Edit tour

Windows Analysis Report
NoERE2024000013833.exe

Overview

General Information

Sample name:	NoERE2024000013833.exe
Analysis ID:	1546202
MD5:	fcd3727d56f9e69be13c397a22b8843e
SHA1:	928a3ac26dc99383b21c5fa071e4d245b0ca11fc
SHA256:	d36e88ce588046e6ebb2f893aa7bb910ae99be757e8d879f820fc8188b0d79c1
Tags:	exeuser-lowmal3
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

NoERE2024000013833.exe (PID: 2004 cmdline: "C:\Users\user\Desktop\NoERE2024000013833.exe" MD5: FCD3727D56F9E69BE13C397A22B8843E)

conhost.exe (PID: 7108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

InstallUtil.exe (PID: 404 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

InstallUtil.exe (PID: 2044 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

WerFault.exe (PID: 2084 cmdline: C:\Windows\system32\WerFault.exe -u -p 2004 -s 1036 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.alhoneycomb.com", "Username": "blog@alhoneycomb.com", "Password": "          WORTHwill3611!           "}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1884610057.000002620CD82000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000002.4120836178.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4120836178.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1885047529.000002621D259000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1885047529.000002621D259000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.4123322438.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4123322438.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: NoERE2024000013833.exe PID: 2004	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: NoERE2024000013833.exe PID: 2004	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: NoERE2024000013833.exe PID: 2004	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: NoERE2024000013833.exe PID: 2004	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: InstallUtil.exe PID: 404	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 404	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.NoERE2024000013833.exe.2621d2d3b88.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.NoERE2024000013833.exe.2621d2d3b88.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.NoERE2024000013833.exe.2621d2d3b88.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x339aa:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33a1c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33aa6:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33b38:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33ba2:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33c14:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33caa:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33d3a:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.InstallUtil.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x357aa:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3581c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x358a6:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35938:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x359a2:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35a14:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35aaa:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35b3a:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.NoERE2024000013833.exe.2621d2d3b88.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.NoERE2024000013833.exe.2621d2d3b88.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.NoERE2024000013833.exe.2621d2d3b88.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x357aa:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3581c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x358a6:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35938:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x359a2:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35a14:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35aaa:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35b3a:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.NoERE2024000013833.exe.2621d296b40.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.NoERE2024000013833.exe.2621d296b40.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.NoERE2024000013833.exe.2621d296b40.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x339aa:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33a1c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33aa6:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33b38:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33ba2:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33c14:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33caa:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33d3a:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.NoERE2024000013833.exe.2621d296b40.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.NoERE2024000013833.exe.2621d296b40.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.NoERE2024000013833.exe.2621d296b40.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x357aa:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x727f2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3581c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x72864:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x358a6:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x728ee:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35938:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x72980:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x359a2:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x729ea:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35a14:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x72a5c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35aaa:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x72af2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35b3a:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x72b82:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 74.119.238.7, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, Initiated: true, ProcessId: 404, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49734

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T16:18:15.932722+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.4	49740	TCP
2024-10-31T16:18:53.588043+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.4	49744	TCP

ET MALWARE AgentTesla Exfil Via SMTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T16:18:06.266393+0100	2030171	1	A Network Trojan was detected	192.168.2.4	49734	74.119.238.7	587	TCP
2024-10-31T16:18:09.199310+0100	2030171	1	A Network Trojan was detected	192.168.2.4	49737	74.119.238.7	587	TCP
2024-10-31T16:19:36.572721+0100	2030171	1	A Network Trojan was detected	192.168.2.4	49928	74.119.238.7	587	TCP
2024-10-31T16:19:47.550104+0100	2030171	1	A Network Trojan was detected	192.168.2.4	49971	74.119.238.7	587	TCP
2024-10-31T16:19:49.981170+0100	2030171	1	A Network Trojan was detected	192.168.2.4	49978	74.119.238.7	587	TCP
2024-10-31T16:19:51.657687+0100	2030171	1	A Network Trojan was detected	192.168.2.4	49985	74.119.238.7	587	TCP
2024-10-31T16:20:15.887144+0100	2030171	1	A Network Trojan was detected	192.168.2.4	50014	74.119.238.7	587	TCP
2024-10-31T16:20:33.087424+0100	2030171	1	A Network Trojan was detected	192.168.2.4	50015	74.119.238.7	587	TCP
2024-10-31T16:20:53.473188+0100	2030171	1	A Network Trojan was detected	192.168.2.4	50016	74.119.238.7	587	TCP
2024-10-31T16:20:56.730866+0100	2030171	1	A Network Trojan was detected	192.168.2.4	50017	74.119.238.7	587	TCP
2024-10-31T16:21:44.874890+0100	2030171	1	A Network Trojan was detected	192.168.2.4	50019	74.119.238.7	587	TCP
2024-10-31T16:21:59.570878+0100	2030171	1	A Network Trojan was detected	192.168.2.4	50021	74.119.238.7	587	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T16:18:05.699966+0100	2855542	1	A Network Trojan was detected	192.168.2.4	49734	74.119.238.7	587	TCP
2024-10-31T16:18:08.968325+0100	2855542	1	A Network Trojan was detected	192.168.2.4	49737	74.119.238.7	587	TCP
2024-10-31T16:19:36.566245+0100	2855542	1	A Network Trojan was detected	192.168.2.4	49928	74.119.238.7	587	TCP
2024-10-31T16:19:47.543273+0100	2855542	1	A Network Trojan was detected	192.168.2.4	49971	74.119.238.7	587	TCP
2024-10-31T16:19:49.962198+0100	2855542	1	A Network Trojan was detected	192.168.2.4	49978	74.119.238.7	587	TCP
2024-10-31T16:19:51.650871+0100	2855542	1	A Network Trojan was detected	192.168.2.4	49985	74.119.238.7	587	TCP
2024-10-31T16:20:15.870251+0100	2855542	1	A Network Trojan was detected	192.168.2.4	50014	74.119.238.7	587	TCP
2024-10-31T16:20:33.079223+0100	2855542	1	A Network Trojan was detected	192.168.2.4	50015	74.119.238.7	587	TCP
2024-10-31T16:20:53.465102+0100	2855542	1	A Network Trojan was detected	192.168.2.4	50016	74.119.238.7	587	TCP
2024-10-31T16:20:56.722808+0100	2855542	1	A Network Trojan was detected	192.168.2.4	50017	74.119.238.7	587	TCP
2024-10-31T16:21:44.868302+0100	2855542	1	A Network Trojan was detected	192.168.2.4	50019	74.119.238.7	587	TCP
2024-10-31T16:21:59.564489+0100	2855542	1	A Network Trojan was detected	192.168.2.4	50021	74.119.238.7	587	TCP

ETPRO MALWARE Agent Tesla Exfil via SMTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T16:18:05.699966+0100	2855245	1	A Network Trojan was detected	192.168.2.4	49734	74.119.238.7	587	TCP

ETPRO MALWARE Win32/Agent Tesla SMTP Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T16:18:06.266393+0100	2839723	1	Malware Command and Control Activity Detected	192.168.2.4	49734	74.119.238.7	587	TCP
2024-10-31T16:18:09.199310+0100	2839723	1	Malware Command and Control Activity Detected	192.168.2.4	49737	74.119.238.7	587	TCP
2024-10-31T16:19:36.572721+0100	2839723	1	Malware Command and Control Activity Detected	192.168.2.4	49928	74.119.238.7	587	TCP
2024-10-31T16:19:47.550104+0100	2839723	1	Malware Command and Control Activity Detected	192.168.2.4	49971	74.119.238.7	587	TCP
2024-10-31T16:19:49.981170+0100	2839723	1	Malware Command and Control Activity Detected	192.168.2.4	49978	74.119.238.7	587	TCP
2024-10-31T16:19:51.657687+0100	2839723	1	Malware Command and Control Activity Detected	192.168.2.4	49985	74.119.238.7	587	TCP
2024-10-31T16:20:15.887144+0100	2839723	1	Malware Command and Control Activity Detected	192.168.2.4	50014	74.119.238.7	587	TCP
2024-10-31T16:20:33.087424+0100	2839723	1	Malware Command and Control Activity Detected	192.168.2.4	50015	74.119.238.7	587	TCP
2024-10-31T16:20:53.473188+0100	2839723	1	Malware Command and Control Activity Detected	192.168.2.4	50016	74.119.238.7	587	TCP
2024-10-31T16:20:56.730866+0100	2839723	1	Malware Command and Control Activity Detected	192.168.2.4	50017	74.119.238.7	587	TCP
2024-10-31T16:21:44.874890+0100	2839723	1	Malware Command and Control Activity Detected	192.168.2.4	50019	74.119.238.7	587	TCP
2024-10-31T16:21:59.570878+0100	2839723	1	Malware Command and Control Activity Detected	192.168.2.4	50021	74.119.238.7	587	TCP

ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T16:18:06.266393+0100	2840032	1	A Network Trojan was detected	192.168.2.4	49734	74.119.238.7	587	TCP
2024-10-31T16:18:09.199310+0100	2840032	1	A Network Trojan was detected	192.168.2.4	49737	74.119.238.7	587	TCP
2024-10-31T16:19:36.572721+0100	2840032	1	A Network Trojan was detected	192.168.2.4	49928	74.119.238.7	587	TCP
2024-10-31T16:19:47.550104+0100	2840032	1	A Network Trojan was detected	192.168.2.4	49971	74.119.238.7	587	TCP
2024-10-31T16:19:49.981170+0100	2840032	1	A Network Trojan was detected	192.168.2.4	49978	74.119.238.7	587	TCP
2024-10-31T16:19:51.657687+0100	2840032	1	A Network Trojan was detected	192.168.2.4	49985	74.119.238.7	587	TCP
2024-10-31T16:20:15.887144+0100	2840032	1	A Network Trojan was detected	192.168.2.4	50014	74.119.238.7	587	TCP
2024-10-31T16:20:33.087424+0100	2840032	1	A Network Trojan was detected	192.168.2.4	50015	74.119.238.7	587	TCP
2024-10-31T16:20:53.473188+0100	2840032	1	A Network Trojan was detected	192.168.2.4	50016	74.119.238.7	587	TCP
2024-10-31T16:20:56.730866+0100	2840032	1	A Network Trojan was detected	192.168.2.4	50017	74.119.238.7	587	TCP
2024-10-31T16:21:44.874890+0100	2840032	1	A Network Trojan was detected	192.168.2.4	50019	74.119.238.7	587	TCP
2024-10-31T16:21:59.570878+0100	2840032	1	A Network Trojan was detected	192.168.2.4	50021	74.119.238.7	587	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 2.2.InstallUtil.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.alhoneycomb.com", "Username": "blog@alhoneycomb.com", "Password": " WORTHwill3611! "}

Multi AV Scanner detection for submitted file

Source: NoERE2024000013833.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: NoERE2024000013833.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.1884610057.000002620CD82000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NoERE2024000013833.exe PID: 2004, type: MEMORYSTR

Source: NoERE2024000013833.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER8720.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdb source: WER8720.tmp.dmp.6.dr
Source:	Binary string: System.ni.pdbRSDS source: WER8720.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WER8720.tmp.dmp.6.dr
Source:	Binary string: System.Core.pdb source: WER8720.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb- source: WER8720.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER8720.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER8720.tmp.dmp.6.dr
Source:	Binary string: System.ni.pdb source: WER8720.tmp.dmp.6.dr
Source:	Binary string: System.pdb source: WER8720.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER8720.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER8720.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdb source: WER8720.tmp.dmp.6.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49737 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.4:49737 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.4:49737 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.4:49737 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2855245 - Severity 1 - ETPRO MALWARE Agent Tesla Exfil via SMTP : 192.168.2.4:49734 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49734 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.4:49734 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.4:49734 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.4:49734 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49928 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.4:49928 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.4:49928 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.4:49928 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49985 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49978 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49971 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.4:49985 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.4:49985 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.4:49985 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.4:49971 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.4:49978 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.4:49971 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.4:49978 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.4:49971 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.4:49978 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:50014 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:50015 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:50019 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:50021 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:50016 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.4:50019 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.4:50015 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.4:50019 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.4:50019 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.4:50021 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.4:50021 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.4:50015 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.4:50021 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.4:50015 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.4:50014 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.4:50014 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.4:50014 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.4:50016 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.4:50016 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.4:50016 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:50017 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.4:50017 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.4:50017 -> 74.119.238.7:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.4:50017 -> 74.119.238.7:587

Source: global traffic

TCP traffic: 192.168.2.4:49734 -> 74.119.238.7:587

Source: Joe Sandbox View

IP Address: 74.119.238.7 74.119.238.7

Source: Joe Sandbox View

ASN Name: VPLSNETUS VPLSNETUS

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.4:49740
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.4:49744

Source: global traffic

TCP traffic: 192.168.2.4:49734 -> 74.119.238.7:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mail.alhoneycomb.com

Source: InstallUtil.exe, 00000002.00000002.4123322438.0000000002D75000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4123322438.0000000002DE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4123322438.0000000002D2D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4123322438.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4123322438.0000000002F2E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4123322438.0000000002EEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4123322438.00000000030F3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4123322438.0000000003053000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4123322438.000000000318C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.alhoneycomb.com
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: NoERE2024000013833.exe, 00000000.00000002.1885047529.000002621D259000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4120836178.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.NoERE2024000013833.exe.2621d296b40.1.raw.unpack, SKTzxzsJw.cs	.Net Code: GhwkGV1Ll50
Source: 0.2.NoERE2024000013833.exe.2621d2d3b88.2.raw.unpack, SKTzxzsJw.cs	.Net Code: GhwkGV1Ll50

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.NoERE2024000013833.exe.2621d2d3b88.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.NoERE2024000013833.exe.2621d2d3b88.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.NoERE2024000013833.exe.2621d296b40.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.NoERE2024000013833.exe.2621d296b40.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Code function: 0_2_00007FFD9B87CB61	0_2_00007FFD9B87CB61
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Code function: 0_2_00007FFD9B8750F1	0_2_00007FFD9B8750F1
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Code function: 0_2_00007FFD9B8708B5	0_2_00007FFD9B8708B5
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Code function: 0_2_00007FFD9B88576F	0_2_00007FFD9B88576F
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Code function: 0_2_00007FFD9B87BF14	0_2_00007FFD9B87BF14
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Code function: 0_2_00007FFD9B87C6D9	0_2_00007FFD9B87C6D9
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Code function: 0_2_00007FFD9B87F4E5	0_2_00007FFD9B87F4E5
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Code function: 0_2_00007FFD9B879530	0_2_00007FFD9B879530
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Code function: 0_2_00007FFD9B8711F2	0_2_00007FFD9B8711F2
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Code function: 0_2_00007FFD9B88107C	0_2_00007FFD9B88107C
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Code function: 0_2_00007FFD9B8857BC	0_2_00007FFD9B8857BC
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Code function: 0_2_00007FFD9B940050	0_2_00007FFD9B940050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_01150006	2_2_01150006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_01150040	2_2_01150040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02AF4330	2_2_02AF4330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02AF4C00	2_2_02AF4C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02AF3FE8	2_2_02AF3FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02AFBF20	2_2_02AFBF20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02AFBF12	2_2_02AFBF12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06286E50	2_2_06286E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0628BF38	2_2_0628BF38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0628A7A8	2_2_0628A7A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_062807F8	2_2_062807F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06283B38	2_2_06283B38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0628F3EF	2_2_0628F3EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06289A8B	2_2_06289A8B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0628B858	2_2_0628B858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_062C46B8	2_2_062C46B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_062C9CAC	2_2_062C9CAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_062C26F0	2_2_062C26F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_062CB551	2_2_062CB551
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_062C9CA0	2_2_062C9CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_062C7CC0	2_2_062C7CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06749B89	2_2_06749B89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06744BA0	2_2_06744BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06743920	2_2_06743920

Source: C:\Users\user\Desktop\NoERE2024000013833.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2004 -s 1036

Source: NoERE2024000013833.exe

Static PE information: No import functions for PE file found

Source: NoERE2024000013833.exe, 00000000.00000002.1884538117.000002620C990000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameUtowipujilozizifena0 vs NoERE2024000013833.exe
Source: NoERE2024000013833.exe, 00000000.00000002.1885047529.000002621D259000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb17b300f-3107-4f0e-bd36-73672dc506a5.exe4 vs NoERE2024000013833.exe
Source: NoERE2024000013833.exe, 00000000.00000000.1658635757.000002620ADA6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFuckingShit.exe8 vs NoERE2024000013833.exe
Source: NoERE2024000013833.exe	Binary or memory string: OriginalFilenameFuckingShit.exe8 vs NoERE2024000013833.exe

Source: 0.2.NoERE2024000013833.exe.2621d2d3b88.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.NoERE2024000013833.exe.2621d2d3b88.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.NoERE2024000013833.exe.2621d296b40.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.NoERE2024000013833.exe.2621d296b40.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: NoERE2024000013833.exe, ----.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.NoERE2024000013833.exe.2621d296b40.1.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.NoERE2024000013833.exe.2621d296b40.1.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.NoERE2024000013833.exe.2621d296b40.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.NoERE2024000013833.exe.2621d296b40.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.NoERE2024000013833.exe.2621d296b40.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.NoERE2024000013833.exe.2621d296b40.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.NoERE2024000013833.exe.2621d296b40.1.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.NoERE2024000013833.exe.2621d296b40.1.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@7/5@1/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7108:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2004

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\da0b6137-ac40-4635-a4ba-2761987917a1

Jump to behavior

Source: NoERE2024000013833.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: NoERE2024000013833.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\NoERE2024000013833.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: NoERE2024000013833.exe

ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\NoERE2024000013833.exe

File read: C:\Users\user\Desktop\NoERE2024000013833.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\NoERE2024000013833.exe "C:\Users\user\Desktop\NoERE2024000013833.exe"
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2004 -s 1036
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\NoERE2024000013833.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\NoERE2024000013833.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: NoERE2024000013833.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: NoERE2024000013833.exe

Static file information: File size 3596943 > 1048576

Source: NoERE2024000013833.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: NoERE2024000013833.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER8720.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdb source: WER8720.tmp.dmp.6.dr
Source:	Binary string: System.ni.pdbRSDS source: WER8720.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WER8720.tmp.dmp.6.dr
Source:	Binary string: System.Core.pdb source: WER8720.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb- source: WER8720.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER8720.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER8720.tmp.dmp.6.dr
Source:	Binary string: System.ni.pdb source: WER8720.tmp.dmp.6.dr
Source:	Binary string: System.pdb source: WER8720.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER8720.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER8720.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdb source: WER8720.tmp.dmp.6.dr

Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Code function: 0_2_00007FFD9B877963 push ebx; retf	0_2_00007FFD9B87796A
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Code function: 0_2_00007FFD9B877960 push ebx; retf	0_2_00007FFD9B87796A
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Code function: 0_2_00007FFD9B8768B9 push ebp; retn 0008h	0_2_00007FFD9B8768BA
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Code function: 0_2_00007FFD9B8768CC push esp; retn 0008h	0_2_00007FFD9B8768CD
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Code function: 0_2_00007FFD9B870814 pushad ; ret	0_2_00007FFD9B870821
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Code function: 0_2_00007FFD9B940050 push esp; retf 4810h	0_2_00007FFD9B940312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_062CC0B0 push es; ret	2_2_062CC0C0

Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: NoERE2024000013833.exe PID: 2004, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: NoERE2024000013833.exe, 00000000.00000002.1884610057.000002620CD82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: NoERE2024000013833.exe, 00000000.00000002.1884610057.000002620CD82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Memory allocated: 2620B0D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Memory allocated: 26224A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2A50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 7373			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2467			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -200000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -99546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -99218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -98999s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -98780s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -98671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -98562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -98452s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -98336s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -98218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -98098s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -97968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -97660s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -97540s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -97359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -97250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -97137s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -99344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -99233s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -99119s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -99014s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -98905s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -98796s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -98687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -98578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -98469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -98139s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -97812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -97594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -97484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -97375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5480	Thread sleep time: -97265s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98780	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98452	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98336	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98098	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97660	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97540	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97137	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99233	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99119	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99014	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98905	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98139	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97265	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: NoERE2024000013833.exe, 00000000.00000002.1884610057.000002620CD82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: NoERE2024000013833.exe, 00000000.00000002.1884610057.000002620CD82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: NoERE2024000013833.exe, 00000000.00000002.1884610057.000002620CD82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: NoERE2024000013833.exe, 00000000.00000002.1884610057.000002620CD82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: NoERE2024000013833.exe, 00000000.00000002.1884610057.000002620CD82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: InstallUtil.exe, 00000002.00000002.4129065646.0000000006067000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: NoERE2024000013833.exe, 00000000.00000002.1884610057.000002620CD82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: NoERE2024000013833.exe, 00000000.00000002.1884610057.000002620CD82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: NoERE2024000013833.exe, 00000000.00000002.1884610057.000002620CD82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: NoERE2024000013833.exe, 00000000.00000002.1884610057.000002620CD82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: NoERE2024000013833.exe, 00000000.00000002.1884610057.000002620CD82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: NoERE2024000013833.exe, 00000000.00000002.1884610057.000002620CD82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\NoERE2024000013833.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: NoERE2024000013833.exe, ----.cs	Reference to suspicious API methods: GetProcAddress(_320E_A9B4_322A, _31CA_A9B4_31C8_3197_322E)
Source: NoERE2024000013833.exe, ----.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer<_D7FE_3201>(GetProcAddress(LoadLibrary(_A9B7_31DB_320B_3197[2]), _A9B7_31DB_320B_3197[3]))
Source: 0.2.NoERE2024000013833.exe.2621d296b40.1.raw.unpack, zOS.cs	Reference to suspicious API methods: _120HqGy.OpenProcess(_2pIt.DuplicateHandle, bInheritHandle: true, (uint)iVE.ProcessID)

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\NoERE2024000013833.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\NoERE2024000013833.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 442000	Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: BDB008	Jump to behavior

Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"			Jump to behavior
Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"			Jump to behavior

Source: C:\Users\user\Desktop\NoERE2024000013833.exe	Queries volume information: C:\Users\user\Desktop\NoERE2024000013833.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\NoERE2024000013833.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.NoERE2024000013833.exe.2621d2d3b88.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NoERE2024000013833.exe.2621d2d3b88.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NoERE2024000013833.exe.2621d296b40.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NoERE2024000013833.exe.2621d296b40.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4120836178.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1885047529.000002621D259000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4123322438.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NoERE2024000013833.exe PID: 2004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 404, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.NoERE2024000013833.exe.2621d2d3b88.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NoERE2024000013833.exe.2621d2d3b88.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NoERE2024000013833.exe.2621d296b40.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NoERE2024000013833.exe.2621d296b40.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4120836178.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1885047529.000002621D259000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4123322438.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NoERE2024000013833.exe PID: 2004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 404, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.NoERE2024000013833.exe.2621d2d3b88.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NoERE2024000013833.exe.2621d2d3b88.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NoERE2024000013833.exe.2621d296b40.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NoERE2024000013833.exe.2621d296b40.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4120836178.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1885047529.000002621D259000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4123322438.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NoERE2024000013833.exe PID: 2004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 404, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Disable or Modify Tools	2 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	151 Virtualization/Sandbox Evasion	21 Input Capture	1 Process Discovery	Remote Desktop Protocol	21 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	1 Credentials in Registry	151 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Data from Local System	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
NoERE2024000013833.exe	32%	ReversingLabs	Win64.Trojan.Generic
NoERE2024000013833.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.alhoneycomb.com	74.119.238.7	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
https://account.dyn.com/	NoERE2024000013833.exe, 00000000.00000002.1885047529.000002621D259000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4120836178.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.alhoneycomb.com	InstallUtil.exe, 00000002.00000002.4123322438.0000000002D75000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4123322438.0000000002DE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4123322438.0000000002D2D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4123322438.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4123322438.0000000002F2E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4123322438.0000000002EEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4123322438.00000000030F3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4123322438.0000000003053000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4123322438.000000000318C000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
74.119.238.7	mail.alhoneycomb.com	United States		35908	VPLSNETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546202
Start date and time:	2024-10-31 16:17:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NoERE2024000013833.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@7/5@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 107 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: NoERE2024000013833.exe

Simulations

Behavior and APIs

Time	Type	Description
11:18:02	API Interceptor	10671733x Sleep call for process: InstallUtil.exe modified
11:18:18	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
74.119.238.7	1863415243647.exe	Get hash	malicious	AgentTesla	Browse
	Halkbank_Ekstre_20230426_075819_154085.exe	Get hash	malicious	AgentTesla	Browse
	hesaphareketi-01.exe	Get hash	malicious	AgentTesla	Browse
	New Purchase Order.exe	Get hash	malicious	AgentTesla	Browse
	rPO_CW00402902400415.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.alhoneycomb.com	1863415243647.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	Halkbank_Ekstre_20230426_075819_154085.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	hesaphareketi-01.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	New Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	rPO_CW00402902400415.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VPLSNETUS	bin.sh.elf	Get hash	malicious	Mirai	Browse	174.139.206.51
	arm7.elf	Get hash	malicious	Unknown	Browse	98.126.6.24
	mpsl.elf	Get hash	malicious	Unknown	Browse	174.139.231.14
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	174.139.68.183
	1863415243647.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	Halkbank_Ekstre_20230426_075819_154085.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	hesaphareketi-01.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	174.139.218.86
	na.elf	Get hash	malicious	Mirai	Browse	98.126.6.38
	New Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_NoERE20240000138_63a7ade33fcf8e6782cf4f395bc29799fa92023_992c1a96_9a37bb2c-84d5-4845-8954-bb1a9aef85a6\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9932461349061201
Encrypted:	false
SSDEEP:	192:vbj6y9PO50UnUVaWBHpgXzuiFGZ24lO8iy3:X6WPjUnUVamHeXzuiFGY4lO8iU
MD5:	5EC5E245890469DF39F49673454CCCB7
SHA1:	74DE4AF62F52133CE1EE8216F03FD99104E44585
SHA-256:	89425EB36EE10CA5D0E68DE34A86C818474E56E8D1F05EDDC64457996A27336B
SHA-512:	2EF14DDF94B24F928C0637C858741AADF3757B0DD6D6E6E00CD559D4507707187F3CE5E382ECC47F486F3881A06064BACCB488CE2ADFC4D0A6E4E8BB417CBB47
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.8.6.1.4.7.8.7.9.8.1.0.8.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.8.6.1.4.7.9.3.4.4.9.8.4.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.a.3.7.b.b.2.c.-.8.4.d.5.-.4.8.4.5.-.8.9.5.4.-.b.b.1.a.9.a.e.f.8.5.a.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.6.a.e.6.c.0.7.-.8.4.1.1.-.4.6.a.7.-.8.a.9.3.-.e.e.8.e.7.5.c.5.b.2.8.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.N.o.E.R.E.2.0.2.4.0.0.0.0.1.3.8.3.3...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.F.u.c.k.i.n.g.S.h.i.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.d.4.-.0.0.0.1.-.0.0.1.4.-.a.e.b.a.-.1.b.1.0.a.8.2.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.3.7.a.6.c.6.3.8.f.5.6.b.c.f.2.3.e.8.5.7.0.f.c.8.f.1.1.f.3.3.0.0.0.0.0.0.0.0.!.0.0.0.0.9.2.8.a.3.a.c.2.6.d.c.9.9.3.8.3.b.2.1.c.5.f.a.0.7.1.e.4.d.2.4.5.b.0.c.a.1.1.f.c.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8720.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Thu Oct 31 15:17:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	387163
Entropy (8bit):	3.295704502732141
Encrypted:	false
SSDEEP:	3072:V/E+jM43gVpW31psAdE4qjcSgi1CCqQRHb3+vw0ll5:V/E+A6EW3Cn37qQRHb3Q
MD5:	48060F58B2BEEEE8C20B2D0580C6A44F
SHA1:	C5E0F40BE0AEEDB158C9A46C1984CA2B9B48CA87
SHA-256:	C5D87F1507BEC3CEC95600543FAE14991BA6FAE9C2A7F1E4EE385F64FFE46A80
SHA-512:	5024BEF1B3C79A3BB5393E233F71CB15A8F907B82C70671F5286691163A9D2833B2F3078E4B9DAD39B075086BEB70178C22A92293E952B9EA7C3208661E63201
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........#g....................................$...........d...(.......tF...u..........l.......8...........T............(...............8..........x:..............................................................................eJ.......;......Lw......................T.............#g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8888.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8630
Entropy (8bit):	3.7090208150508963
Encrypted:	false
SSDEEP:	192:R6l7wVeJY1Db6Y9BacJgmfx6J/prp89bLb4fw45m:R6lXJub6YracJgmfxi0L0fU
MD5:	58A8C4531AC384BD0F841887EE634B14
SHA1:	F739EF9A2F48F2B9AC950DFB4DA499D58017FF5D
SHA-256:	C12EA758FBA5EF9504F61717645333E01A2D67A48A716FBFC788F26D03DC9F40
SHA-512:	96D743039E3E47FC83DB29D3C5D8B7AAC9882142602E93E82C9E6122D9159AF554936C3B14F41CEB87892B40ADDF5AACF90C200264E49EA91127C74CCA88D664
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.0.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER88B8.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4799
Entropy (8bit):	4.525115378505152
Encrypted:	false
SSDEEP:	48:cvIwWl8zsLJg771I9PkWpW8VYkYm8M4JMAFMyq85CLmwUpd:uIjflI7o97VsJE5tUpd
MD5:	C080245CF9010E22E43334BDA40C14B6
SHA1:	43548480ED27DD40F82CFDECFC4D79DF6DF6DEC1
SHA-256:	D706C443DBBBD9E7BD88A2666EDE8E69A6CC4BF9EC738B06F89B7C5D65CF9508
SHA-512:	08BF3E9256D607B9484CCEBF820C20879C345CF2E727F06C129234871B320D408A1D8A869C9816D1828D2195CE4BC376E943F65FF1B2A2127DBA4874C03A4AD5
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="567740" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465752430567172
Encrypted:	false
SSDEEP:	6144:kIXfpi67eLPU9skLmb0b48WSPKaJG8nAgejZMMhA2gX4WABl0uNldwBCswSbhD:ZXD948WlLZMM6YFHr+h
MD5:	A613EEFEF6123EE9CEB85E8648E69968
SHA1:	DB1758C004CAB803B8DD6D2B1F40DE01D7715121
SHA-256:	8A57E52447EBB1E8C34E807C41818FF2B257DFF54E618288A26A85803B59E318
SHA-512:	C00BABA0CA48757FDD05CBF3984561C80E4EC9FAC117C6797E3BEE9E1286BF94DDEA3C5C8EBD0A8EF53B6EF879257B896B647AD450431929A11926DDAA1D5EEF
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.....+...............................................................................................................................................................................................................................................................................................................................................i.%........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.236772874604311
TrID:	Win64 Executable Console Net Framework (206006/5) 48.58% Win64 Executable Console (202006/5) 47.64% Win64 Executable (generic) (12005/4) 2.83% Generic Win/DOS Executable (2004/3) 0.47% DOS Executable Generic (2002/1) 0.47%
File name:	NoERE2024000013833.exe
File size:	3'596'943 bytes
MD5:	fcd3727d56f9e69be13c397a22b8843e
SHA1:	928a3ac26dc99383b21c5fa071e4d245b0ca11fc
SHA256:	d36e88ce588046e6ebb2f893aa7bb910ae99be757e8d879f820fc8188b0d79c1
SHA512:	ec09e0dc5621835c31a62a3cdf435ada632f84584c612ee96bc87e62378837ff627059a9b468d114d33588e0b7ecacc14af29a63d8402313017a07ddef6eac13
SSDEEP:	12288:xquBeBsQLLzjmEY/5Li5oIUCmItmiFYMjrSpxPmGqQvU0z3H2KGvL:xW25L+0IgiFpiuwHKvL
TLSH:	70F512943B972E0BFC6E56B4C0D232F280FE5D1379F6869FCF456CA502969BC2242578
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f#g.........."...0..(............... ....@...... ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x672366A9 [Thu Oct 31 11:14:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x5f6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x484e	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x28ee	0x2a00	24199f46333ad2965bad19322cae93d6	False	0.6167224702380952	data	6.234249124640782	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x5f6	0x600	c49dc9dc5c1b1149f6f38bdcafe82caa	False	0.4166666666666667	data	4.214703724660371	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x60a0	0x36c	data			0.3938356164383562
RT_MANIFEST	0x640c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T16:18:05.699966+0100	2855245	ETPRO MALWARE Agent Tesla Exfil via SMTP	1	192.168.2.4	49734	74.119.238.7	587	TCP
2024-10-31T16:18:05.699966+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49734	74.119.238.7	587	TCP
2024-10-31T16:18:06.266393+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.4	49734	74.119.238.7	587	TCP
2024-10-31T16:18:06.266393+0100	2839723	ETPRO MALWARE Win32/Agent Tesla SMTP Activity	1	192.168.2.4	49734	74.119.238.7	587	TCP
2024-10-31T16:18:06.266393+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.4	49734	74.119.238.7	587	TCP
2024-10-31T16:18:08.968325+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49737	74.119.238.7	587	TCP
2024-10-31T16:18:09.199310+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.4	49737	74.119.238.7	587	TCP
2024-10-31T16:18:09.199310+0100	2839723	ETPRO MALWARE Win32/Agent Tesla SMTP Activity	1	192.168.2.4	49737	74.119.238.7	587	TCP
2024-10-31T16:18:09.199310+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.4	49737	74.119.238.7	587	TCP
2024-10-31T16:18:15.932722+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.4	49740	TCP
2024-10-31T16:18:53.588043+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.4	49744	TCP
2024-10-31T16:19:36.566245+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49928	74.119.238.7	587	TCP
2024-10-31T16:19:36.572721+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.4	49928	74.119.238.7	587	TCP
2024-10-31T16:19:36.572721+0100	2839723	ETPRO MALWARE Win32/Agent Tesla SMTP Activity	1	192.168.2.4	49928	74.119.238.7	587	TCP
2024-10-31T16:19:36.572721+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.4	49928	74.119.238.7	587	TCP
2024-10-31T16:19:47.543273+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49971	74.119.238.7	587	TCP
2024-10-31T16:19:47.550104+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.4	49971	74.119.238.7	587	TCP
2024-10-31T16:19:47.550104+0100	2839723	ETPRO MALWARE Win32/Agent Tesla SMTP Activity	1	192.168.2.4	49971	74.119.238.7	587	TCP
2024-10-31T16:19:47.550104+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.4	49971	74.119.238.7	587	TCP
2024-10-31T16:19:49.962198+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49978	74.119.238.7	587	TCP
2024-10-31T16:19:49.981170+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.4	49978	74.119.238.7	587	TCP
2024-10-31T16:19:49.981170+0100	2839723	ETPRO MALWARE Win32/Agent Tesla SMTP Activity	1	192.168.2.4	49978	74.119.238.7	587	TCP
2024-10-31T16:19:49.981170+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.4	49978	74.119.238.7	587	TCP
2024-10-31T16:19:51.650871+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49985	74.119.238.7	587	TCP
2024-10-31T16:19:51.657687+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.4	49985	74.119.238.7	587	TCP
2024-10-31T16:19:51.657687+0100	2839723	ETPRO MALWARE Win32/Agent Tesla SMTP Activity	1	192.168.2.4	49985	74.119.238.7	587	TCP
2024-10-31T16:19:51.657687+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.4	49985	74.119.238.7	587	TCP
2024-10-31T16:20:15.870251+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	50014	74.119.238.7	587	TCP
2024-10-31T16:20:15.887144+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.4	50014	74.119.238.7	587	TCP
2024-10-31T16:20:15.887144+0100	2839723	ETPRO MALWARE Win32/Agent Tesla SMTP Activity	1	192.168.2.4	50014	74.119.238.7	587	TCP
2024-10-31T16:20:15.887144+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.4	50014	74.119.238.7	587	TCP
2024-10-31T16:20:33.079223+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	50015	74.119.238.7	587	TCP
2024-10-31T16:20:33.087424+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.4	50015	74.119.238.7	587	TCP
2024-10-31T16:20:33.087424+0100	2839723	ETPRO MALWARE Win32/Agent Tesla SMTP Activity	1	192.168.2.4	50015	74.119.238.7	587	TCP
2024-10-31T16:20:33.087424+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.4	50015	74.119.238.7	587	TCP
2024-10-31T16:20:53.465102+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	50016	74.119.238.7	587	TCP
2024-10-31T16:20:53.473188+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.4	50016	74.119.238.7	587	TCP
2024-10-31T16:20:53.473188+0100	2839723	ETPRO MALWARE Win32/Agent Tesla SMTP Activity	1	192.168.2.4	50016	74.119.238.7	587	TCP
2024-10-31T16:20:53.473188+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.4	50016	74.119.238.7	587	TCP
2024-10-31T16:20:56.722808+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	50017	74.119.238.7	587	TCP
2024-10-31T16:20:56.730866+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.4	50017	74.119.238.7	587	TCP
2024-10-31T16:20:56.730866+0100	2839723	ETPRO MALWARE Win32/Agent Tesla SMTP Activity	1	192.168.2.4	50017	74.119.238.7	587	TCP
2024-10-31T16:20:56.730866+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.4	50017	74.119.238.7	587	TCP
2024-10-31T16:21:44.868302+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	50019	74.119.238.7	587	TCP
2024-10-31T16:21:44.874890+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.4	50019	74.119.238.7	587	TCP
2024-10-31T16:21:44.874890+0100	2839723	ETPRO MALWARE Win32/Agent Tesla SMTP Activity	1	192.168.2.4	50019	74.119.238.7	587	TCP
2024-10-31T16:21:44.874890+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.4	50019	74.119.238.7	587	TCP
2024-10-31T16:21:59.564489+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	50021	74.119.238.7	587	TCP
2024-10-31T16:21:59.570878+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.4	50021	74.119.238.7	587	TCP
2024-10-31T16:21:59.570878+0100	2839723	ETPRO MALWARE Win32/Agent Tesla SMTP Activity	1	192.168.2.4	50021	74.119.238.7	587	TCP
2024-10-31T16:21:59.570878+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.4	50021	74.119.238.7	587	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 16:18:03.253041983 CET	49734	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:03.259742022 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:03.259830952 CET	49734	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:04.470115900 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:04.480895996 CET	49734	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:04.486460924 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:04.645661116 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:04.646835089 CET	49734	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:04.655706882 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:04.800005913 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:04.804245949 CET	49734	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:04.809015036 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:05.144268990 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:05.184948921 CET	49734	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:05.189750910 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:05.351702929 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:05.366583109 CET	49734	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:05.371413946 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:05.535995960 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:05.536242008 CET	49734	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:05.541055918 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:05.698997021 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:05.699872017 CET	49734	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:05.699965954 CET	49734	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:05.700009108 CET	49734	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:05.700038910 CET	49734	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:05.704683065 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:05.704694033 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:05.704873085 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:05.704885006 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:05.857727051 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:05.902436018 CET	49734	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:05.908706903 CET	49734	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:05.913686037 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:06.266205072 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:06.266392946 CET	49734	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:06.267671108 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:06.271636963 CET	587	49734	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:06.271827936 CET	49734	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:06.272991896 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:06.273082972 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:06.962619066 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:06.962841034 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:06.968152046 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.159893990 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.160104990 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:08.177380085 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.177438974 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:08.178266048 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.178308010 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:08.179115057 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.179150105 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.179161072 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:08.317024946 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.317230940 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:08.323467970 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.475339890 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.475465059 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:08.480357885 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.639945030 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.640073061 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:08.644887924 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.811012983 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.811247110 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:08.816067934 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.966856956 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.968254089 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:08.968298912 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:08.968324900 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:08.968353033 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:08.968462944 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:08.968512058 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:08.968542099 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:08.968556881 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:08.968581915 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:18:08.973288059 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.973295927 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.973412991 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.973558903 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.973572016 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.973579884 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.973629951 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:08.973838091 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:09.147162914 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:18:09.199310064 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:34.416914940 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:34.421885967 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:34.775343895 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:34.775441885 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:34.776367903 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:34.780706882 CET	587	49737	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:34.780766964 CET	49737	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:34.781152964 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:34.781208038 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:35.478149891 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:35.480988979 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:35.486838102 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:35.643930912 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:35.644318104 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:35.649429083 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:35.805958986 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:35.806173086 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:35.811186075 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.071170092 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.071660042 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.076520920 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.231666088 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.231995106 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.236793041 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.404135942 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.405733109 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.410826921 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.565882921 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.566145897 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.566219091 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.566245079 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.566322088 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.567622900 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.571233988 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.571244955 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.571253061 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.571319103 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.571507931 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.572585106 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.572663069 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.572669029 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.572680950 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.572699070 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.572715044 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.572721004 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.572726965 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.572751045 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.572778940 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.572793007 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.576107979 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.576155901 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.577580929 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.577641010 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.577680111 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.577739954 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.577824116 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.577833891 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.577868938 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.577877045 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.577878952 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.577892065 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.577923059 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.577939034 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.577945948 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.577992916 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.580950975 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.580997944 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.582370996 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.582422018 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.582448959 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.582495928 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.582554102 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.582604885 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.582719088 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.582763910 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:36.582783937 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.582803965 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.582869053 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.582906961 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.582961082 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.582973957 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.582986116 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.583030939 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.583039999 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.583096981 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.583106995 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.583115101 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.583200932 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.585915089 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587117910 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587137938 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587198019 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587207079 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587328911 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587337971 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587357044 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587366104 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587392092 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587435007 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587488890 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587503910 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587596893 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587626934 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587635994 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587713957 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587723017 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587730885 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587747097 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587755919 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587765932 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587775946 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587795973 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587832928 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:36.587842941 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:37.036322117 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:37.090159893 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:45.429310083 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:45.434415102 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:45.857887983 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:45.857920885 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:45.858005047 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:45.861299038 CET	49928	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:45.865992069 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:45.866147041 CET	587	49928	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:45.870892048 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:45.871093988 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:46.582937956 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:46.584023952 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:46.588937998 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:46.740765095 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:46.740955114 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:46.745841026 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:46.897644997 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:46.897901058 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:46.902710915 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.056622982 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.056885958 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:47.061822891 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.220524073 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.220715046 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:47.225626945 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.386177063 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.386328936 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:47.391230106 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.542891026 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.543190002 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:47.543272972 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:47.543272972 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:47.544810057 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:47.544810057 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:47.548171997 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.548201084 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.548223019 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.548342943 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:47.549768925 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.549877882 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.549911976 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.550065041 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.550103903 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:47.550137043 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.550203085 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:47.550308943 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:47.553230047 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.554944992 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.554999113 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.555118084 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.555161953 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.555210114 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:47.555387020 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.555947065 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:47.556189060 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:47.560245991 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.560504913 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.560575008 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.561022043 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.561078072 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.561115980 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.561150074 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:47.561160088 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.561172009 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.561213970 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.561220884 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.561245918 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.561258078 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.561284065 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.565464973 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.565471888 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566098928 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566118002 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566231966 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566242933 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566248894 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566261053 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566277027 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566288948 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566327095 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566338062 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566404104 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566415071 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566492081 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566576004 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566581011 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566591978 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566615105 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566627026 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566682100 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566694021 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566716909 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566765070 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.566771030 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.952250004 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:47.958897114 CET	587	49971	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:47.959120035 CET	49971	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:48.014801979 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:48.019726992 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:48.019819975 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:48.725155115 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:48.726598978 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:48.731576920 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:48.879946947 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:48.880232096 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:48.885169983 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.313122034 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.314250946 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.314301968 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:49.331835032 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:49.336734056 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.489509106 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.490072012 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:49.494836092 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.643208981 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.643363953 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:49.648205042 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.806843042 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.806992054 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:49.811866999 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.961858988 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.962136984 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:49.962136984 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:49.962198019 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:49.962220907 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:49.963551044 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:49.967035055 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.967048883 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.967061996 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.967077017 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.967133045 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:49.968419075 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.968431950 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.968446016 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.968457937 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.968530893 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.968554020 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.972281933 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.981169939 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:49.986253977 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.986351967 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.986476898 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.986490011 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.986540079 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.988204002 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:49.996576071 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:50.001564026 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.001597881 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.001642942 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:50.001652002 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.001691103 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:50.001705885 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:50.001740932 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.001874924 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.001878977 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:50.002033949 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002048016 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002079964 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002093077 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002156019 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002254963 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002269030 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002283096 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002325058 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002337933 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002371073 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002383947 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002396107 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002409935 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002423048 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002445936 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002460957 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002474070 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002496958 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.002509117 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.007065058 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.007088900 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.007103920 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.007193089 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.007205009 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.007225990 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.007241011 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.007255077 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.007278919 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.007303953 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.007324934 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.007338047 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.007358074 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.007365942 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.007860899 CET	587	49978	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.007917881 CET	49978	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:50.033893108 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:50.038892031 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.038976908 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:50.678345919 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.678474903 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:50.683326006 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.835803986 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.835926056 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:50.840874910 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.993899107 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:50.994069099 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:50.999015093 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.154047012 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.154176950 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:51.158948898 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.310635090 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.310894966 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:51.316016912 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.483351946 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.483494043 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:51.488400936 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.650290966 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.650790930 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:51.650790930 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:51.650871038 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:51.650871038 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:51.652761936 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:51.655704975 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.655716896 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.655721903 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.655726910 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.655822992 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:51.657602072 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.657686949 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:51.657706976 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.657828093 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:51.662605047 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.662813902 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.662950993 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:51.663022995 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.663130045 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:51.667973995 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668025017 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668107033 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668174028 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668209076 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668226004 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:51.668291092 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668301105 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668363094 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668401957 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668483019 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668487072 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668518066 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668535948 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668596029 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668601990 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668603897 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668638945 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668642998 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668672085 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668726921 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668740988 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.668745041 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673114061 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673118114 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673141956 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673185110 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673188925 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673228025 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673237085 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673240900 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673260927 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673265934 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673305035 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673327923 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673331976 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673336983 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673367977 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673372984 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673391104 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673422098 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.673425913 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:51.675967932 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:19:51.681224108 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:52.103801966 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:19:52.152674913 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:13.708986044 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:13.713892937 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:14.067080021 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:14.067351103 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:14.068162918 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:14.072510958 CET	587	49985	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:14.072570086 CET	49985	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:14.072943926 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:14.073004961 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:14.773274899 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:14.777765036 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:14.782723904 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:14.934442997 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:14.936115980 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:14.941227913 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.091141939 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.096164942 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:15.101360083 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.375216007 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.378133059 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:15.383671045 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.546149969 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.550411940 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:15.555355072 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.713881969 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.714025021 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:15.719223022 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.869781971 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.870156050 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:15.870225906 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:15.870250940 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:15.870326042 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:15.872834921 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:15.875080109 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.875091076 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.875098944 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.875150919 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:15.875281096 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.877744913 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.877799988 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.877814054 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.877821922 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.877832890 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.877841949 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.877954960 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.887144089 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:15.892226934 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.892280102 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:15.893006086 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.893081903 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:15.899481058 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.899581909 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:15.904572964 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.904644012 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.904686928 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.904736042 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.904787064 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.904838085 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.904927969 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.904990911 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.904999971 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905047894 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905052900 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905061007 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905203104 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905211926 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905220985 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905230045 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905237913 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905252934 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905332088 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905333996 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905338049 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905339003 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905342102 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905352116 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905360937 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905376911 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905388117 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905461073 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905471087 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905478954 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905587912 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905632973 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:15.905642033 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:16.324552059 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:16.467628002 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:30.909288883 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:30.914236069 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:31.266510963 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:31.266727924 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:31.270100117 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:31.271886110 CET	587	50014	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:31.272003889 CET	50014	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:31.275063992 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:31.275156021 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:31.953761101 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:31.953902006 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:31.958899021 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:32.110306978 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:32.110446930 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:32.115632057 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:32.423291922 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:32.423507929 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:32.428390026 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:32.580900908 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:32.582299948 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:32.587186098 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:32.737236977 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:32.737931967 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:32.742739916 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:32.913315058 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:32.913691044 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:32.918998957 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.078877926 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.079199076 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.079199076 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.079222918 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.079353094 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.082381964 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.084137917 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.084142923 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.084150076 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.084244967 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.084377050 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.087321043 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.087327003 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.087331057 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.087354898 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.087424040 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.087819099 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.087903023 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.092272043 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.092396021 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.092413902 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.092464924 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.092473984 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.092636108 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.092679024 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.092771053 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.092869997 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.092885971 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.092890024 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.092900038 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.092959881 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.092967987 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.093031883 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.093076944 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.093177080 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.097322941 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.097424984 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.097472906 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.097516060 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.097573996 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.097609997 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.097641945 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.097647905 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.097683907 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.097749949 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.097750902 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:33.097862959 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.097915888 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.097960949 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.098062038 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.098066092 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.098113060 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.098225117 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.098228931 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.098232985 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.098243952 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.098256111 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.098259926 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.098396063 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.098400116 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.098413944 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.098432064 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.098437071 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.102387905 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.102464914 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.102469921 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.102520943 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.102524996 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.102535963 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.102580070 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.102623940 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.102674007 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.102699041 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.102726936 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.102854013 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.102917910 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.102925062 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.102972031 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.103115082 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.103120089 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.103123903 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.103245020 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.526276112 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:33.715512991 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:51.302103996 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:51.307035923 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:51.661803961 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:51.661926985 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:51.662985086 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:51.667896986 CET	587	50015	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:51.667917967 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:51.667944908 CET	50015	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:51.668006897 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:52.340404034 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:52.348177910 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:52.353123903 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:52.506561041 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:52.509721041 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:52.515758038 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:52.671910048 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:52.672347069 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:52.677522898 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:52.972326040 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:52.976176023 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:52.983505964 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.134902000 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.135101080 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.140074968 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.305529118 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.307244062 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.312293053 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.464618921 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.465007067 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.465101957 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.465101957 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.465101957 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.468106031 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.470099926 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.470118999 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.470122099 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.470136881 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.470206976 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.473092079 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.473161936 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.473166943 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.473187923 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.473303080 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.473309994 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.473315001 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.473352909 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.473423004 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.473449945 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.473563910 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.478183985 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.478303909 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.478312969 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.478424072 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.478557110 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.478720903 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.478792906 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.478799105 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.478825092 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.478892088 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.478967905 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.484019995 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.484178066 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.484291077 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.484424114 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.484441996 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.484523058 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.484539032 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.484565973 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.484589100 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.484594107 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.484637022 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:53.484739065 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.484983921 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.485049963 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.485126972 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.485178947 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.485184908 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.485280991 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.485285997 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.485291958 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.485337973 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.485343933 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.485356092 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.485361099 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.485367060 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.485371113 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.489818096 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.489824057 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.489906073 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.489912033 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.489921093 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.489922047 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.490381002 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.490426064 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.490487099 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.490495920 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.490498066 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.490500927 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.490550041 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.490555048 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.490560055 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.490572929 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.491364956 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.491370916 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.491375923 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.920732975 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:53.965332985 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:54.387208939 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:54.614588976 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:54.965711117 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:54.965888977 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:54.966794014 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:54.972412109 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:54.972599983 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:54.972944021 CET	587	50016	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:54.974606037 CET	50016	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:55.739991903 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:55.746331930 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:55.751195908 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:55.903584003 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:55.904427052 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:55.909398079 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.067034960 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.067289114 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:56.075829983 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.229716063 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.229885101 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:56.234848976 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.387094021 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.387375116 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:56.392282009 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.565022945 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.565171957 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:56.570067883 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.722338915 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.722758055 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:56.722807884 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:56.722807884 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:56.722871065 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:56.725280046 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:56.727699995 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.727705002 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.727710009 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.727827072 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:56.727866888 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.730387926 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.730612040 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.730865955 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:56.735954046 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.736143112 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.736202002 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.736265898 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:56.736413956 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:56.741214991 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.741373062 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.741450071 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.741455078 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.741524935 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.741539001 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:20:56.741797924 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.746565104 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.746644974 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.746690989 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.746695042 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.746705055 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.746722937 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.746763945 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.746768951 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.746772051 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.746861935 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.746865988 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.746870041 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.747180939 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.747185946 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.747189999 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.747193098 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.747226000 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.747236967 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.747245073 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.747248888 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.747257948 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.747262001 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:56.747272015 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:57.179287910 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:20:57.230982065 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:41.714152098 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:41.719393969 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:42.072247028 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:42.072514057 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:42.073689938 CET	50018	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:42.077995062 CET	587	50017	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:42.078181982 CET	50017	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:42.078784943 CET	587	50018	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:42.078952074 CET	50018	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:42.793322086 CET	587	50018	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:42.793497086 CET	50018	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:42.798528910 CET	587	50018	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:42.949953079 CET	587	50018	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:42.950136900 CET	50018	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:42.955713987 CET	587	50018	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:43.107336998 CET	587	50018	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:43.107526064 CET	50018	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:43.113837957 CET	587	50018	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:43.137418985 CET	50018	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:43.144154072 CET	587	50018	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:43.144210100 CET	50018	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:43.195619106 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:43.201936960 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:43.202012062 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:43.915477037 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:43.918329000 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:43.923535109 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.072505951 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.074331045 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.079428911 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.228091002 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.228317976 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.234380007 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.384036064 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.386373997 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.392430067 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.540668964 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.540858030 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.546999931 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.711258888 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.714401960 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.719419003 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.867868900 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.868196964 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.868235111 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.868302107 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.868366957 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.869904041 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.873064041 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.873153925 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.873261929 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.873351097 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.873565912 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.874816895 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.874890089 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.874922991 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.874994040 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.875123978 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.875189066 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.879785061 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.879801989 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.879847050 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.879864931 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.879955053 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.879961967 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.880029917 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.880172968 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.880265951 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.880273104 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.880279064 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.880311012 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.880357981 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.880606890 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.880665064 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.885409117 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.885421991 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.885426998 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.885447979 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.885452986 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.885464907 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.885530949 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:44.885772943 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.885788918 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.885795116 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.885925055 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.885937929 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.885942936 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.890702963 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.890714884 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.890717030 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.890719891 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.891089916 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.891096115 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.891100883 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.891105890 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.891122103 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.891128063 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.891133070 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.891138077 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.891153097 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.891159058 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.891171932 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.891176939 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.891189098 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:44.891194105 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:45.325737953 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:45.371686935 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:56.022187948 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:56.027132988 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:56.376312971 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:56.381066084 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:56.382404089 CET	50020	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:56.386491060 CET	587	50019	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:56.386671066 CET	50019	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:56.387269974 CET	587	50020	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:56.388113022 CET	50020	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:57.112572908 CET	587	50020	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:57.112772942 CET	50020	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:57.117721081 CET	587	50020	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:57.274768114 CET	587	50020	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:57.274926901 CET	50020	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:57.279839993 CET	587	50020	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:57.436788082 CET	587	50020	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:57.436996937 CET	50020	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:57.441924095 CET	587	50020	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:57.612190008 CET	587	50020	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:57.612385988 CET	50020	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:57.617391109 CET	587	50020	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:57.773534060 CET	587	50020	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:57.773828030 CET	50020	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:57.778587103 CET	587	50020	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:57.874377012 CET	50020	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:57.879815102 CET	587	50020	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:57.879966021 CET	50020	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:57.927902937 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:57.932827950 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:57.933221102 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:58.608536959 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:58.608829021 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:58.613846064 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:58.764866114 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:58.767282009 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:58.772233009 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:58.924272060 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:58.924659014 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:58.929568052 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.082058907 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.082227945 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.087328911 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.241230011 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.241439104 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.246392012 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.408051014 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.408480883 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.413351059 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.564086914 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.564443111 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.564488888 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.564488888 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.564534903 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.565856934 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.569382906 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.569466114 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.569473982 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.569499016 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.569552898 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.570796013 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.570878029 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.570878983 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.570961952 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.571207047 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.571276903 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.575799942 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.575897932 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.576126099 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.576268911 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.576320887 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.576387882 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.580872059 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.581016064 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.581139088 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.581195116 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.581207037 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.581239939 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.581244946 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.581267118 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.581316948 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:21:59.581418991 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.581535101 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.581540108 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.581543922 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.581552982 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.581557035 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.585988045 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.585994959 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586147070 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586255074 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586363077 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586368084 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586371899 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586374998 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586472034 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586498976 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586549044 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586553097 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586558104 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586612940 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586616993 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586621046 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586652994 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586658001 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586672068 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586675882 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586714983 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586719990 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586724043 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586776972 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.586781979 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:21:59.587369919 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:22:00.012480021 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:22:00.074857950 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:22:02.901762962 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:22:02.906728983 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:22:03.261152983 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:22:03.261310101 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:22:03.262655973 CET	50022	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:22:03.267265081 CET	587	50021	74.119.238.7	192.168.2.4
Oct 31, 2024 16:22:03.267338037 CET	50021	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:22:03.267518997 CET	587	50022	74.119.238.7	192.168.2.4
Oct 31, 2024 16:22:03.267589092 CET	50022	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:22:03.954570055 CET	587	50022	74.119.238.7	192.168.2.4
Oct 31, 2024 16:22:04.028017044 CET	50022	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:22:05.115748882 CET	50022	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:22:05.115823030 CET	50022	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:22:05.120656013 CET	587	50022	74.119.238.7	192.168.2.4
Oct 31, 2024 16:22:05.121241093 CET	587	50022	74.119.238.7	192.168.2.4
Oct 31, 2024 16:22:05.121308088 CET	50022	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:22:05.172713041 CET	50023	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:22:05.181597948 CET	587	50023	74.119.238.7	192.168.2.4
Oct 31, 2024 16:22:05.181708097 CET	50023	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:22:05.862996101 CET	587	50023	74.119.238.7	192.168.2.4
Oct 31, 2024 16:22:05.863173008 CET	50023	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:22:05.868092060 CET	587	50023	74.119.238.7	192.168.2.4
Oct 31, 2024 16:22:06.016365051 CET	587	50023	74.119.238.7	192.168.2.4
Oct 31, 2024 16:22:06.016679049 CET	50023	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:22:06.021692038 CET	587	50023	74.119.238.7	192.168.2.4
Oct 31, 2024 16:22:06.174333096 CET	587	50023	74.119.238.7	192.168.2.4
Oct 31, 2024 16:22:06.174586058 CET	50023	587	192.168.2.4	74.119.238.7
Oct 31, 2024 16:22:06.180818081 CET	587	50023	74.119.238.7	192.168.2.4
Oct 31, 2024 16:22:06.359371901 CET	587	50023	74.119.238.7	192.168.2.4
Oct 31, 2024 16:22:06.403038979 CET	50023	587	192.168.2.4	74.119.238.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 16:18:02.963543892 CET	57554	53	192.168.2.4	1.1.1.1
Oct 31, 2024 16:18:03.246776104 CET	53	57554	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 16:18:02.963543892 CET	192.168.2.4	1.1.1.1	0x4d45	Standard query (0)	mail.alhoneycomb.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 16:18:03.246776104 CET	1.1.1.1	192.168.2.4	0x4d45	No error (0)	mail.alhoneycomb.com		74.119.238.7	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 31, 2024 16:18:04.470115900 CET	587	49734	74.119.238.7	192.168.2.4	220-md-la-5.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 31 Oct 2024 20:48:04 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2024 16:18:04.480895996 CET	49734	587	192.168.2.4	74.119.238.7	EHLO 965969
Oct 31, 2024 16:18:04.645661116 CET	587	49734	74.119.238.7	192.168.2.4	250-md-la-5.webhostbox.net Hello 965969 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 31, 2024 16:18:04.646835089 CET	49734	587	192.168.2.4	74.119.238.7	AUTH login YmxvZ0BhbGhvbmV5Y29tYi5jb20=
Oct 31, 2024 16:18:04.800005913 CET	587	49734	74.119.238.7	192.168.2.4	334 UGFzc3dvcmQ6
Oct 31, 2024 16:18:05.144268990 CET	587	49734	74.119.238.7	192.168.2.4	235 Authentication succeeded
Oct 31, 2024 16:18:05.184948921 CET	49734	587	192.168.2.4	74.119.238.7	MAIL FROM:<blog@alhoneycomb.com>
Oct 31, 2024 16:18:05.351702929 CET	587	49734	74.119.238.7	192.168.2.4	250 OK
Oct 31, 2024 16:18:05.366583109 CET	49734	587	192.168.2.4	74.119.238.7	RCPT TO:<blog@alhoneycomb.com>
Oct 31, 2024 16:18:05.535995960 CET	587	49734	74.119.238.7	192.168.2.4	250 Accepted
Oct 31, 2024 16:18:05.536242008 CET	49734	587	192.168.2.4	74.119.238.7	DATA
Oct 31, 2024 16:18:05.698997021 CET	587	49734	74.119.238.7	192.168.2.4	354 Enter message, ending with "." on a line by itself
Oct 31, 2024 16:18:05.700038910 CET	49734	587	192.168.2.4	74.119.238.7	.
Oct 31, 2024 16:18:05.857727051 CET	587	49734	74.119.238.7	192.168.2.4	250 OK id=1t6Ww1-001V4C-1z
Oct 31, 2024 16:18:05.908706903 CET	49734	587	192.168.2.4	74.119.238.7	QUIT
Oct 31, 2024 16:18:06.266205072 CET	587	49734	74.119.238.7	192.168.2.4	221 md-la-5.webhostbox.net closing connection
Oct 31, 2024 16:18:06.962619066 CET	587	49737	74.119.238.7	192.168.2.4	220-md-la-5.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 31 Oct 2024 20:48:06 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2024 16:18:06.962841034 CET	49737	587	192.168.2.4	74.119.238.7	EHLO 965969
Oct 31, 2024 16:18:08.159893990 CET	587	49737	74.119.238.7	192.168.2.4	250-md-la-5.webhostbox.net Hello 965969 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 31, 2024 16:18:08.160104990 CET	49737	587	192.168.2.4	74.119.238.7	AUTH login YmxvZ0BhbGhvbmV5Y29tYi5jb20=
Oct 31, 2024 16:18:08.177380085 CET	587	49737	74.119.238.7	192.168.2.4	250-md-la-5.webhostbox.net Hello 965969 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 31, 2024 16:18:08.178266048 CET	587	49737	74.119.238.7	192.168.2.4	250-md-la-5.webhostbox.net Hello 965969 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 31, 2024 16:18:08.179115057 CET	587	49737	74.119.238.7	192.168.2.4	250-md-la-5.webhostbox.net Hello 965969 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 31, 2024 16:18:08.317024946 CET	587	49737	74.119.238.7	192.168.2.4	334 UGFzc3dvcmQ6
Oct 31, 2024 16:18:08.475339890 CET	587	49737	74.119.238.7	192.168.2.4	235 Authentication succeeded
Oct 31, 2024 16:18:08.475465059 CET	49737	587	192.168.2.4	74.119.238.7	MAIL FROM:<blog@alhoneycomb.com>
Oct 31, 2024 16:18:08.639945030 CET	587	49737	74.119.238.7	192.168.2.4	250 OK
Oct 31, 2024 16:18:08.640073061 CET	49737	587	192.168.2.4	74.119.238.7	RCPT TO:<blog@alhoneycomb.com>
Oct 31, 2024 16:18:08.811012983 CET	587	49737	74.119.238.7	192.168.2.4	250 Accepted
Oct 31, 2024 16:18:08.811247110 CET	49737	587	192.168.2.4	74.119.238.7	DATA
Oct 31, 2024 16:18:08.966856956 CET	587	49737	74.119.238.7	192.168.2.4	354 Enter message, ending with "." on a line by itself
Oct 31, 2024 16:18:08.968581915 CET	49737	587	192.168.2.4	74.119.238.7	.
Oct 31, 2024 16:18:09.147162914 CET	587	49737	74.119.238.7	192.168.2.4	250 OK id=1t6Ww4-001V5J-2q
Oct 31, 2024 16:19:34.416914940 CET	49737	587	192.168.2.4	74.119.238.7	QUIT
Oct 31, 2024 16:19:34.775343895 CET	587	49737	74.119.238.7	192.168.2.4	221 md-la-5.webhostbox.net closing connection
Oct 31, 2024 16:19:35.478149891 CET	587	49928	74.119.238.7	192.168.2.4	220-md-la-5.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 31 Oct 2024 20:49:35 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2024 16:19:35.480988979 CET	49928	587	192.168.2.4	74.119.238.7	EHLO 965969
Oct 31, 2024 16:19:35.643930912 CET	587	49928	74.119.238.7	192.168.2.4	250-md-la-5.webhostbox.net Hello 965969 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 31, 2024 16:19:35.644318104 CET	49928	587	192.168.2.4	74.119.238.7	AUTH login YmxvZ0BhbGhvbmV5Y29tYi5jb20=
Oct 31, 2024 16:19:35.805958986 CET	587	49928	74.119.238.7	192.168.2.4	334 UGFzc3dvcmQ6
Oct 31, 2024 16:19:36.071170092 CET	587	49928	74.119.238.7	192.168.2.4	235 Authentication succeeded
Oct 31, 2024 16:19:36.071660042 CET	49928	587	192.168.2.4	74.119.238.7	MAIL FROM:<blog@alhoneycomb.com>
Oct 31, 2024 16:19:36.231666088 CET	587	49928	74.119.238.7	192.168.2.4	250 OK
Oct 31, 2024 16:19:36.231995106 CET	49928	587	192.168.2.4	74.119.238.7	RCPT TO:<blog@alhoneycomb.com>
Oct 31, 2024 16:19:36.404135942 CET	587	49928	74.119.238.7	192.168.2.4	250 Accepted
Oct 31, 2024 16:19:36.405733109 CET	49928	587	192.168.2.4	74.119.238.7	DATA
Oct 31, 2024 16:19:36.565882921 CET	587	49928	74.119.238.7	192.168.2.4	354 Enter message, ending with "." on a line by itself
Oct 31, 2024 16:19:37.036322117 CET	587	49928	74.119.238.7	192.168.2.4	250 OK id=1t6WxU-001Vpl-1Z
Oct 31, 2024 16:19:45.429310083 CET	49928	587	192.168.2.4	74.119.238.7	QUIT
Oct 31, 2024 16:19:45.857887983 CET	587	49928	74.119.238.7	192.168.2.4	221 md-la-5.webhostbox.net closing connection
Oct 31, 2024 16:19:46.582937956 CET	587	49971	74.119.238.7	192.168.2.4	220-md-la-5.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 31 Oct 2024 20:49:46 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2024 16:19:46.584023952 CET	49971	587	192.168.2.4	74.119.238.7	EHLO 965969
Oct 31, 2024 16:19:46.740765095 CET	587	49971	74.119.238.7	192.168.2.4	250-md-la-5.webhostbox.net Hello 965969 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 31, 2024 16:19:46.740955114 CET	49971	587	192.168.2.4	74.119.238.7	AUTH login YmxvZ0BhbGhvbmV5Y29tYi5jb20=
Oct 31, 2024 16:19:46.897644997 CET	587	49971	74.119.238.7	192.168.2.4	334 UGFzc3dvcmQ6
Oct 31, 2024 16:19:47.056622982 CET	587	49971	74.119.238.7	192.168.2.4	235 Authentication succeeded
Oct 31, 2024 16:19:47.056885958 CET	49971	587	192.168.2.4	74.119.238.7	MAIL FROM:<blog@alhoneycomb.com>
Oct 31, 2024 16:19:47.220524073 CET	587	49971	74.119.238.7	192.168.2.4	250 OK
Oct 31, 2024 16:19:47.220715046 CET	49971	587	192.168.2.4	74.119.238.7	RCPT TO:<blog@alhoneycomb.com>
Oct 31, 2024 16:19:47.386177063 CET	587	49971	74.119.238.7	192.168.2.4	250 Accepted
Oct 31, 2024 16:19:47.386328936 CET	49971	587	192.168.2.4	74.119.238.7	DATA
Oct 31, 2024 16:19:47.542891026 CET	587	49971	74.119.238.7	192.168.2.4	354 Enter message, ending with "." on a line by itself
Oct 31, 2024 16:19:48.725155115 CET	587	49978	74.119.238.7	192.168.2.4	220-md-la-5.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 31 Oct 2024 20:49:48 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2024 16:19:48.726598978 CET	49978	587	192.168.2.4	74.119.238.7	EHLO 965969
Oct 31, 2024 16:19:48.879946947 CET	587	49978	74.119.238.7	192.168.2.4	250-md-la-5.webhostbox.net Hello 965969 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 31, 2024 16:19:48.880232096 CET	49978	587	192.168.2.4	74.119.238.7	AUTH login YmxvZ0BhbGhvbmV5Y29tYi5jb20=
Oct 31, 2024 16:19:49.313122034 CET	587	49978	74.119.238.7	192.168.2.4	334 UGFzc3dvcmQ6
Oct 31, 2024 16:19:49.314250946 CET	587	49978	74.119.238.7	192.168.2.4	334 UGFzc3dvcmQ6
Oct 31, 2024 16:19:49.489509106 CET	587	49978	74.119.238.7	192.168.2.4	235 Authentication succeeded
Oct 31, 2024 16:19:49.490072012 CET	49978	587	192.168.2.4	74.119.238.7	MAIL FROM:<blog@alhoneycomb.com>
Oct 31, 2024 16:19:49.643208981 CET	587	49978	74.119.238.7	192.168.2.4	250 OK
Oct 31, 2024 16:19:49.643363953 CET	49978	587	192.168.2.4	74.119.238.7	RCPT TO:<blog@alhoneycomb.com>
Oct 31, 2024 16:19:49.806843042 CET	587	49978	74.119.238.7	192.168.2.4	250 Accepted
Oct 31, 2024 16:19:49.806992054 CET	49978	587	192.168.2.4	74.119.238.7	DATA
Oct 31, 2024 16:19:49.961858988 CET	587	49978	74.119.238.7	192.168.2.4	354 Enter message, ending with "." on a line by itself
Oct 31, 2024 16:19:50.678345919 CET	587	49985	74.119.238.7	192.168.2.4	220-md-la-5.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 31 Oct 2024 20:49:50 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2024 16:19:50.678474903 CET	49985	587	192.168.2.4	74.119.238.7	EHLO 965969
Oct 31, 2024 16:19:50.835803986 CET	587	49985	74.119.238.7	192.168.2.4	250-md-la-5.webhostbox.net Hello 965969 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 31, 2024 16:19:50.835926056 CET	49985	587	192.168.2.4	74.119.238.7	AUTH login YmxvZ0BhbGhvbmV5Y29tYi5jb20=
Oct 31, 2024 16:19:50.993899107 CET	587	49985	74.119.238.7	192.168.2.4	334 UGFzc3dvcmQ6
Oct 31, 2024 16:19:51.154047012 CET	587	49985	74.119.238.7	192.168.2.4	235 Authentication succeeded
Oct 31, 2024 16:19:51.154176950 CET	49985	587	192.168.2.4	74.119.238.7	MAIL FROM:<blog@alhoneycomb.com>
Oct 31, 2024 16:19:51.310635090 CET	587	49985	74.119.238.7	192.168.2.4	250 OK
Oct 31, 2024 16:19:51.310894966 CET	49985	587	192.168.2.4	74.119.238.7	RCPT TO:<blog@alhoneycomb.com>
Oct 31, 2024 16:19:51.483351946 CET	587	49985	74.119.238.7	192.168.2.4	250 Accepted
Oct 31, 2024 16:19:51.483494043 CET	49985	587	192.168.2.4	74.119.238.7	DATA
Oct 31, 2024 16:19:51.650290966 CET	587	49985	74.119.238.7	192.168.2.4	354 Enter message, ending with "." on a line by itself
Oct 31, 2024 16:19:51.675967932 CET	49985	587	192.168.2.4	74.119.238.7	.
Oct 31, 2024 16:19:52.103801966 CET	587	49985	74.119.238.7	192.168.2.4	250 OK id=1t6Wxj-001Vz8-1p
Oct 31, 2024 16:20:13.708986044 CET	49985	587	192.168.2.4	74.119.238.7	QUIT
Oct 31, 2024 16:20:14.067080021 CET	587	49985	74.119.238.7	192.168.2.4	221 md-la-5.webhostbox.net closing connection
Oct 31, 2024 16:20:14.773274899 CET	587	50014	74.119.238.7	192.168.2.4	220-md-la-5.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 31 Oct 2024 20:50:14 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2024 16:20:14.777765036 CET	50014	587	192.168.2.4	74.119.238.7	EHLO 965969
Oct 31, 2024 16:20:14.934442997 CET	587	50014	74.119.238.7	192.168.2.4	250-md-la-5.webhostbox.net Hello 965969 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 31, 2024 16:20:14.936115980 CET	50014	587	192.168.2.4	74.119.238.7	AUTH login YmxvZ0BhbGhvbmV5Y29tYi5jb20=
Oct 31, 2024 16:20:15.091141939 CET	587	50014	74.119.238.7	192.168.2.4	334 UGFzc3dvcmQ6
Oct 31, 2024 16:20:15.375216007 CET	587	50014	74.119.238.7	192.168.2.4	235 Authentication succeeded
Oct 31, 2024 16:20:15.378133059 CET	50014	587	192.168.2.4	74.119.238.7	MAIL FROM:<blog@alhoneycomb.com>
Oct 31, 2024 16:20:15.546149969 CET	587	50014	74.119.238.7	192.168.2.4	250 OK
Oct 31, 2024 16:20:15.550411940 CET	50014	587	192.168.2.4	74.119.238.7	RCPT TO:<blog@alhoneycomb.com>
Oct 31, 2024 16:20:15.713881969 CET	587	50014	74.119.238.7	192.168.2.4	250 Accepted
Oct 31, 2024 16:20:15.714025021 CET	50014	587	192.168.2.4	74.119.238.7	DATA
Oct 31, 2024 16:20:15.869781971 CET	587	50014	74.119.238.7	192.168.2.4	354 Enter message, ending with "." on a line by itself
Oct 31, 2024 16:20:16.324552059 CET	587	50014	74.119.238.7	192.168.2.4	250 OK id=1t6Wy7-001WEm-2X
Oct 31, 2024 16:20:30.909288883 CET	50014	587	192.168.2.4	74.119.238.7	QUIT
Oct 31, 2024 16:20:31.266510963 CET	587	50014	74.119.238.7	192.168.2.4	221 md-la-5.webhostbox.net closing connection
Oct 31, 2024 16:20:31.953761101 CET	587	50015	74.119.238.7	192.168.2.4	220-md-la-5.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 31 Oct 2024 20:50:31 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2024 16:20:31.953902006 CET	50015	587	192.168.2.4	74.119.238.7	EHLO 965969
Oct 31, 2024 16:20:32.110306978 CET	587	50015	74.119.238.7	192.168.2.4	250-md-la-5.webhostbox.net Hello 965969 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 31, 2024 16:20:32.110446930 CET	50015	587	192.168.2.4	74.119.238.7	AUTH login YmxvZ0BhbGhvbmV5Y29tYi5jb20=
Oct 31, 2024 16:20:32.423291922 CET	587	50015	74.119.238.7	192.168.2.4	334 UGFzc3dvcmQ6
Oct 31, 2024 16:20:32.580900908 CET	587	50015	74.119.238.7	192.168.2.4	235 Authentication succeeded
Oct 31, 2024 16:20:32.582299948 CET	50015	587	192.168.2.4	74.119.238.7	MAIL FROM:<blog@alhoneycomb.com>
Oct 31, 2024 16:20:32.737236977 CET	587	50015	74.119.238.7	192.168.2.4	250 OK
Oct 31, 2024 16:20:32.737931967 CET	50015	587	192.168.2.4	74.119.238.7	RCPT TO:<blog@alhoneycomb.com>
Oct 31, 2024 16:20:32.913315058 CET	587	50015	74.119.238.7	192.168.2.4	250 Accepted
Oct 31, 2024 16:20:32.913691044 CET	50015	587	192.168.2.4	74.119.238.7	DATA
Oct 31, 2024 16:20:33.078877926 CET	587	50015	74.119.238.7	192.168.2.4	354 Enter message, ending with "." on a line by itself
Oct 31, 2024 16:20:33.526276112 CET	587	50015	74.119.238.7	192.168.2.4	250 OK id=1t6WyO-001WRB-3D
Oct 31, 2024 16:20:51.302103996 CET	50015	587	192.168.2.4	74.119.238.7	QUIT
Oct 31, 2024 16:20:51.661803961 CET	587	50015	74.119.238.7	192.168.2.4	221 md-la-5.webhostbox.net closing connection
Oct 31, 2024 16:20:52.340404034 CET	587	50016	74.119.238.7	192.168.2.4	220-md-la-5.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 31 Oct 2024 20:50:52 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2024 16:20:52.348177910 CET	50016	587	192.168.2.4	74.119.238.7	EHLO 965969
Oct 31, 2024 16:20:52.506561041 CET	587	50016	74.119.238.7	192.168.2.4	250-md-la-5.webhostbox.net Hello 965969 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 31, 2024 16:20:52.509721041 CET	50016	587	192.168.2.4	74.119.238.7	AUTH login YmxvZ0BhbGhvbmV5Y29tYi5jb20=
Oct 31, 2024 16:20:52.671910048 CET	587	50016	74.119.238.7	192.168.2.4	334 UGFzc3dvcmQ6
Oct 31, 2024 16:20:52.972326040 CET	587	50016	74.119.238.7	192.168.2.4	235 Authentication succeeded
Oct 31, 2024 16:20:52.976176023 CET	50016	587	192.168.2.4	74.119.238.7	MAIL FROM:<blog@alhoneycomb.com>
Oct 31, 2024 16:20:53.134902000 CET	587	50016	74.119.238.7	192.168.2.4	250 OK
Oct 31, 2024 16:20:53.135101080 CET	50016	587	192.168.2.4	74.119.238.7	RCPT TO:<blog@alhoneycomb.com>
Oct 31, 2024 16:20:53.305529118 CET	587	50016	74.119.238.7	192.168.2.4	250 Accepted
Oct 31, 2024 16:20:53.307244062 CET	50016	587	192.168.2.4	74.119.238.7	DATA
Oct 31, 2024 16:20:53.464618921 CET	587	50016	74.119.238.7	192.168.2.4	354 Enter message, ending with "." on a line by itself
Oct 31, 2024 16:20:53.920732975 CET	587	50016	74.119.238.7	192.168.2.4	250 OK id=1t6Wyj-001Wc3-1E
Oct 31, 2024 16:20:54.387208939 CET	50016	587	192.168.2.4	74.119.238.7	QUIT
Oct 31, 2024 16:20:54.965711117 CET	587	50016	74.119.238.7	192.168.2.4	221 md-la-5.webhostbox.net closing connection
Oct 31, 2024 16:20:55.739991903 CET	587	50017	74.119.238.7	192.168.2.4	220-md-la-5.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 31 Oct 2024 20:50:55 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2024 16:20:55.746331930 CET	50017	587	192.168.2.4	74.119.238.7	EHLO 965969
Oct 31, 2024 16:20:55.903584003 CET	587	50017	74.119.238.7	192.168.2.4	250-md-la-5.webhostbox.net Hello 965969 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 31, 2024 16:20:55.904427052 CET	50017	587	192.168.2.4	74.119.238.7	AUTH login YmxvZ0BhbGhvbmV5Y29tYi5jb20=
Oct 31, 2024 16:20:56.067034960 CET	587	50017	74.119.238.7	192.168.2.4	334 UGFzc3dvcmQ6
Oct 31, 2024 16:20:56.229716063 CET	587	50017	74.119.238.7	192.168.2.4	235 Authentication succeeded
Oct 31, 2024 16:20:56.229885101 CET	50017	587	192.168.2.4	74.119.238.7	MAIL FROM:<blog@alhoneycomb.com>
Oct 31, 2024 16:20:56.387094021 CET	587	50017	74.119.238.7	192.168.2.4	250 OK
Oct 31, 2024 16:20:56.387375116 CET	50017	587	192.168.2.4	74.119.238.7	RCPT TO:<blog@alhoneycomb.com>
Oct 31, 2024 16:20:56.565022945 CET	587	50017	74.119.238.7	192.168.2.4	250 Accepted
Oct 31, 2024 16:20:56.565171957 CET	50017	587	192.168.2.4	74.119.238.7	DATA
Oct 31, 2024 16:20:56.722338915 CET	587	50017	74.119.238.7	192.168.2.4	354 Enter message, ending with "." on a line by itself
Oct 31, 2024 16:20:57.179287910 CET	587	50017	74.119.238.7	192.168.2.4	250 OK id=1t6Wym-001Wdp-24
Oct 31, 2024 16:21:41.714152098 CET	50017	587	192.168.2.4	74.119.238.7	QUIT
Oct 31, 2024 16:21:42.072247028 CET	587	50017	74.119.238.7	192.168.2.4	221 md-la-5.webhostbox.net closing connection
Oct 31, 2024 16:21:42.793322086 CET	587	50018	74.119.238.7	192.168.2.4	220-md-la-5.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 31 Oct 2024 20:51:42 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2024 16:21:42.793497086 CET	50018	587	192.168.2.4	74.119.238.7	EHLO 965969
Oct 31, 2024 16:21:42.949953079 CET	587	50018	74.119.238.7	192.168.2.4	250-md-la-5.webhostbox.net Hello 965969 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 31, 2024 16:21:42.950136900 CET	50018	587	192.168.2.4	74.119.238.7	AUTH login YmxvZ0BhbGhvbmV5Y29tYi5jb20=
Oct 31, 2024 16:21:43.107336998 CET	587	50018	74.119.238.7	192.168.2.4	334 UGFzc3dvcmQ6
Oct 31, 2024 16:21:43.915477037 CET	587	50019	74.119.238.7	192.168.2.4	220-md-la-5.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 31 Oct 2024 20:51:43 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2024 16:21:43.918329000 CET	50019	587	192.168.2.4	74.119.238.7	EHLO 965969
Oct 31, 2024 16:21:44.072505951 CET	587	50019	74.119.238.7	192.168.2.4	250-md-la-5.webhostbox.net Hello 965969 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 31, 2024 16:21:44.074331045 CET	50019	587	192.168.2.4	74.119.238.7	AUTH login YmxvZ0BhbGhvbmV5Y29tYi5jb20=
Oct 31, 2024 16:21:44.228091002 CET	587	50019	74.119.238.7	192.168.2.4	334 UGFzc3dvcmQ6
Oct 31, 2024 16:21:44.384036064 CET	587	50019	74.119.238.7	192.168.2.4	235 Authentication succeeded
Oct 31, 2024 16:21:44.386373997 CET	50019	587	192.168.2.4	74.119.238.7	MAIL FROM:<blog@alhoneycomb.com>
Oct 31, 2024 16:21:44.540668964 CET	587	50019	74.119.238.7	192.168.2.4	250 OK
Oct 31, 2024 16:21:44.540858030 CET	50019	587	192.168.2.4	74.119.238.7	RCPT TO:<blog@alhoneycomb.com>
Oct 31, 2024 16:21:44.711258888 CET	587	50019	74.119.238.7	192.168.2.4	250 Accepted
Oct 31, 2024 16:21:44.714401960 CET	50019	587	192.168.2.4	74.119.238.7	DATA
Oct 31, 2024 16:21:44.867868900 CET	587	50019	74.119.238.7	192.168.2.4	354 Enter message, ending with "." on a line by itself
Oct 31, 2024 16:21:45.325737953 CET	587	50019	74.119.238.7	192.168.2.4	250 OK id=1t6WzY-001X4c-2X
Oct 31, 2024 16:21:56.022187948 CET	50019	587	192.168.2.4	74.119.238.7	QUIT
Oct 31, 2024 16:21:56.376312971 CET	587	50019	74.119.238.7	192.168.2.4	221 md-la-5.webhostbox.net closing connection
Oct 31, 2024 16:21:57.112572908 CET	587	50020	74.119.238.7	192.168.2.4	220-md-la-5.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 31 Oct 2024 20:51:57 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2024 16:21:57.112772942 CET	50020	587	192.168.2.4	74.119.238.7	EHLO 965969
Oct 31, 2024 16:21:57.274768114 CET	587	50020	74.119.238.7	192.168.2.4	250-md-la-5.webhostbox.net Hello 965969 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 31, 2024 16:21:57.274926901 CET	50020	587	192.168.2.4	74.119.238.7	AUTH login YmxvZ0BhbGhvbmV5Y29tYi5jb20=
Oct 31, 2024 16:21:57.436788082 CET	587	50020	74.119.238.7	192.168.2.4	334 UGFzc3dvcmQ6
Oct 31, 2024 16:21:57.612190008 CET	587	50020	74.119.238.7	192.168.2.4	235 Authentication succeeded
Oct 31, 2024 16:21:57.612385988 CET	50020	587	192.168.2.4	74.119.238.7	MAIL FROM:<blog@alhoneycomb.com>
Oct 31, 2024 16:21:57.773534060 CET	587	50020	74.119.238.7	192.168.2.4	250 OK
Oct 31, 2024 16:21:57.773828030 CET	50020	587	192.168.2.4	74.119.238.7	RCPT TO:<blog@alhoneycomb.com>
Oct 31, 2024 16:21:58.608536959 CET	587	50021	74.119.238.7	192.168.2.4	220-md-la-5.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 31 Oct 2024 20:51:58 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2024 16:21:58.608829021 CET	50021	587	192.168.2.4	74.119.238.7	EHLO 965969
Oct 31, 2024 16:21:58.764866114 CET	587	50021	74.119.238.7	192.168.2.4	250-md-la-5.webhostbox.net Hello 965969 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 31, 2024 16:21:58.767282009 CET	50021	587	192.168.2.4	74.119.238.7	AUTH login YmxvZ0BhbGhvbmV5Y29tYi5jb20=
Oct 31, 2024 16:21:58.924272060 CET	587	50021	74.119.238.7	192.168.2.4	334 UGFzc3dvcmQ6
Oct 31, 2024 16:21:59.082058907 CET	587	50021	74.119.238.7	192.168.2.4	235 Authentication succeeded
Oct 31, 2024 16:21:59.082227945 CET	50021	587	192.168.2.4	74.119.238.7	MAIL FROM:<blog@alhoneycomb.com>
Oct 31, 2024 16:21:59.241230011 CET	587	50021	74.119.238.7	192.168.2.4	250 OK
Oct 31, 2024 16:21:59.241439104 CET	50021	587	192.168.2.4	74.119.238.7	RCPT TO:<blog@alhoneycomb.com>
Oct 31, 2024 16:21:59.408051014 CET	587	50021	74.119.238.7	192.168.2.4	250 Accepted
Oct 31, 2024 16:21:59.408480883 CET	50021	587	192.168.2.4	74.119.238.7	DATA
Oct 31, 2024 16:21:59.564086914 CET	587	50021	74.119.238.7	192.168.2.4	354 Enter message, ending with "." on a line by itself
Oct 31, 2024 16:22:00.012480021 CET	587	50021	74.119.238.7	192.168.2.4	250 OK id=1t6Wzn-001XDB-1Y
Oct 31, 2024 16:22:02.901762962 CET	50021	587	192.168.2.4	74.119.238.7	QUIT
Oct 31, 2024 16:22:03.261152983 CET	587	50021	74.119.238.7	192.168.2.4	221 md-la-5.webhostbox.net closing connection
Oct 31, 2024 16:22:03.954570055 CET	587	50022	74.119.238.7	192.168.2.4	220-md-la-5.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 31 Oct 2024 20:52:03 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2024 16:22:05.115748882 CET	50022	587	192.168.2.4	74.119.238.7	EHLO 965969
Oct 31, 2024 16:22:05.862996101 CET	587	50023	74.119.238.7	192.168.2.4	220-md-la-5.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 31 Oct 2024 20:52:05 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2024 16:22:05.863173008 CET	50023	587	192.168.2.4	74.119.238.7	EHLO 965969
Oct 31, 2024 16:22:06.016365051 CET	587	50023	74.119.238.7	192.168.2.4	250-md-la-5.webhostbox.net Hello 965969 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 31, 2024 16:22:06.016679049 CET	50023	587	192.168.2.4	74.119.238.7	AUTH login YmxvZ0BhbGhvbmV5Y29tYi5jb20=
Oct 31, 2024 16:22:06.174333096 CET	587	50023	74.119.238.7	192.168.2.4	334 UGFzc3dvcmQ6
Oct 31, 2024 16:22:06.359371901 CET	587	50023	74.119.238.7	192.168.2.4	235 Authentication succeeded

Target ID:	0
Start time:	11:17:56
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\NoERE2024000013833.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\NoERE2024000013833.exe"
Imagebase:	0x2620ada0000
File size:	3'596'943 bytes
MD5 hash:	FCD3727D56F9E69BE13C397A22B8843E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1884610057.000002620CD82000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1885047529.000002621D259000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1885047529.000002621D259000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:17:56
Start date:	31/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:17:57
Start date:	31/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Imagebase:	0x910000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4120836178.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4120836178.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4123322438.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4123322438.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	11:17:57
Start date:	31/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Imagebase:	0xb80000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:17:57
Start date:	31/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2004 -s 1036
Imagebase:	0x7ff7468c0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9B940050 Relevance: 3.4, Strings: 1, Instructions: 2161COMMON

Download Yara Rule

Strings

A`$%, xrefs: 00007FFD9B941459

Memory Dump Source

Source File: 00000000.00000002.1892724843.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b940000_NoERE2024000013833.jbxd

Similarity

API ID:
String ID: A`$%
API String ID: 0-4040629893
Opcode ID: f107b1dd8a7d9e122f1eac0a30e40bbbb782bb260c6b134c68b89246a1de5b66
Instruction ID: 678bd8af1b54be3e4cfa9f52000346fcfdf7578771e7e86096358f2ea3ec480e
Opcode Fuzzy Hash: f107b1dd8a7d9e122f1eac0a30e40bbbb782bb260c6b134c68b89246a1de5b66
Instruction Fuzzy Hash: A0E25B31A1E7DA4FE766DB6888655B47FE1EF56700F0A06FAD088CB1E3DA146906C381

Function 00007FFD9B87F4E5 Relevance: 1.9, Instructions: 1909COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1892442479.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_NoERE2024000013833.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25f586d1b1a97d3002bfebb2dbfaed1b0f797b301f9939426ab27a5267c2774c
Instruction ID: 27f6c60571b338bd7c7185ea985dd6ebda3c32d675dd0bba5685dbe6e5534936
Opcode Fuzzy Hash: 25f586d1b1a97d3002bfebb2dbfaed1b0f797b301f9939426ab27a5267c2774c
Instruction Fuzzy Hash: 7BD29B3161DB894FE329DB28C4A04B5B7E2FFD9305B0445BED48AC72A6DE34E946C781

Function 00007FFD9B87CB61 Relevance: 1.4, Instructions: 1444
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1892442479.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_NoERE2024000013833.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2371b388f9a0adc2afebb43f3ed80d2618af7c8315060b56c7698c919c9f6947
Instruction ID: b8afb38890c455d12d66441c9c78ede15ab91f3ce6a645e12be359ed0481bbe1
Opcode Fuzzy Hash: 2371b388f9a0adc2afebb43f3ed80d2618af7c8315060b56c7698c919c9f6947
Instruction Fuzzy Hash: 3FA2493061DB4E8FE719DB28C4A44A5B7E1FF89305B1445BED48AC72B6DE34E946CB40

Function 00007FFD9B88107C Relevance: 1.1, Instructions: 1114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1892442479.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_NoERE2024000013833.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f53e3a3566fbd2ac04576064ff4245bd37e5121fa5f1da714ae21dcc86f989
Instruction ID: 57b143f0b7c79d21314af1a0c20b0973488dca08c3ba26849bb0e1a53b167903
Opcode Fuzzy Hash: 62f53e3a3566fbd2ac04576064ff4245bd37e5121fa5f1da714ae21dcc86f989
Instruction Fuzzy Hash: 1B72793161DB4E4FE369EB28C4A15B177E1FF99300B0145BED09AC72A6DE38E946C781

Function 00007FFD9B879530 Relevance: .9, Instructions: 928
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1892442479.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_NoERE2024000013833.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a6b76015905f19a4047a66d44134f39b6ea6259dba66bf7a6a7ffbf8efa616
Instruction ID: c57e237d447d9dac54057e43e74284f6f7e69acd27642e188c4367c2872e1dd3
Opcode Fuzzy Hash: b1a6b76015905f19a4047a66d44134f39b6ea6259dba66bf7a6a7ffbf8efa616
Instruction Fuzzy Hash: 82521730B09A0D8FDB68DB68D4A5A7977E1FF58305B1501BEE04EC36A2DE24ED429781

Function 00007FFD9B87BF14 Relevance: .8, Instructions: 765
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1892442479.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_NoERE2024000013833.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 405207621d0f1b148ad7e15afa0adca16664c8c5a92a657a6b52b2f3865f2ce2
Instruction ID: b00e027324801b00800e3252840f8572ec1805f82dcabfd2f206ada39c44348e
Opcode Fuzzy Hash: 405207621d0f1b148ad7e15afa0adca16664c8c5a92a657a6b52b2f3865f2ce2
Instruction Fuzzy Hash: 8232BB3170EB8A4FE729CB6884A517577D1FFC9308B1545BED08AC72B2DD29E942CB81

Function 00007FFD9B8708B5 Relevance: .7, Instructions: 652
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1892442479.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_NoERE2024000013833.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06be578abf0020567c74e95292d1e54cbe242639e7282e1e226786b261112bf3
Instruction ID: 89377dc283f96063e5efe3348a71032ceca4e505f12c8c4b0f25ec5a1ed399d5
Opcode Fuzzy Hash: 06be578abf0020567c74e95292d1e54cbe242639e7282e1e226786b261112bf3
Instruction Fuzzy Hash: 9C12A331B18A4D8FEB98EB98C8A5AB973D1FF98704F11017AD01DC72D6DE24AC42C740

Function 00007FFD9B87C6D9 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1892442479.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_NoERE2024000013833.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a08d9dc8b9ed4342a83adbdfdf1ed50ff421083dfd78d7702ded82dfd88a6826
Instruction ID: 8d846fa91ece3c46f582788383369274e9639b63821275305c4e7159b5bf8c8e
Opcode Fuzzy Hash: a08d9dc8b9ed4342a83adbdfdf1ed50ff421083dfd78d7702ded82dfd88a6826
Instruction Fuzzy Hash: CDF17B3160DB4A4FE369CB6884A9175B7D2FF98305F15467ED0C6C72B1DE28A942CB80

Function 00007FFD9B8750F1 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1892442479.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_NoERE2024000013833.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a585e706b4015dd90f7f7d270b82bce7f047ad461ef0b66668000e64f73d9a
Instruction ID: bcfed687caacbeba418d5cf8b82d807620397ee056a54ed5db4701e596ee9d5b
Opcode Fuzzy Hash: 47a585e706b4015dd90f7f7d270b82bce7f047ad461ef0b66668000e64f73d9a
Instruction Fuzzy Hash: 48812A31B1DA4E4FD76CEF6894A54B973E1FF99304B00057EE44BC3192ED24F9428681

Function 00007FFD9B88576F Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1892442479.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_NoERE2024000013833.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e926ff246ed762e6aef1de48db8d24e2969f145f4fafba066858a02a15c861
Instruction ID: 6f769d09ba27eb75bab8fceac8b3dde76d550dff5b9332ffef7ab029dec80759
Opcode Fuzzy Hash: 05e926ff246ed762e6aef1de48db8d24e2969f145f4fafba066858a02a15c861
Instruction Fuzzy Hash: 28415A31A0E78D4FD31E9B3888610F57BA1DB47220B1582BFD486C71B7DD2868478392

Function 00007FFD9B8857BC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1892442479.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_NoERE2024000013833.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d54d732b3ccabd63331b870cbab5d1cf0ef7293d2648d3e9fba2e78624bb34c6
Instruction ID: ba1712b3026dd14631ff3647dc3028c1173e02d948bed2756698afc9e260b747
Opcode Fuzzy Hash: d54d732b3ccabd63331b870cbab5d1cf0ef7293d2648d3e9fba2e78624bb34c6
Instruction Fuzzy Hash: 05415831A0E78D0FC71F9B7488614A67FA5DB87310B1682BFD496CB1E7DC28580683D2

Function 00007FFD9B87381A Relevance: 1.6, APIs: 1, Instructions: 141
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B8738FA

Memory Dump Source

Source File: 00000000.00000002.1892442479.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_NoERE2024000013833.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 354a0276f33f73b5524aac9f6449ef914a29663517e655a33c1186b5c804d087
Instruction ID: e85c9b9c7711e3f300ac95bd4929d283d47680ae72596b12dd48de4d7c76c9a4
Opcode Fuzzy Hash: 354a0276f33f73b5524aac9f6449ef914a29663517e655a33c1186b5c804d087
Instruction Fuzzy Hash: DF41083190C7884FDB1D9BA898566E97FE0EF56321F0443AFD099D3293DB786806C792

Function 00007FFD9B870E65 Relevance: 1.6, APIs: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FFD9B870F0F

Memory Dump Source

Source File: 00000000.00000002.1892442479.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_NoERE2024000013833.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 290d39a4e2b422f06df59d6ed4318d461624535da38227acf89a784d7d2f544f
Instruction ID: c0da18a7963369065eb4273d0c6ab0b16498e99c8c8c8d5d1b607d66a97f5b9f
Opcode Fuzzy Hash: 290d39a4e2b422f06df59d6ed4318d461624535da38227acf89a784d7d2f544f
Instruction Fuzzy Hash: F341073150D78C8FDB16DB68D845AE97FF0EF56320F0441AFD089C71A3D6656549CB42

Function 00007FFD9B9410C9 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1892724843.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b940000_NoERE2024000013833.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6450ecd11dee795d36541b5ea6e6c83e1365cbbe1d0ebdae83c6042d8d038274
Instruction ID: 023d52732767cbecd5c661938e1d7ed9502303e3a5eceeeef4b3bc177c4dc1bc
Opcode Fuzzy Hash: 6450ecd11dee795d36541b5ea6e6c83e1365cbbe1d0ebdae83c6042d8d038274
Instruction Fuzzy Hash: 04416831A0EAAD4FDB66DF54C8A04E87FB1FF56304B0642EBD449CB1A3DA24A941C340

Non-executed Functions

Function 00007FFD9B8711F2 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1892442479.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_NoERE2024000013833.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f564ab55fd22f2a152967b851cd23da9bbc9611464877ae6251fd69e3f163b
Instruction ID: fd0ae6af8376d301c17708d59543eebaedec8be07bde31ac967b3e8f817679bf
Opcode Fuzzy Hash: 33f564ab55fd22f2a152967b851cd23da9bbc9611464877ae6251fd69e3f163b
Instruction Fuzzy Hash: 7D31E767B0C4329DA70EBBBDBD598E97704DF8533930545BBD1D9CF093A944208B86E4

Analysis Process: InstallUtil.exePID: 404, Parent PID: 2004COMMON

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	456
Total number of Limit Nodes:	45

Executed Functions

Function 06286E50 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0628755B
$^q, xrefs: 06287532
$^q, xrefs: 06287573
$^q, xrefs: 06287526
$^q, xrefs: 0628754F
$^q, xrefs: 0628757F

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 85dd5b36506c049bb6c7b9f795baf01dcd60fd4a1b153a55bba005a1a53d07b1
Instruction ID: 97391c684188c0b44469614b116dee7f9f2f8b729f1d16ae136e3f87facd5af2
Opcode Fuzzy Hash: 85dd5b36506c049bb6c7b9f795baf01dcd60fd4a1b153a55bba005a1a53d07b1
Instruction Fuzzy Hash: 70322F31E1071A8FCB14EF79C95459DB7B2FFC9300F2486A9D409AB264EF70A985CB81

Function 0628BF38 Relevance: 3.0, Strings: 2, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0628C29B
$^q, xrefs: 0628C2A7

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 1fa3dfd7fc82c295b2f1d71dfa554c6f91cb72c1a557f505957f464e6372985a
Instruction ID: 1a452e0b8842b77f0657f89665c6be19fcef5785fcf3c1bcef231df7b29cd736
Opcode Fuzzy Hash: 1fa3dfd7fc82c295b2f1d71dfa554c6f91cb72c1a557f505957f464e6372985a
Instruction Fuzzy Hash: FC02C130B112069FDB54EB74D9946AEB7F2EF84310F148569D806EB394DB34EC86CB91

Function 062807F8 Relevance: 2.8, Instructions: 2825COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9a4fd2142cee471a11f6e0b3540713a05e892a68137f8baa6f39a4eefd501b
Instruction ID: cc0af719ba7d80a6c0f318905053b6ef3003a5431785d1fece8ae2be503cac76
Opcode Fuzzy Hash: 6b9a4fd2142cee471a11f6e0b3540713a05e892a68137f8baa6f39a4eefd501b
Instruction Fuzzy Hash: 0853F831C10B1A8EDB51EF68C880599F7B1FF99300F15D79AE4587B221EB70AAD5CB81

Function 06283B38 Relevance: 2.2, Instructions: 2221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e2fa05df0ef549aa3b9eef8584a2d1a7a399a77033f70027c491400fb1bd50
Instruction ID: 17e1edfac8d16067581e9bfb8a7507a018977a843dbb4de9c16e4231e23da6b1
Opcode Fuzzy Hash: 70e2fa05df0ef549aa3b9eef8584a2d1a7a399a77033f70027c491400fb1bd50
Instruction Fuzzy Hash: 1C231D31D2071A8ECB51EF68C8905ADF7B1FF99300F15C69AE458B7251EB70AAC5CB81

Function 06749B89 Relevance: 1.8, APIs: 1, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4132766926.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6740000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c64c021c175431a6db70237f3836a5ec1ec80f38841177871847285ea7e4ce0
Instruction ID: 392c03c514184eabc07b7af2b0e9c9efc7346bc2bc39ee81f7846ef3a99809f3
Opcode Fuzzy Hash: 3c64c021c175431a6db70237f3836a5ec1ec80f38841177871847285ea7e4ce0
Instruction Fuzzy Hash: A2D14D30E00209CFDB54EFA5C988BAEBBF2BF84304F158555E515AB2A5DB70E945CF81

Function 0628A7A8 Relevance: .8, Instructions: 812COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b58bf5378855f526845a737c41fbf6732bdc86344c53c83dda69bacf4b1bc7
Instruction ID: fd26ce3c802b007516722e67ca81b048805af817d7a349c134ad7ce0611f16e6
Opcode Fuzzy Hash: 77b58bf5378855f526845a737c41fbf6732bdc86344c53c83dda69bacf4b1bc7
Instruction Fuzzy Hash: A262A134B112059FDB54EB68D9847ADB7F2EF84310F14846AE80AEB394DB75EC42CB90

Function 0628F3EF Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca10cf0ad40e845fcb3bd1e97dfe82db88a0eecaa52ce1e8277c502975c9856
Instruction ID: 7f0e5bfea7f1d4fc4652391f27766053aacd4c4a7ebf9d6e43db16d9b0f475fc
Opcode Fuzzy Hash: aca10cf0ad40e845fcb3bd1e97dfe82db88a0eecaa52ce1e8277c502975c9856
Instruction Fuzzy Hash: A122A730E2110A9FEF64EB68CA907ADB7B2EB88350F248525D819EB3D5D735DC81CB51

Function 0628EE98 Relevance: 10.4, Strings: 8, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0628F070
$^q, xrefs: 0628F018
$^q, xrefs: 0628EFC5
$^q, xrefs: 0628F047
$^q, xrefs: 0628F00C
$^q, xrefs: 0628EFB9
$^q, xrefs: 0628F064
$^q, xrefs: 0628F03B

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 96ba04106be6d31fe664fa98978563fef0b91245d28a60e70649f0ec3e37af42
Instruction ID: c6bd61636c66fcb8f94a558c5bdb3e4f90cce4042ee849f96ec42f8cafd7c05a
Opcode Fuzzy Hash: 96ba04106be6d31fe664fa98978563fef0b91245d28a60e70649f0ec3e37af42
Instruction Fuzzy Hash: 44E17131E2120A8FDB55EF64D9806AEB7B2FF84344F108529D809EB398DB75DC46CB91

Function 0628F808 Relevance: 8.0, Strings: 6, Instructions: 472COMMON

Download Yara Rule

Strings

$^q, xrefs: 0628FD83
$^q, xrefs: 0628FDAB
$^q, xrefs: 0628FD4F
$^q, xrefs: 0628FD77
$^q, xrefs: 0628FD43
$^q, xrefs: 0628FDB7

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 7d7e3d006ba90cca0e90e6e218a3da4c98567adb5297eb3ee7d6070ad8f010f1
Instruction ID: 1bf1785e43f9a04629f38d51318b8b59ba611dd607f4f3d90b1cb41440369fa1
Opcode Fuzzy Hash: 7d7e3d006ba90cca0e90e6e218a3da4c98567adb5297eb3ee7d6070ad8f010f1
Instruction Fuzzy Hash: 1F02B330E2110A9FDB64EF68DA806ADB7B2FF49350F248565D809DB395DB30DC85CB81

Function 02AF9CC8 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02AFAE86
GetCurrentThread.KERNEL32 ref: 02AFAEC3
GetCurrentProcess.KERNEL32 ref: 02AFAF00
GetCurrentThreadId.KERNEL32 ref: 02AFAF59

Memory Dump Source

Source File: 00000002.00000002.4122932639.0000000002AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2af0000_InstallUtil.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c47263bb02ffc62282cc1dcc11825e9d07984ef4c5c91b66f64b03a2c709fef0
Instruction ID: ed074de79a2573a5f1f0818613a4c9a118a8fc2610b8c27240cf4b7afe3b4bdb
Opcode Fuzzy Hash: c47263bb02ffc62282cc1dcc11825e9d07984ef4c5c91b66f64b03a2c709fef0
Instruction Fuzzy Hash: DD5167B0900209DFDB44DFA9C648BDEBBF1EF88314F208459E159A7261DB38A884CF65

Function 02AFAE06 Relevance: 6.1, APIs: 4, Instructions: 127
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02AFAE86
GetCurrentThread.KERNEL32 ref: 02AFAEC3
GetCurrentProcess.KERNEL32 ref: 02AFAF00
GetCurrentThreadId.KERNEL32 ref: 02AFAF59

Memory Dump Source

Source File: 00000002.00000002.4122932639.0000000002AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2af0000_InstallUtil.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: bb292561390bca82ea4eae4d8e5725edf9c0a9e59723cbb1237e3cf1d76c53cd
Instruction ID: be09e349d2b9f517db9e71baf570fe1ef21c104acbf736deb486a7adbb2917fd
Opcode Fuzzy Hash: bb292561390bca82ea4eae4d8e5725edf9c0a9e59723cbb1237e3cf1d76c53cd
Instruction Fuzzy Hash: 1E5155B0900209DFDB44DFA9D648BDEBBF1EF88314F208459E159A7261DB38A984CF65

Function 02AF9D94 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 02AF9F2F

Strings

Hbq, xrefs: 02AFA190
Hbq, xrefs: 02AFA14B

Memory Dump Source

Source File: 00000002.00000002.4122932639.0000000002AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2af0000_InstallUtil.jbxd

Similarity

API ID: ActiveWindow
String ID: Hbq$Hbq
API String ID: 2558294473-4258043069
Opcode ID: 4548750b0c33f919693dacf8b5f23405dca6142563a9360499fc5411af8845ae
Instruction ID: 4839c6945495ce090e98688aca1555f7cdca0893517bcaf271c87d4ed3984b77
Opcode Fuzzy Hash: 4548750b0c33f919693dacf8b5f23405dca6142563a9360499fc5411af8845ae
Instruction Fuzzy Hash: 3CC19E70F002459FDB54AFB8D5547AE7AEBAFC8300F248468E50AEB394DF389846CB55

Function 0628D310 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0628D38C
$^q, xrefs: 0628D380
$^q, xrefs: 0628D3C7
$^q, xrefs: 0628D3BB

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: a32b5cbdf1bdf483db9693d9d2b45f6134162ccc07718caea54a36001ef845af
Instruction ID: 64ec8bfc7c37932ad00357eca798039ada212443c49f080e2e34e4bdb5a0d484
Opcode Fuzzy Hash: a32b5cbdf1bdf483db9693d9d2b45f6134162ccc07718caea54a36001ef845af
Instruction Fuzzy Hash: D0913030F1121A9FDB54EB65D950BAEB3F6AFC5204F108869C809EB394EB70DC46CB95

Function 01153168 Relevance: 4.1, Strings: 3, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 0115349F
(bq, xrefs: 011532E2
(bq, xrefs: 0115330D

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq
API String ID: 0-2716923250
Opcode ID: 523c2509171f77f41452907e24e0498cbc717c23c96cd61c1fbf2d55d63aaaa1
Instruction ID: 9bfd8c8d2e3a459f7fb36605223495f7dfaa0b70a5105aacada14e6c3945f7b6
Opcode Fuzzy Hash: 523c2509171f77f41452907e24e0498cbc717c23c96cd61c1fbf2d55d63aaaa1
Instruction Fuzzy Hash: 1FD1AE70E00209DFCB19DFA9C85469EBFF2FF88350F148569E825AB391DB35A941CB91

Function 06288958 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 06288983
XPcq, xrefs: 06288AA9
\Ocq, xrefs: 06288B33

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: 0bde7387ef37f056b2afda7838f88df671cc88303588545cb791a26dc25aea34
Instruction ID: e1d5fe1159e20044beb748c5b11a6a2e006c53385ab981f4ce08b1cc29d0852c
Opcode Fuzzy Hash: 0bde7387ef37f056b2afda7838f88df671cc88303588545cb791a26dc25aea34
Instruction Fuzzy Hash: 01615D70E102099FEB55AFA9C8547AEBAF6FFC8700F208429E505EB394DB758D41CB91

Function 0628894A Relevance: 2.7, Strings: 2, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 06288983
XPcq, xrefs: 06288AA9

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID: fcq$XPcq
API String ID: 0-936005338
Opcode ID: 050566b2c6ad82b50a4b19f0012f761c2e299998b148696a9a8dbfe03a36af04
Instruction ID: f52cb07517d9fa64985faaa848501238c3ab1169b70dedb1fc6791b4bfcf8a74
Opcode Fuzzy Hash: 050566b2c6ad82b50a4b19f0012f761c2e299998b148696a9a8dbfe03a36af04
Instruction Fuzzy Hash: 8B518371F102099FDB559FA9C9547AEBAE7FFC8700F208429E509EB394DA749C01CB91

Function 0628D301 Relevance: 2.7, Strings: 2, Instructions: 167COMMON

Download Yara Rule

Strings

$^q, xrefs: 0628D380
$^q, xrefs: 0628D3BB

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 0b456706b2f22409fd99540fb1bb975ade3c90f8913e35d3b9d2895e65d3a9b1
Instruction ID: c62b63cc096abf934be20232e2438407aa6645e9b48d69af67123393503b8b2b
Opcode Fuzzy Hash: 0b456706b2f22409fd99540fb1bb975ade3c90f8913e35d3b9d2895e65d3a9b1
Instruction Fuzzy Hash: 12513070B11106AFDB54EB78D950BAE73F6AFC8604F108869C809DB398EB70DC46CB95

Function 062C4B88 Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131527291.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_62c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018ac75d167b812f966f2fd814e371e11cd8ebdc30ca1344fee86536c59db82b
Instruction ID: 26443656d492124c7702fd63db42e91c7a2ba89ba4a032d1bff660d91b971948
Opcode Fuzzy Hash: 018ac75d167b812f966f2fd814e371e11cd8ebdc30ca1344fee86536c59db82b
Instruction Fuzzy Hash: 0E414331D043968FCB10DFB9D85469ABFF0EF8A310F1586AAD848E7251DB749984CBE1

Function 062CB244 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 062CB362

Memory Dump Source

Source File: 00000002.00000002.4131527291.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_62c0000_InstallUtil.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9e8edcf0646b230ee358a8f282bcd7a33ac65c71544ee7bd0f6413ffd520c562
Instruction ID: 3fd7b4ebee24e058663c4945e30776e3c3abac2f234a6aaec2502dd1ad2bd0ed
Opcode Fuzzy Hash: 9e8edcf0646b230ee358a8f282bcd7a33ac65c71544ee7bd0f6413ffd520c562
Instruction Fuzzy Hash: 7E51CEB1D10309DFDB14CFA9C885ADEBBB5FF48310F24862AE819AB210D7759885CF91

Function 062CB250 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 062CB362

Memory Dump Source

Source File: 00000002.00000002.4131527291.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_62c0000_InstallUtil.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 254af1520f4db99355c49858468b93369df882c5745e54a4370e642654c16382
Instruction ID: 6483dd1ef057dbf30f709a232d186214bc93fbf47dc38d01a19f7bf620b2b973
Opcode Fuzzy Hash: 254af1520f4db99355c49858468b93369df882c5745e54a4370e642654c16382
Instruction Fuzzy Hash: 9141B1B1D10349DFDB14CFA9C985ADEBBB5FF48310F24822AE819AB210D7759845CF91

Function 062C9D9C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 062CC429

Memory Dump Source

Source File: 00000002.00000002.4131527291.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_62c0000_InstallUtil.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: a18ae10f897b741ac943d5dee0072b6d22c9b75d8b48b8fde33ce47158103844
Instruction ID: 9b43f7213816f1406a72d532e216417d0e6547de19525774a0e5aa6bcadac224
Opcode Fuzzy Hash: a18ae10f897b741ac943d5dee0072b6d22c9b75d8b48b8fde33ce47158103844
Instruction Fuzzy Hash: 534129B4A10305CFDB54CF99C448AAABBF5FF88324F24C55DD559AB321D774A841CBA0

Function 062CCFB4 Relevance: 1.6, APIs: 1, Instructions: 76comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 062CD048

Memory Dump Source

Source File: 00000002.00000002.4131527291.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_62c0000_InstallUtil.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 14eaf27d217e90e78f9785f8ff8f4f429179527c8e3a28673116ed5e500dc90a
Instruction ID: be3627b8ef07e935c8c800771103ea6ef7c320ef619cb80e991a01d24130d4fd
Opcode Fuzzy Hash: 14eaf27d217e90e78f9785f8ff8f4f429179527c8e3a28673116ed5e500dc90a
Instruction Fuzzy Hash: 143132B0D00209EFDB10DFA9C984BCEBBF5EF48314F208469E848AB294D7756886CF55

Function 062CC9AC Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 062CD048

Memory Dump Source

Source File: 00000002.00000002.4131527291.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_62c0000_InstallUtil.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 320d163f7116cbf27ab2a016dfcbbec25f7c980ca73921fd159e519df3027d7b
Instruction ID: 3c7b67bc718c56ff724bbc5a7098166a23942801ac0726d92c8c2362c3315b79
Opcode Fuzzy Hash: 320d163f7116cbf27ab2a016dfcbbec25f7c980ca73921fd159e519df3027d7b
Instruction Fuzzy Hash: D93105B0D11208DFDB50DF99C984B9EBBF5AF48314F208469E808BB254D7756845CB95

Function 02AFCC30 Relevance: 1.6, APIs: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 02AFCCC2

Memory Dump Source

Source File: 00000002.00000002.4122932639.0000000002AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2af0000_InstallUtil.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d80e164faf22de97186eb6f5baddad7ed151700df5806f73345f859380fa6233
Instruction ID: 4e35edcbd1239f8c967bbb09f277c98428ba316c9e2f79b64c84e901f71bcf0c
Opcode Fuzzy Hash: d80e164faf22de97186eb6f5baddad7ed151700df5806f73345f859380fa6233
Instruction Fuzzy Hash: 593167B09002498FCB00DF99D584B9EFBF1FB48314F14855AE559AB321C739A949CFA4

Function 02AFB048 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02AFB0D7

Memory Dump Source

Source File: 00000002.00000002.4122932639.0000000002AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2af0000_InstallUtil.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 43bf66134dea2854c479b0cd2f7f18d936516b1630038973c36ffc25dad38db4
Instruction ID: 00a7ee5ebffe01daa454772bfdc50b03f7d6eebb8f66ab047562bec825201041
Opcode Fuzzy Hash: 43bf66134dea2854c479b0cd2f7f18d936516b1630038973c36ffc25dad38db4
Instruction Fuzzy Hash: 402178B590024A9FDB10CFA9E444BEEFBF0EB48324F24815AE664A7250C338A954CF60

Function 02AFB04B Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02AFB0D7

Memory Dump Source

Source File: 00000002.00000002.4122932639.0000000002AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2af0000_InstallUtil.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6287fb88025ec12ee314e80d2ee19518ae907a5b7a549c8834f7def7f9fd18d7
Instruction ID: e964fc396754428f4b403a8f2fdf6782fe17a7424ab15b1b552083ba9cca30f7
Opcode Fuzzy Hash: 6287fb88025ec12ee314e80d2ee19518ae907a5b7a549c8834f7def7f9fd18d7
Instruction Fuzzy Hash: 0221E4B5900208EFDB10CF9AD984ADEFBF4FB48314F14841AE958A7350C379A944CFA4

Function 062CEC01 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 062CEC83

Memory Dump Source

Source File: 00000002.00000002.4131527291.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_62c0000_InstallUtil.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 85b43870be9789c22793b7e45b6cb9e524f87695dfe6db05c5f0851fae9fb930
Instruction ID: 47e082e2b63a17ec5722538000987a6cf8cd786811ea460d97412fd5b4dd046a
Opcode Fuzzy Hash: 85b43870be9789c22793b7e45b6cb9e524f87695dfe6db05c5f0851fae9fb930
Instruction Fuzzy Hash: 862134B1D002099FCB14CFAAC844BDEBBF5EB88320F10842AE459A7250C775A944CFA5

Function 02AFCD28 Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 02AFCDA1

Memory Dump Source

Source File: 00000002.00000002.4122932639.0000000002AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2af0000_InstallUtil.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: f8807842b71357053aa54481a4f6ef5d46ab68b7d6b4062d10ae85a7ce68084c
Instruction ID: 4a542fd0b939cdc4767e52dc17e706ad07af15ff470fa01cddf68c3a9c98a766
Opcode Fuzzy Hash: f8807842b71357053aa54481a4f6ef5d46ab68b7d6b4062d10ae85a7ce68084c
Instruction Fuzzy Hash: 9C2158B1D002098FDB10CF9AC844BEEFBF5EB88320F14842AE558A3350C778A945CFA5

Function 02AFB050 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02AFB0D7

Memory Dump Source

Source File: 00000002.00000002.4122932639.0000000002AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2af0000_InstallUtil.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6e888ece859ade4f90799fed0bdc3a1c97abed5ff9f7dc41b9a68bbfe205a5f2
Instruction ID: f613d76ddf030f9f3c5677116d5f89a5b5d0484238c64fdd01d6680d21621d76
Opcode Fuzzy Hash: 6e888ece859ade4f90799fed0bdc3a1c97abed5ff9f7dc41b9a68bbfe205a5f2
Instruction Fuzzy Hash: E021E4B5900208DFDB10CF9AD584ADEFBF4FB48314F14841AE958A3350C379A940CFA4

Function 02AFD4B9 Relevance: 1.6, APIs: 1, Instructions: 60windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,00000000,00000000,?), ref: 02AFD53D

Memory Dump Source

Source File: 00000002.00000002.4122932639.0000000002AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2af0000_InstallUtil.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 45141ad76aa5733aedebc854d5ed777fde608cbe11100b818fa72359f24816c5
Instruction ID: 3995b103f475a242652e500222acd7b32cbd552bfb136675b65ead9d2eed9d65
Opcode Fuzzy Hash: 45141ad76aa5733aedebc854d5ed777fde608cbe11100b818fa72359f24816c5
Instruction Fuzzy Hash: 7D2113B6900709DFCB11CF9AD884ADEFBB5FB48318F10852EE519A7200C779A544CFA4

Function 02AFCD30 Relevance: 1.6, APIs: 1, Instructions: 59threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 02AFCDA1

Memory Dump Source

Source File: 00000002.00000002.4122932639.0000000002AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2af0000_InstallUtil.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 279e545d675e855aae893127c81cb8a2b4ff5e8a7181ffe09f9cd055807a6b8e
Instruction ID: c65b9e7a16660a05043592382049887ef9ae34e174470d6a939946d297d6379f
Opcode Fuzzy Hash: 279e545d675e855aae893127c81cb8a2b4ff5e8a7181ffe09f9cd055807a6b8e
Instruction Fuzzy Hash: FA2136B1D002198FDB14CF9AC844BEEFBF5EB88324F14842AE558A7250D778A945CFA5

Function 062CEC08 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 062CEC83

Memory Dump Source

Source File: 00000002.00000002.4131527291.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_62c0000_InstallUtil.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 4c914638480acad79e142702bad6cecec7bec87bb16d92c8722b25092549df6c
Instruction ID: 48e08a0be8f8a49d9fac0d424d710acb5d40aa12a7878f247e73b1e2f33feb28
Opcode Fuzzy Hash: 4c914638480acad79e142702bad6cecec7bec87bb16d92c8722b25092549df6c
Instruction Fuzzy Hash: EB2124B1D00209DFCB14CF9AC844BEEFBF5EB88320F10842AE459A7290C775A944CFA5

Function 02AFD4C0 Relevance: 1.6, APIs: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,00000000,00000000,?), ref: 02AFD53D

Memory Dump Source

Source File: 00000002.00000002.4122932639.0000000002AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2af0000_InstallUtil.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: ebdfa42112b2371ac78f8007ece313dce9a27b49c20e0be7e7a761868be9d4dd
Instruction ID: a6076366c8dcc3f607fd3a12a4c52d8ceee7f8851f2ab4ef8522bc4d082587e2
Opcode Fuzzy Hash: ebdfa42112b2371ac78f8007ece313dce9a27b49c20e0be7e7a761868be9d4dd
Instruction Fuzzy Hash: 992113B6900709DFCB10CF9AD884ADEFBB5FB48318F10852EE519A7200C775A544CFA4

Function 062C4C70 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 062C4CD7

Memory Dump Source

Source File: 00000002.00000002.4131527291.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_62c0000_InstallUtil.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 349e3ce865567b3603c580dc8ab821f420cb8d3d786c27d74f3e499c12e2ce8c
Instruction ID: 1251113aedbf9223758b252d553d0f70490b9d4d0c5b087a727669bfcc007b5b
Opcode Fuzzy Hash: 349e3ce865567b3603c580dc8ab821f420cb8d3d786c27d74f3e499c12e2ce8c
Instruction Fuzzy Hash: D91112B1C0025A9BCB10DF9AC544BDEFBF4AB48320F10812AD818A7250D378A944CFA5

Function 062CAB18 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 062CAB86

Memory Dump Source

Source File: 00000002.00000002.4131527291.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_62c0000_InstallUtil.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: cd9920b15f9273d0675e5648958a985d041646b76124f9e4b4c9f48f25ec1e77
Instruction ID: a58ee73b1bf7a8ff1d1ce50c13847f01cd48713fc481e718cf70c6c1f2849ed3
Opcode Fuzzy Hash: cd9920b15f9273d0675e5648958a985d041646b76124f9e4b4c9f48f25ec1e77
Instruction Fuzzy Hash: 4211F0B5D003498FDB10CFAAC448ADEFBF5EF49320F10856AD8A9A7210D375A545CFA5

Function 062CC698 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,062CC675), ref: 062CC6FF

Memory Dump Source

Source File: 00000002.00000002.4131527291.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_62c0000_InstallUtil.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 11afe1f8c1a66ba2e98f2f1d32bdc0135b77941e2c88f522cc1c69c33e77519e
Instruction ID: 16699ec7ea94fe7f1c8ffdc9b937357857828e6ea0c4a85205c2617585899f6e
Opcode Fuzzy Hash: 11afe1f8c1a66ba2e98f2f1d32bdc0135b77941e2c88f522cc1c69c33e77519e
Instruction Fuzzy Hash: 211136B1900249CFDB10DFAAC485BDEFFF8EB49324F20845AD599A7210C375A544CFA5

Function 062CAB20 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 062CAB86

Memory Dump Source

Source File: 00000002.00000002.4131527291.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_62c0000_InstallUtil.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1ab572573f60901abf178436436bebfcfd9899929e808b678cc9fbf68301e95b
Instruction ID: d59bfcdbd54159fc89bc2022731c65b2dbed8dbfe1b1797dc909e398dacc66e2
Opcode Fuzzy Hash: 1ab572573f60901abf178436436bebfcfd9899929e808b678cc9fbf68301e95b
Instruction Fuzzy Hash: BE11DFB5D002498FDB10DF9AC448ADEFBF5AB89324F10852AD869A7210C375A545CFA5

Function 062C9DF4 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,062CC675), ref: 062CC6FF

Memory Dump Source

Source File: 00000002.00000002.4131527291.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_62c0000_InstallUtil.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 0805459e38abbb66fd0252534b0e6bf1ab9400b3c7f4fcb2aa9f3236f0f04d08
Instruction ID: a464a2c45cb162bc96025968f903ac3baf18ae217972e9c44cc3876d8f2a9bcd
Opcode Fuzzy Hash: 0805459e38abbb66fd0252534b0e6bf1ab9400b3c7f4fcb2aa9f3236f0f04d08
Instruction Fuzzy Hash: 451145B5900249CFCB50DF9AC488BDEFBF8EB48324F20841AE959A7310D375A944CFA5

Function 02AFB920 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 02AFBED5

Memory Dump Source

Source File: 00000002.00000002.4122932639.0000000002AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2af0000_InstallUtil.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 3362e856230f3819c7e6cbcb3b653fc194b4d0cc339144c93a8f06099646bca1
Instruction ID: 5b50d9ad964b48fb536c135c70025cbd061fb6514fc526979c85dfd721f1ba81
Opcode Fuzzy Hash: 3362e856230f3819c7e6cbcb3b653fc194b4d0cc339144c93a8f06099646bca1
Instruction Fuzzy Hash: AD1133B09002488FCB20DF9AC488B9EFBF4EB48328F108459E658A7210D378A940CFA5

Function 02AFBE78 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 02AFBED5

Memory Dump Source

Source File: 00000002.00000002.4122932639.0000000002AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2af0000_InstallUtil.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 56969d72e41af6db8ec55b8b73b04b329e86cd6056c51c9f9176e9ead4bc887c
Instruction ID: be39809ae808a4b1e4b977119f93651be375b8f0019bf9635b8cc5037f1bfb90
Opcode Fuzzy Hash: 56969d72e41af6db8ec55b8b73b04b329e86cd6056c51c9f9176e9ead4bc887c
Instruction Fuzzy Hash: 3D1115B59002498FCB20DF9AC585BDFFFF4EB48324F108459E658A7210D779A544CFA5

Function 0674A840 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 0674A89D

Memory Dump Source

Source File: 00000002.00000002.4132766926.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6740000_InstallUtil.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: b867e5b69a19d32f0f4483629b39b5061e2249e6918f46f9a2791a58d94d29d3
Instruction ID: bea06bb5ec823c159e07536fade452e6527a5e78a39f860e731976979649990d
Opcode Fuzzy Hash: b867e5b69a19d32f0f4483629b39b5061e2249e6918f46f9a2791a58d94d29d3
Instruction Fuzzy Hash: FB1100B1D00248CFCB10DF9AD448BDEFBF8EB48320F10842AE458A3250D378A544CFA5

Function 062CC72C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,062CC675), ref: 062CC6FF

Memory Dump Source

Source File: 00000002.00000002.4131527291.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_62c0000_InstallUtil.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a0139e92098ec2aa98f4b5734f2bc0796d8a8699a0f870fafa47b08021c701ce
Instruction ID: 1be1757495e98de43184803513b234bc16fed3b1baa346358a97cf3080452291
Opcode Fuzzy Hash: a0139e92098ec2aa98f4b5734f2bc0796d8a8699a0f870fafa47b08021c701ce
Instruction Fuzzy Hash: BFF0F0B2C143808EDB508B99C8593DABFF0EB51328F24818EC49E9B261D3799189CB91

Function 06285FC8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06286103

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 5fa1c5bccd23f8775d361f9e4ca2419587a04c2395285f7a605291570e3db913
Instruction ID: 315dd1c5054a01d287bdd6c9b3f251e538225f735c009a387241b49c2041dcc8
Opcode Fuzzy Hash: 5fa1c5bccd23f8775d361f9e4ca2419587a04c2395285f7a605291570e3db913
Instruction Fuzzy Hash: 9631E231B142029FDB55AB74D95466F7AE3AFC5300F108828D806DB395EF36DC46CB95

Function 06288841 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Ocq, xrefs: 0628884D

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID: \Ocq
API String ID: 0-2995510325
Opcode ID: a49ab3780eb2a963d9e1881066f586d7dd812417ca6a2ca4a84a617a41c33378
Instruction ID: 71d3f021c2564acb81bbba9defd796ff904391eb5996c0521d6bb814bac8c349
Opcode Fuzzy Hash: a49ab3780eb2a963d9e1881066f586d7dd812417ca6a2ca4a84a617a41c33378
Instruction Fuzzy Hash: B3F0B730E21129EFDB14EF94E9597AEBBB2BF88740F604519E502A7294CB741D41CB80

Function 06286140 Relevance: 1.0, Instructions: 1005COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd787536be2744237ddd4fb99e987d72460999a05ab5f87c49674be734b26b2b
Instruction ID: 41292e9ca84314e3d6fdc48171c9ff4ddef2ca2585d137055ef0af1d8689a19f
Opcode Fuzzy Hash: bd787536be2744237ddd4fb99e987d72460999a05ab5f87c49674be734b26b2b
Instruction Fuzzy Hash: CF924634E11205CFDB64EB68C988A9DB7F2FB45314F5484A9D849AB3A1DB35EC85CF80

Function 06280040 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4f7faac42599edb9ef4b5926d36543132e86ccf78390d5a6b01cf8461d363e
Instruction ID: 636404f05b8531c0e37b73b85d0297ca849655930451214ffda771358bb885f4
Opcode Fuzzy Hash: cf4f7faac42599edb9ef4b5926d36543132e86ccf78390d5a6b01cf8461d363e
Instruction Fuzzy Hash: 6EE1B035F112059FDB54EF68D984AAEB7B2EF88310F108465E806E73A4DB35EC46CB91

Function 06280007 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b49a0c59dda89c10cb9554c5b4161a7fce237eb1367e28d7b6250e063234c482
Instruction ID: 6560aa80da8a1481f3ded8861f2c5d4a9121ed41cb8b7f834cbaaf6884c6ab5b
Opcode Fuzzy Hash: b49a0c59dda89c10cb9554c5b4161a7fce237eb1367e28d7b6250e063234c482
Instruction Fuzzy Hash: 27A1CD35A112059FCB55EF64D984AADBBF2EF88310F148069E806E73A5DB74EC46CB90

Function 06289438 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38a7e4e349b0813bc22e68885f929699411aa6cf8de587732ee71518dd409277
Instruction ID: 9f3c406f080bf49c3e93e680ac652fe34ac10fb07e838bc8a28ce6abf635dae1
Opcode Fuzzy Hash: 38a7e4e349b0813bc22e68885f929699411aa6cf8de587732ee71518dd409277
Instruction Fuzzy Hash: 2C81D331E262139FDF60AB6CD880779BB61EB81315F158466EC69DB2C2C235D8D0CBD1

Function 06289FA0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c3932ed80c33aa7df21feabe40917f8a77f56bcafb7700f99876a3e8ea2c78f
Instruction ID: 4838354af237b783670ea3344bb008e714d7d7921973bfc965965451cd8cf20c
Opcode Fuzzy Hash: 6c3932ed80c33aa7df21feabe40917f8a77f56bcafb7700f99876a3e8ea2c78f
Instruction Fuzzy Hash: 4761C271F100124FCB14AA7ECC8466FAADBAFD4624B154436E80EDB360DEA6DD02C7D2

Function 06287C8A Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a7be1a3424bb4bed45475c419a716695ddd0e95168eaa880bf208a8090d0d2
Instruction ID: d062eb062bfb364c8f1659151706de4fa16c1b0c095f55eff3d35e34639af4ba
Opcode Fuzzy Hash: 67a7be1a3424bb4bed45475c419a716695ddd0e95168eaa880bf208a8090d0d2
Instruction Fuzzy Hash: F9814031B112069FDB54EB65D89476EB7F2AF89304F208529D80ADB394EB71EC42CB91

Function 06287FA8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ae4864a8bc4d20193ecb8e63570346f01448bc3ac81d96209649560c053b6f
Instruction ID: 6c05773d8dca7044325bf8e7158284e8905346e19f9d7d90fba7c67ccfe0e0f7
Opcode Fuzzy Hash: 17ae4864a8bc4d20193ecb8e63570346f01448bc3ac81d96209649560c053b6f
Instruction Fuzzy Hash: 28915F30E1061A8FDF60DF68C890B9DB7B1FF89300F208599D549BB295DB74AA85CF91

Function 06280558 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7edb5f45c5b972a8c1bae99291affe387583d1976066be7efdf415f5880d07c
Instruction ID: 3966bcd773e58c2def5a7ced85e7d7ceb87c2a0fb5589a63a2bc21a81f95c9ac
Opcode Fuzzy Hash: d7edb5f45c5b972a8c1bae99291affe387583d1976066be7efdf415f5880d07c
Instruction Fuzzy Hash: C371AC71A112058FDB44DF69D984B9DBBF6FF88310F14C1A9E909AB395EB70D844CB90

Function 06287FC0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f9e67c870c1e1c102e228e9b3d5f987c05a8e6ea07148c31f08799e126ba79
Instruction ID: 218f04be4ff7ce6213a8f991f126c5c814aec9cec2a1fe446f593b86bb617edc
Opcode Fuzzy Hash: 67f9e67c870c1e1c102e228e9b3d5f987c05a8e6ea07148c31f08799e126ba79
Instruction Fuzzy Hash: CA913C30E1061A8FDF60DF68C980B9DB7B1FF89300F208595D549BB295DB74AA85CF51

Function 01150588 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a9c792df044e80888c4c5c5bcee52297309fbff8d5434296d8785ce8359d653
Instruction ID: d644304982638ffaad6af9ac5bf492baa23fa8375256284d0be761f6715ad2a2
Opcode Fuzzy Hash: 3a9c792df044e80888c4c5c5bcee52297309fbff8d5434296d8785ce8359d653
Instruction Fuzzy Hash: 91718C31D00709DFCB14DFA9C884ADEFBB5FF49310F20896AE869A7211E734A945CB51

Function 06289208 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3146706d42034f8f2ba3f73cab977a21635cab458a427d46843324def39e9628
Instruction ID: 8efbef2785f1e73bae7b589bebba34ea2a068ff40e2fc77a57323e712af21020
Opcode Fuzzy Hash: 3146706d42034f8f2ba3f73cab977a21635cab458a427d46843324def39e9628
Instruction Fuzzy Hash: 81418071E1020A9FDB70DE9DDC80ABFF7B1EB85310F104929D51AD7694D334A985CB90

Function 0628A5E8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff5667c024321847d2048d04a6e14f75354a2515c70549da6b497f996d3fdfc
Instruction ID: 05ca6d58cd7b6d6719a54a184ebf87b112d5b9d90538f306e2caa0c50ddffa22
Opcode Fuzzy Hash: 1ff5667c024321847d2048d04a6e14f75354a2515c70549da6b497f996d3fdfc
Instruction Fuzzy Hash: DB41B0719163A99FCB01DF68CC506DEBFB4EF0A310F1580A7E444E7292D7389944CBA5

Function 01153158 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06bd3f5f3dcc835c3c00539159b42e51f8f64d5dcf2845ae3ec738ce32a8878c
Instruction ID: 002ac294f571c0a74b9b7b73cecd7c6a1c49a915aea9751f2e91bf31ddddaecc
Opcode Fuzzy Hash: 06bd3f5f3dcc835c3c00539159b42e51f8f64d5dcf2845ae3ec738ce32a8878c
Instruction Fuzzy Hash: 47416D30D10709DBDB19DFA9C8846DEFBB1BF88340F14C669E8597B214EB70A981CB90

Function 06285E79 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d85d24c390293ad2254be82bea916af17f68fbdb4d62194f7c2f9f83356829
Instruction ID: f4234eca11aafd697f2f3e49b92a884e05b5d3904d4138dd856fbc5994c5f803
Opcode Fuzzy Hash: 98d85d24c390293ad2254be82bea916af17f68fbdb4d62194f7c2f9f83356829
Instruction Fuzzy Hash: F2316D74E202069FCB55DF65D89869EB7B2BF99300F148519E80AF7790DB70A846CB50

Function 011539AF Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 487a12cefdd50754f270a3b2081ca483e450118992a5838ca430a8bd436c6aed
Instruction ID: cbac807bc55ae93aafac4369df96004bd302a8a5fae2f072e3fffdbdc93d874d
Opcode Fuzzy Hash: 487a12cefdd50754f270a3b2081ca483e450118992a5838ca430a8bd436c6aed
Instruction Fuzzy Hash: A631C270E102059FCB51EF68D940AAEB7B1FF46310F108A29D416EB365EB35ED46CB91

Function 011539C0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe5e4796dee9737184af45be7f89a7feab5c7459c9c8427461e6ade47025176
Instruction ID: f2b4e8b3d73115f5c487bec66de7f2100836e76188aafa9de596a30d80fd2daf
Opcode Fuzzy Hash: 4fe5e4796dee9737184af45be7f89a7feab5c7459c9c8427461e6ade47025176
Instruction Fuzzy Hash: 3531B030E102058FCF51EB68D880AAEB7B1FF85310F108A28D516E7365EB31EC46CB91

Function 06285E88 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e1bb660a56ca252eb2eab4ab173ba8c6c927bef84980d4355bc7b3fe12a11c9
Instruction ID: a54c5534c05b9b01c73b1a197787f37efac0ddc5fa0fbfbf62841091ec790f7b
Opcode Fuzzy Hash: 6e1bb660a56ca252eb2eab4ab173ba8c6c927bef84980d4355bc7b3fe12a11c9
Instruction Fuzzy Hash: F9312B34E202069FCB55DF69D89869EB7B2BF99300F148529EC06F7790DB70AC56CB50

Function 01150809 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde0630f05e805561dc5aea7ec2abff96f6bd7d6afe045ca3a63ba095720c935
Instruction ID: 9e69d97be89f2ac8a1bebbe697377445230873c65b3a49b0c6199e60be7498dc
Opcode Fuzzy Hash: cde0630f05e805561dc5aea7ec2abff96f6bd7d6afe045ca3a63ba095720c935
Instruction Fuzzy Hash: 453126B5900608CFDB10DF9AD544BDEFFF4EB88324F24841AE559A7210C375A944CFA5

Function 06287892 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a97c1096c479a5dc7e0334d94f9d6f3396ed06b0d998b0c2c1f13c4e1ab4a1e
Instruction ID: 4d002ffbf118a48a38b7303d272a4fcc875a6cee993881ed5d17b3faae0c27c8
Opcode Fuzzy Hash: 9a97c1096c479a5dc7e0334d94f9d6f3396ed06b0d998b0c2c1f13c4e1ab4a1e
Instruction Fuzzy Hash: 34218B75E112169FDB40EF69DD80AAEBBF1AB48610F208025E909E7394E770D802CB90

Function 01151D35 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2267cc94b4f239e7a929381691bab54c7a7189fa3272243eea7cbe74b6039e1
Instruction ID: ec656f39f33cdfb055fd85f8490955de768e2023fd4130ec3602d69dc68960a9
Opcode Fuzzy Hash: c2267cc94b4f239e7a929381691bab54c7a7189fa3272243eea7cbe74b6039e1
Instruction Fuzzy Hash: AA3112B0D11218DFDB14DF99C588BCEBFB4BB08354F20805AE864AB251C7B59945CFA5

Function 062878A0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 542304c92b01b8d15229925c5f3f6566c6803a6421c747255d6b97addb60aef9
Instruction ID: 4d89c84792cf40503efa509878b0dc03f7a53a237df3bced721a140ef96370e2
Opcode Fuzzy Hash: 542304c92b01b8d15229925c5f3f6566c6803a6421c747255d6b97addb60aef9
Instruction Fuzzy Hash: EB216B75E212169FDB40EF69DC40AAEBBF5EB48610F208025E909E7394E670D902CB94

Function 011534DC Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81689f59e29dc42f016a90ff4560cdbfaaa697076db5ddd9295fbf451644ac52
Instruction ID: 43140638493fb2e3a96d6097e52959fa7f96fbcc61ea83a09ccbff3f5492afb4
Opcode Fuzzy Hash: 81689f59e29dc42f016a90ff4560cdbfaaa697076db5ddd9295fbf451644ac52
Instruction Fuzzy Hash: 1D31E3B0D11218EFDB14CF99C588BCEBFF5BB08314F24845AE815AB250C7759945CFA5

Function 029CD2B8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122571441.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29cd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4077a74e29972825778d84c84ab806727b5c4acbd6cb32215cc4ca6d92118cf
Instruction ID: 30da1a7555d0cd6e93ce89765186031f92d40aa2f686e5939279bd71e91da470
Opcode Fuzzy Hash: e4077a74e29972825778d84c84ab806727b5c4acbd6cb32215cc4ca6d92118cf
Instruction Fuzzy Hash: 8A2105B1504244DFDB05DF14DAC4B2ABBA9FB88328F34C57ED8494B295C33AD446CAB2

Function 029CD0F0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122571441.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29cd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a87edfa332166eb5683624ee8e268d5653501848d64457257efc2112c5a5ba3e
Instruction ID: 2791b91e4d09dcb3ba05e3e347656429349a11bcd3eecd8b723ad7de323bca74
Opcode Fuzzy Hash: a87edfa332166eb5683624ee8e268d5653501848d64457257efc2112c5a5ba3e
Instruction Fuzzy Hash: F221AFB5604244DFDB09DF14D9C4B26BBA5EB88314F24C97DE84A4A396C336D446CB72

Function 029CD468 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122571441.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29cd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f8387070004e68bfe6c493446b2ed28629f39801c377fe1cdba89cc02bdf0e4
Instruction ID: ed29f9b3358323d3390663d7f2a1a502bd9470533d65311ee6a139ee2d0707e5
Opcode Fuzzy Hash: 9f8387070004e68bfe6c493446b2ed28629f39801c377fe1cdba89cc02bdf0e4
Instruction Fuzzy Hash: 2821C571504244EFDB04DF14D5C4B26BBA9EB84318F34C97DD90D4B29AC37AE446CA72

Function 01151D4C Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b309b24be5c2a20f2be6242166bec3f5483e8e27608f8bdb0fbb113af8539851
Instruction ID: e27df0e300905d47e7c88868987cfbb92cb35a0d3b806270052f5a49bf499687
Opcode Fuzzy Hash: b309b24be5c2a20f2be6242166bec3f5483e8e27608f8bdb0fbb113af8539851
Instruction Fuzzy Hash: 0B31F2B0D10218EFDB24DF99C588B8EBFF4BB08354F10801AE825BB250C7B59945CFA1

Function 0628AED0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ef4c8025b254ae92379ed21a2ec623616e6d8bb47da97702ffc0d53704335e
Instruction ID: 50d8c336d700f027a41a1248f5db193bd4373b8bc6f50225adf556ff9c7cd484
Opcode Fuzzy Hash: 23ef4c8025b254ae92379ed21a2ec623616e6d8bb47da97702ffc0d53704335e
Instruction Fuzzy Hash: AC217530B211159FDF44EB69E95469EB7B6EF84310F14847AE809E7384DB35EC42CB94

Function 01150D7F Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bd82ad522027f4b2aa60defbc10fbe638dbf87445f91ca877fad6e983311019
Instruction ID: 5a791a9fe7c22496c05ac73900c25967e31d2e703e18e3df44fe2b604fa8253a
Opcode Fuzzy Hash: 9bd82ad522027f4b2aa60defbc10fbe638dbf87445f91ca877fad6e983311019
Instruction Fuzzy Hash: FE11E535B052446FCB99DBBD9C144AEBBEECFC510072480ABE819C7262EE359D0187A1

Function 06287668 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2c690bc7cab7037b78947dd19250f5f3705288e2eb3474fd15458c3b3c837d9
Instruction ID: 8ec2e5f29cc7449976fc1af2867b5d8f09378d39334d2f53aeb4b4b04c5911e7
Opcode Fuzzy Hash: b2c690bc7cab7037b78947dd19250f5f3705288e2eb3474fd15458c3b3c837d9
Instruction Fuzzy Hash: A9212CB5D0125AAFCB10DF99D844ADEFFB4FB49310F20811AE918B7240C375A554CFA5

Function 01150744 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce3bf24969821efb18b5b79fdf27ba4f70412cb102c8873d8e7aa23c8acedacb
Instruction ID: c1089d73264c9dfac1fd11f2fde17acbe0ba1cddd7aee51dc2d5dbd920aee643
Opcode Fuzzy Hash: ce3bf24969821efb18b5b79fdf27ba4f70412cb102c8873d8e7aa23c8acedacb
Instruction Fuzzy Hash: BC2112B0D01348DFCB14CFAAD8886DEBBF4FB48310F60842AE458A3211C378A4048BA5

Function 01150E0C Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de40fb30844bb88c6db4a288663859854328c603fb58e2b8d43e0098b36ff2f0
Instruction ID: 2e2f9796ca32e5dab5aa8a78dddecdb27eec317a4500d0844d7e4cc1926e3e4c
Opcode Fuzzy Hash: de40fb30844bb88c6db4a288663859854328c603fb58e2b8d43e0098b36ff2f0
Instruction Fuzzy Hash: 921104357053849FCB8A9B7C98144AE7FFA9FC620132444ABE945CB2A2DE359D0583A2

Function 062879B0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6bba61e25c4cea1f7993eeeccfcc8bf5e7adaa0393f5503a9c08e08322595ba
Instruction ID: 692e5a38ddb5774ba1d6abf9df93aa7819b897ca05a67afb3b1b23ebbacb46c7
Opcode Fuzzy Hash: f6bba61e25c4cea1f7993eeeccfcc8bf5e7adaa0393f5503a9c08e08322595ba
Instruction Fuzzy Hash: 0A11A532B201155FDF44A668DC14AAF77EAEBC9710F144535D80AE7384DE64DD02C792

Function 06287BE7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07177200874a61754b8a3f242cbb9e3a0259874c7807c848f08dfeee3e419ccc
Instruction ID: aac9440c6ab3ec937ef27973bb00d13e306d4fc5270f25d4b20e5f495f85e4ec
Opcode Fuzzy Hash: 07177200874a61754b8a3f242cbb9e3a0259874c7807c848f08dfeee3e419ccc
Instruction Fuzzy Hash: 3701F131B291111FDB56A6BDA82076E67DACBCA610F24847AE40EC73D2DD65CC028396

Function 0628E4C8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544a40c47279281e3d3ccca13d5512b47af79cfd1620a95e91de6b98909aa213
Instruction ID: 86cc2951ce64fdf6687df250976870f918ec001c9db68bd6e91899b927829b6c
Opcode Fuzzy Hash: 544a40c47279281e3d3ccca13d5512b47af79cfd1620a95e91de6b98909aa213
Instruction Fuzzy Hash: AB01DF31B112011FDB62AA78AC5476B67A5EB89710F108929F44ED7395EA28EC428384

Function 029CD2B3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122571441.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29cd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: 1e7663a7c221cf9c725e67be2c3f0bb44d20b0a11fa1797032bbe5a63308bbe6
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: 87119D76504284CFDB12CF14D5C4B1ABB61FB84328F28C6AED8494B656C33AD40ACBA2

Function 029CD0EB Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122571441.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29cd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 5d87bfbbe46e964121d567bbaf32984feb7a903d865ae91d2bdbb2fe4aca32ae
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 6B118B75504280DFDB15CF14D9C4B15BBA2FB88318F24C6AED8494B796C33AD44ACB62

Function 029CD463 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122571441.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29cd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: c1ed420a4ec75e9bc5549aa7b32b87e5e05aa837d1087503f9bcfa5771910e03
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 0E118B76504280DFDB15CF24D5C4B15BBA1FB84318F28C6AED8494B69AC33AD44ACB62

Function 06287670 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7420a75c21beb9993b893b21be260287097c3fd006362acf200f14e456a951e3
Instruction ID: 22821ab1a00b7d2bd46711cd3fc79199c921034f777fb9ab4f76e546b24c80e1
Opcode Fuzzy Hash: 7420a75c21beb9993b893b21be260287097c3fd006362acf200f14e456a951e3
Instruction Fuzzy Hash: CD11D3B1D01259EFCB00DF9AD884ACEFFB4FB48310F10812AE918A7240C374A544CFA5

Function 062879A2 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54fc99e556864e0cb3e7378fc26c244c2c619251626573efeec36704320091b7
Instruction ID: 0c5315a6b0467139ede6f83135b1ae77e81aec9269ffd469a50cbf030bb8280d
Opcode Fuzzy Hash: 54fc99e556864e0cb3e7378fc26c244c2c619251626573efeec36704320091b7
Instruction Fuzzy Hash: 3601A236F210166FEB95A568DC10BEF76AFDBC8610F104536D90AE7384EE64DD0287E2

Function 06287BF8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1080ea98a005e7b7e6728bb7fb5bd73273a94493b2ae986a4f09d4c0f219600
Instruction ID: 6605e249ddf3b2d20f2bb33f2aa7e447d0b1023fef8c0445b44d9c78235a4eb0
Opcode Fuzzy Hash: c1080ea98a005e7b7e6728bb7fb5bd73273a94493b2ae986a4f09d4c0f219600
Instruction Fuzzy Hash: 53018131B200111FDBA5B66EA85472FA2DBDBC9710F248439E50EC73D5DE66DC428395

Function 011530C0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae8bd6e3487366929a901c855e45bd7d59519153934c1d0a856252f19812f91
Instruction ID: f5fa95411992265f7e8b7921c6bfc0552dc36c5459c03b8f4f9c1ffe5ed8730d
Opcode Fuzzy Hash: aae8bd6e3487366929a901c855e45bd7d59519153934c1d0a856252f19812f91
Instruction Fuzzy Hash: 0E11F5B5900248CFDB20DF9AD585BDEBBF4EB48320F10841AD969A7350C375A945CFA5

Function 0628E4D8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6416f7c5e369ff1cb50d45d5813a3e464e07f86c22c93a135a5e3bf8fbaccc42
Instruction ID: 141d91070318c5a3ecd54340df082de56f989d01ea29d270a0d54fe0ddd712b0
Opcode Fuzzy Hash: 6416f7c5e369ff1cb50d45d5813a3e464e07f86c22c93a135a5e3bf8fbaccc42
Instruction Fuzzy Hash: 83018131B101115FDB65FA6DE85072A73D6EB89714F108839E50EC7394EE25EC428785

Function 011530C8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e634a6e6721039a177f2011337bbabc54f8e10107d3488a759d51af709b0194
Instruction ID: 5bf2ba032b288d68e6a562add07f931e1fdc1e6ecabddb3a9512d695f703278a
Opcode Fuzzy Hash: 2e634a6e6721039a177f2011337bbabc54f8e10107d3488a759d51af709b0194
Instruction Fuzzy Hash: 3A11D3B5900248CFDB60DF9AD585BDEFBF4EB48320F10841AD969A7250C375A944CFA5

Function 01150579 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f528ce977cf187b77b4c9f31d4cf2758f51feacad58791079c564b06fafd24
Instruction ID: 4f082790d4bfc1b0ea4f533607072991b61b9ad674382588ac57ccb99f7b564c
Opcode Fuzzy Hash: 14f528ce977cf187b77b4c9f31d4cf2758f51feacad58791079c564b06fafd24
Instruction Fuzzy Hash: 9EF0B431A062589FCB16CFEDD9C48DEFF76FB49310B15096BF615D2212C33199158761

Function 01153BD0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79607f06e8f0909681fe5fc9cf0fab5649435c986a235563e202c09ae1464815
Instruction ID: f43a6c333cb84d042ac291f8ba464a7da48c13a3b69fc4666cdcb28f4a424289
Opcode Fuzzy Hash: 79607f06e8f0909681fe5fc9cf0fab5649435c986a235563e202c09ae1464815
Instruction Fuzzy Hash: D8F04FB4E4431AEFD748CF69C881AAEBFF9BF48300F008869D924D7242D77485418BE1

Function 01153BE0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01aa057138be49f4581f2698c56333dcd2fc6be9769f648ef1d4490384d03d11
Instruction ID: 9d95985698161ecd43f79554dc76d46606067dbef50a7d31e5f44d185640d42e
Opcode Fuzzy Hash: 01aa057138be49f4581f2698c56333dcd2fc6be9769f648ef1d4490384d03d11
Instruction Fuzzy Hash: F2F03AB0D0030ADFDB48DFAAC845AAEBBF4FF08300F0045AAD928E7201D77096008B90

Function 01153B79 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16f19779ee63af9f8fd6647a6ce5bee193cef501fe5e1c79a77cac4762c386a7
Instruction ID: 5fe88ce4ac96391570eb210716016ef534f1f9c231de4ca5f8d43cf776d892de
Opcode Fuzzy Hash: 16f19779ee63af9f8fd6647a6ce5bee193cef501fe5e1c79a77cac4762c386a7
Instruction Fuzzy Hash: 45F0A974E4820AEFCB44EFB8C804A9EBBF6FF08200F1185A9D824E7211E77085048B91

Function 01153C6F Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9501221ce2c6baae1e2882c68a1f3bd7959f2eb3a65de7058fb2b5ba7c7f59e7
Instruction ID: 1223603693f2e5c8bd15f6772f64efe6ca59532c7e01e685901372d144ac861b
Opcode Fuzzy Hash: 9501221ce2c6baae1e2882c68a1f3bd7959f2eb3a65de7058fb2b5ba7c7f59e7
Instruction Fuzzy Hash: B9E08C32258258AFC742DBA0D840C977BA9BB56280705C4A3E494CF162E722E56DC792

Function 01153B88 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4122247307.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1150000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69388587e0e1ed8f7ce24e94be93fc706442d2911c641549a449346cf7e2ca97
Instruction ID: 4e857d18e0f8a57580ac6d1faa7d896e261d2f9fa0ab0ee0701a3836b9e00003
Opcode Fuzzy Hash: 69388587e0e1ed8f7ce24e94be93fc706442d2911c641549a449346cf7e2ca97
Instruction Fuzzy Hash: 7AE012B0D0020ADFCB84EFA9C948A5EBBF0BB08300F1184A9C428E7211EB7086048F81

Non-executed Functions

Function 0628B858 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 0628B979
$^q, xrefs: 0628BDC6
$^q, xrefs: 0628BDA4
$^q, xrefs: 0628B954
$^q, xrefs: 0628BD11
$^q, xrefs: 0628BDBA
$^q, xrefs: 0628BDB0
$^q, xrefs: 0628B948
$^q, xrefs: 0628BD05
$^q, xrefs: 0628B985

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: 9e88ee29badd3714c50707d8ad14ffb0e1a73a68031f3db6b8d4ebbd4a24ce7f
Instruction ID: e3a0e5bd09d2175afb2e296dd011ea2653547ed83dd41995d6d221449bf81386
Opcode Fuzzy Hash: 9e88ee29badd3714c50707d8ad14ffb0e1a73a68031f3db6b8d4ebbd4a24ce7f
Instruction Fuzzy Hash: 5A124E30E112198FDB54EF65C954A9DB7F2BF88301F2085A9D509AB3A5DB309D86CF81

Function 0628EB00 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 0628ECBE
$^q, xrefs: 0628EC5D
$^q, xrefs: 0628EC7C
$^q, xrefs: 0628EC02
$^q, xrefs: 0628EC51
$^q, xrefs: 0628EBF6
$^q, xrefs: 0628ECB2
$^q, xrefs: 0628EC88

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 742af6dc41cb1ac1b0fa11f20e09b8fac9836cf7d025d2c7a05c63676ebda6b6
Instruction ID: 287dcdfb858ba47cc0461e28f26583834bddd4e66620f7ce5b0800eae263b116
Opcode Fuzzy Hash: 742af6dc41cb1ac1b0fa11f20e09b8fac9836cf7d025d2c7a05c63676ebda6b6
Instruction Fuzzy Hash: 3D918E30E2120ADFEB68EF64DD44B6EBBB2BF84300F118429D8459B3D5DB759945CB90

Function 0628B258 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 0628B53A
$^q, xrefs: 0628B6F4
.5vq, xrefs: 0628B2B3
$^q, xrefs: 0628B5A0
$^q, xrefs: 0628B76C
$^q, xrefs: 0628B760
$^q, xrefs: 0628B594

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: 8b79f5a9c681976c4e44f651faa7eb518e67536b9ca49bd3663f0f66178979a7
Instruction ID: 8627b19668a2547d7bbab97ac917803cab19125160c123e0c61693d4cf34f731
Opcode Fuzzy Hash: 8b79f5a9c681976c4e44f651faa7eb518e67536b9ca49bd3663f0f66178979a7
Instruction Fuzzy Hash: BBF17130A11209DFDB58EFA4D994A6EB7F3BF84301F248569D8059B3A8DB75EC46CB40

Function 0628C590 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 0628C7F6
$^q, xrefs: 0628C85B
$^q, xrefs: 0628C7EA
$^q, xrefs: 0628C84F

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 7e43510e5317a4366eb3e5d19b9e0c68be80a5109768fab2fdc12b18dee94310
Instruction ID: d95c4bcfffdcc65fdaca4f466431a883ef84c397234bd30e5c5ba19cda7887ba
Opcode Fuzzy Hash: 7e43510e5317a4366eb3e5d19b9e0c68be80a5109768fab2fdc12b18dee94310
Instruction Fuzzy Hash: E2B15C30B112098FDB54EB68D9806AEB7B2EF84314F248869D4069B395DB75DC86CB90

Function 0628C9A8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR^q, xrefs: 0628CAEA
$^q, xrefs: 0628CA33
$^q, xrefs: 0628CA27
LR^q, xrefs: 0628CA9B

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: b32c0e2c3a630598567af164bdeb606c7f88026a7c5488d046ded153b7640aac
Instruction ID: 289fd4eb45b4303a8a1c327d65502e4546eddc502fb0f15a84b8b5959666f88e
Opcode Fuzzy Hash: b32c0e2c3a630598567af164bdeb606c7f88026a7c5488d046ded153b7640aac
Instruction Fuzzy Hash: A251C530B112059FDB54EF38D950A6A77E6FF84304F1485A9E815DB3A5DB30EC45CBA1

Function 0628EE88 Relevance: 5.2, Strings: 4, Instructions: 159COMMON

Download Yara Rule

Strings

$^q, xrefs: 0628F00C
$^q, xrefs: 0628EFB9
$^q, xrefs: 0628F064
$^q, xrefs: 0628F03B

Memory Dump Source

Source File: 00000002.00000002.4131273481.0000000006280000.00000040.00000800.00020000.00000000.sdmp, Offset: 06280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6280000_InstallUtil.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 68b564ae2cb1c82e4fb362a7e21edbe6b2c60ed7c1f8cefe6009a4a56e0414f8
Instruction ID: 04797a8f0a9cf725f726544da19b2b7284ae3b6e3da3bfa0687b9d0c66871684
Opcode Fuzzy Hash: 68b564ae2cb1c82e4fb362a7e21edbe6b2c60ed7c1f8cefe6009a4a56e0414f8
Instruction Fuzzy Hash: 0F518131E212059FDFA5EB64EA8066DB3B2EB88310F108529E805DB399DB35DC42CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NoERE2024000013833.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_NoERE20240000138_63a7ade33fcf8e6782cf4f395bc29799fa92023_992c1a96_9a37bb2c-84d5-4845-8954-bb1a9aef85a6\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8720.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8888.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER88B8.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
NoERE2024000013833.exe

Function 00007FFD9B87CB61 Relevance: 1.4, Instructions: 1444
COMMON

Function 00007FFD9B879530 Relevance: .9, Instructions: 928
COMMON

Function 00007FFD9B87BF14 Relevance: .8, Instructions: 765
COMMON

Function 00007FFD9B8708B5 Relevance: .7, Instructions: 652
COMMON

Function 00007FFD9B87381A Relevance: 1.6, APIs: 1, Instructions: 141
memoryCOMMON

Function 00007FFD9B870E65 Relevance: 1.6, APIs: 1, Instructions: 136
COMMON

Function 06286E50 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Function 0628BF38 Relevance: 3.0, Strings: 2, Instructions: 473
COMMON

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre