aee1560f75900385dc94fcc2cb3fb2d0f93f03ba2add55
Instruction Fuzzy Hash: 8BF01570D04208EFCB50EFA8E544AADBBF5FB49311F1081ADD84493342D3309A80DF84

Function 0808DAC0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 435ecc946cbc699eac14bcc13f81007ada1aff16b112e5b5a7d343f5d63fa412
Instruction ID: b631852a883f80f18b18692d51ff115e6d168e63c21f8f93126b7c1f025db22f
Opcode Fuzzy Hash: 435ecc946cbc699eac14bcc13f81007ada1aff16b112e5b5a7d343f5d63fa412
Instruction Fuzzy Hash: C2D05E2009A394AFC7162364BE6D7D73F759B03629B1503AEE88A8A0D3C3A40485D736

Function 0808B40C Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d58c84e8000ea30e847e12548dbe4fbfd9bb0235bab1c04c25dc8d40c730374
Instruction ID: 4c49c656a1b5b12dafb444c0c1a68f862d90eb1d5ddfdf74ae6e229db49c0fad
Opcode Fuzzy Hash: 2d58c84e8000ea30e847e12548dbe4fbfd9bb0235bab1c04c25dc8d40c730374
Instruction Fuzzy Hash: CBE012B1D4020ADFC740EFA8C505B5EBBF1AF08304F10C4A9D018EB211E7B08A018F82

Function 0808B410 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2de9818134fd157e5d86f646356667d4aabe74b8732beab10921793372f454ff
Instruction ID: d14b741b132b024fbb8da32a9102319213affb7d680a83a204421e019c54707d
Opcode Fuzzy Hash: 2de9818134fd157e5d86f646356667d4aabe74b8732beab10921793372f454ff
Instruction Fuzzy Hash: 66E012B1D4020ADFC740EFA9C905B5EBBF1AB08200F10C4A9C018E7211E7B086008F85

Function 08084AA0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e10436c9998596b1013da4512cc9f899d10a49c034e268d6077d2d418eabc9d
Instruction ID: c5f91d32ad779d25750924800e87fa9855f1ae093725b6a9a02023beb4c2f09d
Opcode Fuzzy Hash: 7e10436c9998596b1013da4512cc9f899d10a49c034e268d6077d2d418eabc9d
Instruction Fuzzy Hash: 10D0A92A40A390CED723FBA8CAA8A997FD1AE6220170888CAE0C40E022C520801CC70B

Function 08080500 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c34d9c0fe89c336d178e9e45fbc748578fc65d72ae2b7ab65834436382e23b52
Instruction ID: 4ccd07a47b4791b6bb9d40ad0f3c6da4defedfd2f6aed41f92c0b64b8776b2e2
Opcode Fuzzy Hash: c34d9c0fe89c336d178e9e45fbc748578fc65d72ae2b7ab65834436382e23b52
Instruction Fuzzy Hash: 10D0A736C0A394DFDF21DF24E8B40443F205E01619705C2CBE8404E15AD9685E05CF83

Function 0808DAD0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3341ed807fe4543325a2ffb23c4929729cca045f74dbbdf4c121e333fa1014d7
Instruction ID: e469ac9fa6ce0da233758166dd29a8d9605dfc97087814b8fa685daa14e13369
Opcode Fuzzy Hash: 3341ed807fe4543325a2ffb23c4929729cca045f74dbbdf4c121e333fa1014d7
Instruction Fuzzy Hash: A5C04C310846189BD2547795F70D32677ACE70162AF40027DDA49414934BA054D0C669

Function 0808B900 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b442e9046ac042babfa1cbb19d78eca07197e56f2a8bf8cd03e1da57b407296
Instruction ID: 3e92179ede61d5c7952f534ebf32cca9d60a5ea4c6c0cb85bd4bf726d3b5f82f
Opcode Fuzzy Hash: 7b442e9046ac042babfa1cbb19d78eca07197e56f2a8bf8cd03e1da57b407296
Instruction Fuzzy Hash: 1FC08C3440D3C46FCB03D320EAAC164BFA0AF52318B1806EDA4888E09BD2A60988C387

Function 08089D64 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55bad49673f9e6914f560b982278004b51b692753f1d85d312d6a529c279defc
Instruction ID: b174a24ff14b71bb77c1170b744b1e55e3d6c8961fb11b5a558e7a432634eceb
Opcode Fuzzy Hash: 55bad49673f9e6914f560b982278004b51b692753f1d85d312d6a529c279defc
Instruction Fuzzy Hash: F9B012656A5344E395C477AC8C44B2E6943AFF1702B109C03B355A4040C46084FDE22B

Function 08089B64 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f52e6dd85403dcdf3a58136cd75283346f57f666699d02b1e29f781cee19d1
Instruction ID: 2273261e95f3ac1fcf7436bd41eae1aec0a00d88431950fcfec46ff82c3d39c7
Opcode Fuzzy Hash: 03f52e6dd85403dcdf3a58136cd75283346f57f666699d02b1e29f781cee19d1
Instruction Fuzzy Hash: 88B0123E0205809D9B137F908404D61BFE6FF59608348C488E5C40A132C5119024EB1A

Function 0808A554 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0cc45a981c5bf67391d898784449f9ebd0dc830eecca35268dd935c7ac322a5
Instruction ID: 24351c604eccc73a2bfa7bd1d8dfa6ec087f2b9577a9a6fca0fbaea320e8fd9b
Opcode Fuzzy Hash: f0cc45a981c5bf67391d898784449f9ebd0dc830eecca35268dd935c7ac322a5
Instruction Fuzzy Hash: CDB0126509438460C68127A49901B1DABD01FFA700F24580AEFC800041812000B6E717

Function 08082980 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d5406cefa9b762c67a04dfabe03c80ae9a4d31a227a415561eebea44aee7299
Instruction ID: 005a12b9302ed3dcaea744197b62c222a6df3f3a87514c6c6c983917e63de296
Opcode Fuzzy Hash: 6d5406cefa9b762c67a04dfabe03c80ae9a4d31a227a415561eebea44aee7299
Instruction Fuzzy Hash: 8490023508460C8B46402795740D955775EB544516B844461AA4D415015A5574108595

Function 08086C90 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233308262.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 168882d26c4b8112753ebd516f2ea22d4c6b24f4b967cbdd9fdc59691c66b592
Instruction ID: 7466d477a86a04f749a2679ccd08bf9acc923f0a856bdd16093ec3da714b871a
Opcode Fuzzy Hash: 168882d26c4b8112753ebd516f2ea22d4c6b24f4b967cbdd9fdc59691c66b592
Instruction Fuzzy Hash: 6BA00174809205EEDB109A55A10C26CBA65AB1436AF018069D862527428B7901C49F05

Non-executed Functions

Function 069F95E0 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eeb7955f5815d6dccc106bb57fa252e9daaddbe7c6a79a5f7d8452b6b10e40f
Instruction ID: fe272cff2edb9c564c9c2c79c0b80495ec0b3bdf1ab18f6ec7e6863afbc28691
Opcode Fuzzy Hash: 1eeb7955f5815d6dccc106bb57fa252e9daaddbe7c6a79a5f7d8452b6b10e40f
Instruction Fuzzy Hash: D4D1DF30B103008FEBA9DB75C410BAEB7FAAF89304F2544ADD25A9B690CB35E941CB51

Function 069F25E8 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7588a1d6240fd60d6258bfa8de1806cce442f2b527923f65b856f77287882ad
Instruction ID: 4b884af5a6a4630ea4d71abaaf2e2ffa12bccb7fd719bfd104104a4cc5eb1f0b
Opcode Fuzzy Hash: a7588a1d6240fd60d6258bfa8de1806cce442f2b527923f65b856f77287882ad
Instruction Fuzzy Hash: 77E11974E102598FDB14DFA8C580AAEFBF2BF89304F2481A9D555AB356C734AD41CFA0

Function 069F3CA0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 522733745bd59490d2191023ea0f22c8487cfdbaf6757aa4791babba15e66468
Instruction ID: a4635cd05e6b75d973514e5dac9fd10640ae3602417ebbe172717c7ab760a3a7
Opcode Fuzzy Hash: 522733745bd59490d2191023ea0f22c8487cfdbaf6757aa4791babba15e66468
Instruction Fuzzy Hash: 2FE12774E102198FDB14DFA8C580AAEFBF2BF89304F248169D555AB356C734AD41CFA0

Function 069F40D8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4d6cd6fe115b3440cd8688a48e8c4e5425927bbbb6c5c0ae46789d94a6c1848
Instruction ID: c6f60d20cf87d2946b785523519701e3428c8372f8c61dfa98e6b5f1531d17dd
Opcode Fuzzy Hash: e4d6cd6fe115b3440cd8688a48e8c4e5425927bbbb6c5c0ae46789d94a6c1848
Instruction Fuzzy Hash: 8FE11974E102598FDB14DFA8C580AAEFBF2BF89305F248169D555AB356C730AD42CFA0

Function 069F21C0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9ec194f7d03c5cc9bdb4eecd64245e2dbe898da951282d735f18b3da5c9815
Instruction ID: 7f990a359a8e9549dd52590671954349c86a47155dc704d4c41985c2527b8e2e
Opcode Fuzzy Hash: ab9ec194f7d03c5cc9bdb4eecd64245e2dbe898da951282d735f18b3da5c9815
Instruction Fuzzy Hash: F9E128B4E102198FDB14DFA8C590AAEFBB2FF89304F248169D555AB359D730AD42CF60

Function 069F4510 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d57c4b982694be2ac04082ededb15a2f2d02bb773cc1d4a777b7cb725db98f3
Instruction ID: 1c4c8aa53c675d89873643e7e76c6459562bee479c7e06cf19a749ddc0e8024e
Opcode Fuzzy Hash: 6d57c4b982694be2ac04082ededb15a2f2d02bb773cc1d4a777b7cb725db98f3
Instruction Fuzzy Hash: 6CE12674E102598FDB14DFA8C580AAEFBF2BF89305F248169D555AB356C730AD41CFA0

Function 068FAA80 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1232635150.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_68f0000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82511cd5b8539a5c3a6364d36bde7d84a399b7f83de31059ca7a18487d7f2036
Instruction ID: 2ec99029b1aa0aab43cdfb3c6bf5db937f1cfad4d9aea4b9e7ab6b71d3df4456
Opcode Fuzzy Hash: 82511cd5b8539a5c3a6364d36bde7d84a399b7f83de31059ca7a18487d7f2036
Instruction Fuzzy Hash: 15D1D635D10B5A8ACB10EB69D990A9DB7B1FFD5300F20C79AD14977214EB70AAC9CB41

Function 068FAA90 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1232635150.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_68f0000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4aec379575c70875dfd9c406fd69a2976b4b2748ba93b58bba51ad84d56002
Instruction ID: d5ec312ea0e0e91d17ed15bea5cc26808fefab634410883ca9953181f1cece51
Opcode Fuzzy Hash: 3e4aec379575c70875dfd9c406fd69a2976b4b2748ba93b58bba51ad84d56002
Instruction Fuzzy Hash: 09D1C535D10B5A8ACB10EB69D990A9DB7B1FFD5300F20C79AD10A77214EB70AAC9CB51

Function 04B7D5BC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1231705458.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b30116efac980e4b79cdfd7900b31756b70e3957ae8b7315aff9c0fee8190a21
Instruction ID: 65f5a4242e5b2f2cd8bae508059cf31e711cd0e97cd4d98dd72bf2b801d833c1
Opcode Fuzzy Hash: b30116efac980e4b79cdfd7900b31756b70e3957ae8b7315aff9c0fee8190a21
Instruction Fuzzy Hash: 9EA17E32E00209CFDF05DFB5C8805AEB7B2FF89305B1585AAE815BB265DB35E916CB50

Function 069F40C9 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6689b3fc50149370757931df19700a94aa20f470f2222a531c55f94ebb84c49
Instruction ID: 25893cfb177cb029e1c9b25d499b45da55fb6c69444d003d3d21524aed190cf1
Opcode Fuzzy Hash: c6689b3fc50149370757931df19700a94aa20f470f2222a531c55f94ebb84c49
Instruction Fuzzy Hash: 39512874E142598FDB14CFA9C5805AEFBF2BF89304F2481AAD458AB256C7359D42CFA0

Function 069F4501 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ff5846f7f06b34137fcd222e4a707b4dfd7cfd0691e69f652cad4983b404413
Instruction ID: 0149ae776d2bc6a9fa26a76e395a29ef8c7f19b8fc87df5ad4c67a849c9d7ef4
Opcode Fuzzy Hash: 0ff5846f7f06b34137fcd222e4a707b4dfd7cfd0691e69f652cad4983b404413
Instruction Fuzzy Hash: DD511774E102598FDB18DFA9C5805AEBBF2BF89300F2481A9D458AB356D7349D42CF60

Function 069F6509 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1232952867.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69f0000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbef8284f5492911cfc45cfd38b8371c911fa75efab02924d2ba37689d83cb30
Instruction ID: 46a64f0bdbe59a6f904e098276c838c3ed5f9efa7ab5fdbc2eb9d875fcfd8161
Opcode Fuzzy Hash: bbef8284f5492911cfc45cfd38b8371c911fa75efab02924d2ba37689d83cb30
Instruction Fuzzy Hash: 5FD02323C5F3844ED741464028000F4EF3C5F87026F0734D3CB0C9394381105D2D9799

Analysis Process: PO_27052024.exePID: 5956, Parent PID: 2724COMMON

Execution Graph

Execution Coverage:	13.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.1%
Total number of Nodes:	98
Total number of Limit Nodes:	8

Executed Functions

Function 014A7ED0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 014A7F47

Memory Dump Source

Source File: 00000004.00000002.3673664868.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_14a0000_PO_27052024.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: af03d4f88b31fb75c66993006a7cb6645d15e274b22faaa10795c2f83e8924f6
Instruction ID: 408931e5d363ecd20425c3029c69f0c12880adbc90cc24d8f3371a9a7fa1b8c9
Opcode Fuzzy Hash: af03d4f88b31fb75c66993006a7cb6645d15e274b22faaa10795c2f83e8924f6
Instruction Fuzzy Hash: 09214871C013598FDB10CF9AD484BEEBBF4AF49221F14841AE458A3350D738A944CF61

Function 06F4BE31 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.3692595352.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f40000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70fecf9fc34d0a8bc59345aba55dc8d693eb488bc12b18a562d5e94e9c2f491d
Instruction ID: 17ac3546f201ae6da29c9f22b9fa24cef4bfaeeec21e07696123b792f2bb9ab9
Opcode Fuzzy Hash: 70fecf9fc34d0a8bc59345aba55dc8d693eb488bc12b18a562d5e94e9c2f491d
Instruction Fuzzy Hash: A0412271E143568FDB14DFA9D8007AEBFF0AF89220F18866AD408E7681DB74A845CBD1

Function 06F4F5D2 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06F4F6EA

Memory Dump Source

Source File: 00000004.00000002.3692595352.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f40000_PO_27052024.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6856c4f5933abb4fc3ca0a77e57dd7e865708e5424fbbd92e9b58bc0de4aa5e3
Instruction ID: d6dc2c8f250189e3057aca11f208b4eebde4238d29b87b6085666e2c39c0e939
Opcode Fuzzy Hash: 6856c4f5933abb4fc3ca0a77e57dd7e865708e5424fbbd92e9b58bc0de4aa5e3
Instruction Fuzzy Hash: DC51C0B1D01309DFDB14DF9AC884ADEBFB5BF88310F24812AE819AB210D7759841CF90

Function 06F4F5D8 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06F4F6EA

Memory Dump Source

Source File: 00000004.00000002.3692595352.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f40000_PO_27052024.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ba8623cb1fe8c4e4515b8d06016d8b6b447de0b0497761204d9b2b7e8651824c
Instruction ID: 70329dc98356fd674d94908ddcea481bff79e97524ba17da3fad4ca151ea86e4
Opcode Fuzzy Hash: ba8623cb1fe8c4e4515b8d06016d8b6b447de0b0497761204d9b2b7e8651824c
Instruction Fuzzy Hash: A341C0B1D01309DFDB14DFAAD884ADEBFB5BF88310F24812AE819AB210D7759845CF90

Function 014A7EC8 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 014A7F47

Memory Dump Source

Source File: 00000004.00000002.3673664868.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_14a0000_PO_27052024.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 8d71258317d163fc55d53a54a4eda7291a66b2dcde05227c90b84aad9b73778b
Instruction ID: 2534b975d151f2fc7fc984d4a68746cac7fe5c6cdaf19c06d458d4e00de62d74
Opcode Fuzzy Hash: 8d71258317d163fc55d53a54a4eda7291a66b2dcde05227c90b84aad9b73778b
Instruction Fuzzy Hash: 71217871C002598FDB10CFAAD484BEEBBF4AF49320F14846AE858A3350C7389945CF60

Function 06F4BF18 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 06F4BF7F

Memory Dump Source

Source File: 00000004.00000002.3692595352.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f40000_PO_27052024.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: cc7b5a4eeabd5ae456d19ad8bf31e20c14518585581cd1c21d2625dfdc6dc41d
Instruction ID: ce74f628bc37f6f26ffd57519d5d7522ec63efceef3c06b8412fda46d0384d37
Opcode Fuzzy Hash: cc7b5a4eeabd5ae456d19ad8bf31e20c14518585581cd1c21d2625dfdc6dc41d
Instruction Fuzzy Hash: CA1123B5C0025A9FCB20DF9AC444BDEFBF4EF48320F14812AD818A7240D778A941CFA5

Function 06F4E52A Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06F4E596

Memory Dump Source

Source File: 00000004.00000002.3692595352.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f40000_PO_27052024.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: bfcc6268adcef110a6609e4f5d0251af1668afe74a91f64c2e732c128a8e7de7
Instruction ID: 48f60efff8422b4d44c64bb7caeaa843cddaf9df53238a6fa08b7ea9c0e4ca58
Opcode Fuzzy Hash: bfcc6268adcef110a6609e4f5d0251af1668afe74a91f64c2e732c128a8e7de7
Instruction Fuzzy Hash: 9D11CDB5C003498FDB20EF9AD844ADEFBF4AB88320F11846AD469B7610D379A545CFA5

Function 06F4D540 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06F4E596

Memory Dump Source

Source File: 00000004.00000002.3692595352.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f40000_PO_27052024.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 17ff673c102c4aaa13e10d9f855f2726650f7f51c97b290badd349e895c6933e
Instruction ID: e0e9471a772c75fc02775b8d84eb5641bafdc24061b51a96ac128645b855e111
Opcode Fuzzy Hash: 17ff673c102c4aaa13e10d9f855f2726650f7f51c97b290badd349e895c6933e
Instruction Fuzzy Hash: 0511F0B5C003498FDB20DF9AD444B9EFBF4EB88320F10846AD859A7610D375A545CFA5

Function 0120D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3671938041.000000000120D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0120D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_120d000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eeab54a1941328eb4d9f7df9885b53bf2962e7a135badcf1f3ab5aaf54bb407
Instruction ID: da78895fabd72c8896c2e6193a765fa00b64154e50edee1184a2c332fdbff249
Opcode Fuzzy Hash: 7eeab54a1941328eb4d9f7df9885b53bf2962e7a135badcf1f3ab5aaf54bb407
Instruction Fuzzy Hash: 682100756143089FDB16DFA4D9C4B26BB62EB84314F20C6ADE94D0B283C776D847CA62

Function 0120D20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3671938041.000000000120D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0120D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_120d000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b14c400faeec6565034f303f7fdbd26d8e16cd017dfcf86a8e2deabb99b041
Instruction ID: 2311003901968e0027d6f2adca285fb8f19a25b5730f8a4b002100740dfed7dd
Opcode Fuzzy Hash: 40b14c400faeec6565034f303f7fdbd26d8e16cd017dfcf86a8e2deabb99b041
Instruction Fuzzy Hash: AC212371625348DFDB12DF94D9C4B26BB65FB84334F20C769E9490B287C376D806CA62

Function 0120D3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3671938041.000000000120D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0120D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_120d000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 676d85f21459202f38ab5be25f25be6a03d572d4676e1b95cab905e5d9a7cf36
Instruction ID: ddfd39b052e8cbf41b651c368322994c8c4dd72efbf931cbbf3bfea997afe949
Opcode Fuzzy Hash: 676d85f21459202f38ab5be25f25be6a03d572d4676e1b95cab905e5d9a7cf36
Instruction Fuzzy Hash: A3212275A14208DFDB06DF94D9C0B26BB61FB84314F20C66DE9090B2C7C376E846CA62

Function 0120D207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3671938041.000000000120D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0120D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_120d000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2aa0ac69dbfc9ab00947b0048f034b327edea99ed69b312f674443a93577a4
Instruction ID: eb66535f73d32a9250d51494cd222560ec7d78292339513fb96760fb94b9dc49
Opcode Fuzzy Hash: bf2aa0ac69dbfc9ab00947b0048f034b327edea99ed69b312f674443a93577a4
Instruction Fuzzy Hash: CC11D075504284CFDB02CF94D5C4B15BB71FB84324F24C6AAD9490B687C33AD406CB51

Function 0120D3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3671938041.000000000120D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0120D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_120d000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 21af2a674279b90827e533c333149f536214ea3d67b5ed69f5b987781f895d9f
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 1A11BE75504284CFCB06CF54D5C4B55BB62FB44314F24C6AAD9494B697C33AE40ACF51

Function 0120D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3671938041.000000000120D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0120D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_120d000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: fff11f0722c474c3d47dc5c2e811a3c233febdf7ece5eb3b0bec61f51d88b3aa
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: C611BB79504288CFCB16CF94D9C4B15FBA2FB84324F24C6A9D9494B693C33AD44ACF62

Function 011FD8C5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3671739447.00000000011FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11fd000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80020e9613d6ccf1f821f5a55c5f2fc0ca167fdce7d813e736d0757f9e0046a3
Instruction ID: ce65186b655f7ef517688c9cf92d7179b34a465cd60608c7dbd1d49f250a73df
Opcode Fuzzy Hash: 80020e9613d6ccf1f821f5a55c5f2fc0ca167fdce7d813e736d0757f9e0046a3
Instruction Fuzzy Hash: BA01F7310083449AEB294AA9EC84B36BF98EF41625F14C45EEE490B182D7359841CA72

Function 011FD8C4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3671739447.00000000011FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11fd000_PO_27052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e8b2e6b050d371d0ce80333992f547814eeeb42d758595498dc2bf85e46fe34
Instruction ID: a5da1909903a802052f2b0c2a5adb4e9c2ce6ff3ae91da8ab1afc37b1adb324f
Opcode Fuzzy Hash: 3e8b2e6b050d371d0ce80333992f547814eeeb42d758595498dc2bf85e46fe34
Instruction Fuzzy Hash: 15F0C231004340AEEB248E4ADC84B66FF98EB41635F18C15EEE480B287D3799840CB71

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO_27052024.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO_27052024.exe.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
PO_27052024.exe

Function 080833E8 Relevance: 15.4, Strings: 12, Instructions: 432
COMMON

Function 08084FF5 Relevance: 10.2, Strings: 8, Instructions: 207
COMMON

Function 08084FDC Relevance: 10.2, Strings: 8, Instructions: 202
COMMON

Function 08088B50 Relevance: 7.7, Strings: 6, Instructions: 207
COMMON

Function 08083C30 Relevance: 7.7, Strings: 6, Instructions: 156
COMMON

Function 08088B4C Relevance: 3.9, Strings: 3, Instructions: 178
COMMON

Function 08083707 Relevance: 2.7, Strings: 2, Instructions: 206
COMMON

Function 08083792 Relevance: 2.7, Strings: 2, Instructions: 179
COMMON

Function 0808E450 Relevance: 2.7, Strings: 2, Instructions: 164
COMMON

Function 08085D10 Relevance: 2.6, Strings: 2, Instructions: 94
COMMON

Function 08087180 Relevance: 2.6, Strings: 2, Instructions: 70
COMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre