Edit tour

Windows Analysis Report
nnzZhhVIqM.exe

Overview

General Information

Sample name:	nnzZhhVIqM.exe renamed because original name is a hash value
Original sample name:	43ee4772f0efa084eeb18e09cf5f6ea2a41a35c32123d8b6c1d41337ae79e699.exe
Analysis ID:	1551212
MD5:	d32fb5a87134ee848ec6fc2c081c333e
SHA1:	f2d63086fc54c03f5639e996e2e0f1f6a834625b
SHA256:	43ee4772f0efa084eeb18e09cf5f6ea2a41a35c32123d8b6c1d41337ae79e699
Tags:	exeuser-adrian__luca
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Changes security center settings (notifications, updates, antivirus, firewall)

Found stalling execution ending in API Sleep call

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to resolve many domain names, but no domain seems valid

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Executes massive DNS lookups (> 100)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

svchost.exe (PID: 4224 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

nnzZhhVIqM.exe (PID: 2940 cmdline: "C:\Users\user\Desktop\nnzZhhVIqM.exe" MD5: D32FB5A87134EE848EC6FC2C081C333E)

jbmx3cphxnwpllpjrowiz.exe (PID: 1264 cmdline: "C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe" MD5: D32FB5A87134EE848EC6FC2C081C333E)

ovkmkkgit.exe (PID: 4224 cmdline: "C:\depbjdo\ovkmkkgit.exe" MD5: D32FB5A87134EE848EC6FC2C081C333E)

SgrmBroker.exe (PID: 5296 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 5500 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5140 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2552 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 2092 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 4240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7160 cmdline: C:\Windows\system32\svchost.exe -k LocalService -s W32Time MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

ovkmkkgit.exe (PID: 5932 cmdline: C:\depbjdo\ovkmkkgit.exe MD5: D32FB5A87134EE848EC6FC2C081C333E)

ktwsjztevxgl.exe (PID: 4908 cmdline: n3eh13quo7ee "c:\depbjdo\ovkmkkgit.exe" MD5: D32FB5A87134EE848EC6FC2C081C333E)

ovkmkkgit.exe (PID: 5580 cmdline: "c:\depbjdo\ovkmkkgit.exe" MD5: D32FB5A87134EE848EC6FC2C081C333E)

ktwsjztevxgl.exe (PID: 6492 cmdline: n3eh13quo7ee "c:\depbjdo\ovkmkkgit.exe" MD5: D32FB5A87134EE848EC6FC2C081C333E)

ovkmkkgit.exe (PID: 5920 cmdline: "c:\depbjdo\ovkmkkgit.exe" MD5: D32FB5A87134EE848EC6FC2C081C333E)

ktwsjztevxgl.exe (PID: 2796 cmdline: n3eh13quo7ee "c:\depbjdo\ovkmkkgit.exe" MD5: D32FB5A87134EE848EC6FC2C081C333E)

cleanup

Sigma Signatures

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 4224, ProcessName: svchost.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T15:45:46.264578+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.7	49747	TCP
2024-11-07T15:46:28.077948+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.7	59181	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T15:45:44.860541+0100	2018141	1	A Network Trojan was detected	18.143.155.63	80	192.168.2.7	49741	TCP
2024-11-07T15:45:47.796098+0100	2018141	1	A Network Trojan was detected	54.244.188.177	80	192.168.2.7	49766	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T15:45:44.860541+0100	2037771	1	A Network Trojan was detected	18.143.155.63	80	192.168.2.7	49741	TCP
2024-11-07T15:45:47.796098+0100	2037771	1	A Network Trojan was detected	54.244.188.177	80	192.168.2.7	49766	TCP

ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T15:45:45.985542+0100	2018316	1	A Network Trojan was detected	1.1.1.1	53	192.168.2.7	59618	UDP
2024-11-07T15:47:39.292296+0100	2018316	1	A Network Trojan was detected	1.1.1.1	53	192.168.2.7	52514	UDP

ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T15:45:53.555903+0100	2811542	1	A Network Trojan was detected	1.1.1.1	53	192.168.2.7	52353	UDP
2024-11-07T15:48:23.922912+0100	2811542	1	A Network Trojan was detected	1.1.1.1	53	192.168.2.7	61961	UDP
2024-11-07T15:48:32.910412+0100	2811542	1	A Network Trojan was detected	1.1.1.1	53	192.168.2.7	54726	UDP

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T15:45:44.491463+0100	2815568	1	A Network Trojan was detected	192.168.2.7	49741	18.143.155.63	80	TCP
2024-11-07T15:47:21.074276+0100	2815568	1	A Network Trojan was detected	192.168.2.7	59196	199.59.243.227	80	TCP
2024-11-07T15:48:57.445301+0100	2815568	1	A Network Trojan was detected	192.168.2.7	53566	18.143.155.63	80	TCP

ETPRO MALWARE W32/Bayrob Attempted Checkin 2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T15:45:44.491463+0100	2820680	1	Malware Command and Control Activity Detected	192.168.2.7	49741	18.143.155.63	80	TCP
2024-11-07T15:47:21.074276+0100	2820680	1	Malware Command and Control Activity Detected	192.168.2.7	59196	199.59.243.227	80	TCP
2024-11-07T15:48:57.445301+0100	2820680	1	Malware Command and Control Activity Detected	192.168.2.7	53566	18.143.155.63	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: nnzZhhVIqM.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\depbjdo\ktwsjztevxgl.exe	Avira: detection malicious, Label: TR/Taranis.1056
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Avira: detection malicious, Label: TR/Taranis.1056
Source: C:\depbjdo\ovkmkkgit.exe	Avira: detection malicious, Label: TR/Taranis.1056

Multi AV Scanner detection for dropped file

Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	ReversingLabs: Detection: 92%
Source: C:\depbjdo\ktwsjztevxgl.exe	ReversingLabs: Detection: 92%
Source: C:\depbjdo\ovkmkkgit.exe	ReversingLabs: Detection: 92%

Multi AV Scanner detection for submitted file

Source: nnzZhhVIqM.exe

ReversingLabs: Detection: 92%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\depbjdo\ktwsjztevxgl.exe	Joe Sandbox ML: detected
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Joe Sandbox ML: detected
Source: C:\depbjdo\ovkmkkgit.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: nnzZhhVIqM.exe

Joe Sandbox ML: detected

Source: nnzZhhVIqM.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: nnzZhhVIqM.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Code function: 1_2_005CDB90 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_005CDB90
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Code function: 7_2_00D5DB90 Sleep,FindFirstFileA,FindNextFileA,FindClose,	7_2_00D5DB90
Source: C:\depbjdo\ovkmkkgit.exe	Code function: 9_2_003FDB90 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	9_2_003FDB90
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 10_2_0048DB90 Sleep,FindFirstFileA,FindNextFileA,FindClose,	10_2_0048DB90
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 16_2_0026DB90 Sleep,FindFirstFileA,FindNextFileA,FindClose,	16_2_0026DB90
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 20_2_003DDB90 Sleep,FindFirstFileA,FindNextFileA,FindClose,	20_2_003DDB90

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2820680 - Severity 1 - ETPRO MALWARE W32/Bayrob Attempted Checkin 2 : 192.168.2.7:49741 -> 18.143.155.63:80
Source: Network traffic	Suricata IDS: 2820680 - Severity 1 - ETPRO MALWARE W32/Bayrob Attempted Checkin 2 : 192.168.2.7:59196 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2820680 - Severity 1 - ETPRO MALWARE W32/Bayrob Attempted Checkin 2 : 192.168.2.7:53566 -> 18.143.155.63:80

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: heavydivide.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreemanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreeready.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultbrown.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessaryappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenbottle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessaryinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreeexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavendivide.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requirebusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnmanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderbottle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardready.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orderappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returndivide.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heaveninside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glasspeople.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentleappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassmanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orderexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultmanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerbrown.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerdaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavyexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantmanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavybusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousmanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessarymanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leadermanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessarybusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerready.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardpeople.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlestream.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavystream.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavyanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requireinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessaryexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returninstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requirebright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requiremanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreeanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requireappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultready.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreebright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orderinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orderinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlenothing.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answeranother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavyinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardmanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orderbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessaryinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousnothing.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlebusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardready.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heaveninstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentleinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answermanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreebrown.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlebottle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardbrown.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavymanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnnothing.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavynothing.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavyappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentleinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreebusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessarybright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ordermanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requireanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderdivide.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessaryanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerpeople.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousbottle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orderbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenstream.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavybottle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leadernothing.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavybright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavyinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousdivide.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreeappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requireinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlebright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassbrown.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreepeople.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returninside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentleexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requireexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassready.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavennothing.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwarddaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardmanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnstream.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreeinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassdaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenmanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreeinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentledivide.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orderanother.net replaycode: Name error (3)

Source: unknown

Network traffic detected: DNS query count 171

Source: global traffic

DNS traffic detected: number of DNS queries: 171

Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: variousstream.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnbottle.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: gentleanother.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: glassbright.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: pleasantinstead.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: degreedaughter.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: variousstream.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnbottle.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: gentleanother.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: glassbright.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: pleasantinstead.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: degreedaughter.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: variousstream.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnbottle.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: gentleanother.net

Source: Joe Sandbox View	IP Address: 18.143.155.63 18.143.155.63
Source: Joe Sandbox View	IP Address: 85.214.228.140 85.214.228.140
Source: Joe Sandbox View	IP Address: 199.59.243.227 199.59.243.227

Source: Network traffic	Suricata IDS: 2815568 - Severity 1 - ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort : 192.168.2.7:49741 -> 18.143.155.63:80
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.143.155.63:80 -> 192.168.2.7:49741
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.143.155.63:80 -> 192.168.2.7:49741
Source: Network traffic	Suricata IDS: 2811542 - Severity 1 - ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net) : 1.1.1.1:53 -> 192.168.2.7:52353
Source: Network traffic	Suricata IDS: 2018316 - Severity 1 - ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses : 1.1.1.1:53 -> 192.168.2.7:59618
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 54.244.188.177:80 -> 192.168.2.7:49766
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 54.244.188.177:80 -> 192.168.2.7:49766
Source: Network traffic	Suricata IDS: 2815568 - Severity 1 - ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort : 192.168.2.7:59196 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2018316 - Severity 1 - ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses : 1.1.1.1:53 -> 192.168.2.7:52514
Source: Network traffic	Suricata IDS: 2811542 - Severity 1 - ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net) : 1.1.1.1:53 -> 192.168.2.7:61961
Source: Network traffic	Suricata IDS: 2811542 - Severity 1 - ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net) : 1.1.1.1:53 -> 192.168.2.7:54726
Source: Network traffic	Suricata IDS: 2815568 - Severity 1 - ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort : 192.168.2.7:53566 -> 18.143.155.63:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.7:49747
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.7:59181

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe

Code function: 1_2_005AD0F0 socket,setsockopt,gethostbyname,inet_ntoa,inet_addr,htons,connect,send,recv,closesocket,

1_2_005AD0F0

Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: variousstream.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnbottle.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: gentleanother.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: glassbright.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: pleasantinstead.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: degreedaughter.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: variousstream.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnbottle.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: gentleanother.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: glassbright.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: pleasantinstead.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: degreedaughter.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: variousstream.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnbottle.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: gentleanother.net

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: heavenstream.net
Source: global traffic	DNS traffic detected: DNS query: leadernothing.net
Source: global traffic	DNS traffic detected: DNS query: heavennothing.net
Source: global traffic	DNS traffic detected: DNS query: leaderbottle.net
Source: global traffic	DNS traffic detected: DNS query: heavenbottle.net
Source: global traffic	DNS traffic detected: DNS query: leaderdivide.net
Source: global traffic	DNS traffic detected: DNS query: heavendivide.net
Source: global traffic	DNS traffic detected: DNS query: heavystream.net
Source: global traffic	DNS traffic detected: DNS query: gentlestream.net
Source: global traffic	DNS traffic detected: DNS query: heavynothing.net
Source: global traffic	DNS traffic detected: DNS query: gentlenothing.net
Source: global traffic	DNS traffic detected: DNS query: heavybottle.net
Source: global traffic	DNS traffic detected: DNS query: gentlebottle.net
Source: global traffic	DNS traffic detected: DNS query: heavydivide.net
Source: global traffic	DNS traffic detected: DNS query: gentledivide.net
Source: global traffic	DNS traffic detected: DNS query: variousstream.net
Source: global traffic	DNS traffic detected: DNS query: returnstream.net
Source: global traffic	DNS traffic detected: DNS query: variousnothing.net
Source: global traffic	DNS traffic detected: DNS query: returnnothing.net
Source: global traffic	DNS traffic detected: DNS query: variousbottle.net
Source: global traffic	DNS traffic detected: DNS query: returnbottle.net
Source: global traffic	DNS traffic detected: DNS query: variousdivide.net
Source: global traffic	DNS traffic detected: DNS query: returndivide.net
Source: global traffic	DNS traffic detected: DNS query: degreemanner.net
Source: global traffic	DNS traffic detected: DNS query: forwardmanner.net
Source: global traffic	DNS traffic detected: DNS query: degreeanother.net
Source: global traffic	DNS traffic detected: DNS query: forwardanother.net
Source: global traffic	DNS traffic detected: DNS query: degreebusiness.net
Source: global traffic	DNS traffic detected: DNS query: forwardbusiness.net
Source: global traffic	DNS traffic detected: DNS query: degreeappear.net
Source: global traffic	DNS traffic detected: DNS query: forwardappear.net
Source: global traffic	DNS traffic detected: DNS query: answermanner.net
Source: global traffic	DNS traffic detected: DNS query: glassmanner.net
Source: global traffic	DNS traffic detected: DNS query: answeranother.net
Source: global traffic	DNS traffic detected: DNS query: glassanother.net
Source: global traffic	DNS traffic detected: DNS query: answerbusiness.net
Source: global traffic	DNS traffic detected: DNS query: glassbusiness.net
Source: global traffic	DNS traffic detected: DNS query: answerappear.net
Source: global traffic	DNS traffic detected: DNS query: glassappear.net
Source: global traffic	DNS traffic detected: DNS query: difficultmanner.net
Source: global traffic	DNS traffic detected: DNS query: heardmanner.net
Source: global traffic	DNS traffic detected: DNS query: difficultanother.net
Source: global traffic	DNS traffic detected: DNS query: heardanother.net
Source: global traffic	DNS traffic detected: DNS query: difficultbusiness.net
Source: global traffic	DNS traffic detected: DNS query: heardbusiness.net
Source: global traffic	DNS traffic detected: DNS query: difficultappear.net
Source: global traffic	DNS traffic detected: DNS query: heardappear.net
Source: global traffic	DNS traffic detected: DNS query: pleasantmanner.net
Source: global traffic	DNS traffic detected: DNS query: necessarymanner.net
Source: global traffic	DNS traffic detected: DNS query: pleasantanother.net
Source: global traffic	DNS traffic detected: DNS query: necessaryanother.net
Source: global traffic	DNS traffic detected: DNS query: pleasantbusiness.net
Source: global traffic	DNS traffic detected: DNS query: necessarybusiness.net
Source: global traffic	DNS traffic detected: DNS query: pleasantappear.net
Source: global traffic	DNS traffic detected: DNS query: necessaryappear.net
Source: global traffic	DNS traffic detected: DNS query: ordermanner.net
Source: global traffic	DNS traffic detected: DNS query: requiremanner.net
Source: global traffic	DNS traffic detected: DNS query: orderanother.net
Source: global traffic	DNS traffic detected: DNS query: requireanother.net
Source: global traffic	DNS traffic detected: DNS query: orderbusiness.net
Source: global traffic	DNS traffic detected: DNS query: requirebusiness.net
Source: global traffic	DNS traffic detected: DNS query: orderappear.net
Source: global traffic	DNS traffic detected: DNS query: requireappear.net
Source: global traffic	DNS traffic detected: DNS query: leadermanner.net
Source: global traffic	DNS traffic detected: DNS query: heavenmanner.net
Source: global traffic	DNS traffic detected: DNS query: leaderanother.net
Source: global traffic	DNS traffic detected: DNS query: heavenanother.net
Source: global traffic	DNS traffic detected: DNS query: leaderbusiness.net
Source: global traffic	DNS traffic detected: DNS query: heavenbusiness.net
Source: global traffic	DNS traffic detected: DNS query: leaderappear.net
Source: global traffic	DNS traffic detected: DNS query: heavenappear.net
Source: global traffic	DNS traffic detected: DNS query: heavymanner.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanner.net
Source: global traffic	DNS traffic detected: DNS query: heavyanother.net
Source: global traffic	DNS traffic detected: DNS query: gentleanother.net
Source: global traffic	DNS traffic detected: DNS query: heavybusiness.net
Source: global traffic	DNS traffic detected: DNS query: gentlebusiness.net
Source: global traffic	DNS traffic detected: DNS query: heavyappear.net
Source: global traffic	DNS traffic detected: DNS query: gentleappear.net
Source: global traffic	DNS traffic detected: DNS query: variousmanner.net
Source: global traffic	DNS traffic detected: DNS query: returnmanner.net
Source: global traffic	DNS traffic detected: DNS query: variousanother.net
Source: global traffic	DNS traffic detected: DNS query: returnanother.net
Source: global traffic	DNS traffic detected: DNS query: variousbusiness.net
Source: global traffic	DNS traffic detected: DNS query: returnbusiness.net
Source: global traffic	DNS traffic detected: DNS query: variousappear.net
Source: global traffic	DNS traffic detected: DNS query: returnappear.net
Source: global traffic	DNS traffic detected: DNS query: degreeinstead.net
Source: global traffic	DNS traffic detected: DNS query: forwardinstead.net
Source: global traffic	DNS traffic detected: DNS query: degreeexplain.net
Source: global traffic	DNS traffic detected: DNS query: forwardexplain.net
Source: global traffic	DNS traffic detected: DNS query: degreebright.net
Source: global traffic	DNS traffic detected: DNS query: forwardbright.net
Source: global traffic	DNS traffic detected: DNS query: degreeinside.net
Source: global traffic	DNS traffic detected: DNS query: forwardinside.net
Source: global traffic	DNS traffic detected: DNS query: answerinstead.net
Source: global traffic	DNS traffic detected: DNS query: glassinstead.net
Source: global traffic	DNS traffic detected: DNS query: answerexplain.net
Source: global traffic	DNS traffic detected: DNS query: glassexplain.net

Source: svchost.exe, 00000000.00000002.1367403570.0000015B53613000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000000.00000003.1366782385.0000015B53642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366029892.0000015B53671000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367572572.0000015B53673000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367540594.0000015B53666000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367476162.0000015B53643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366282076.0000015B53665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366640003.0000015B5365D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000000.00000003.1366029892.0000015B53671000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367572572.0000015B53673000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000000.00000002.1367557188.0000015B5366B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000000.00000003.1365924899.0000015B53678000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367588416.0000015B5367A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000000.00000003.1366782385.0000015B53642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367476162.0000015B53643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000000.00000002.1367440782.0000015B5362B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367540594.0000015B53666000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366282076.0000015B53665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366640003.0000015B5365D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000000.00000002.1367440782.0000015B5362B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366237476.0000015B5366A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367557188.0000015B5366B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000000.00000002.1367440782.0000015B5362B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367540594.0000015B53666000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366282076.0000015B53665000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000000.00000003.1366782385.0000015B53642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367476162.0000015B53643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000000.00000002.1367540594.0000015B53666000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366282076.0000015B53665000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000000.00000003.1366942828.0000015B53632000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367540594.0000015B53666000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366282076.0000015B53665000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000000.00000002.1367476162.0000015B53643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000000.00000002.1367540594.0000015B53666000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366282076.0000015B53665000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000000.00000003.1366782385.0000015B53642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367440782.0000015B5362B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367476162.0000015B53643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000000.00000002.1367440782.0000015B5362B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366237476.0000015B5366A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367557188.0000015B5366B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000000.00000003.1366782385.0000015B53642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000000.00000003.1366724561.0000015B5364C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367476162.0000015B53643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000000.00000003.1366861781.0000015B5363F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366724561.0000015B5364C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367476162.0000015B53643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000000.00000003.1366782385.0000015B53642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367440782.0000015B5362B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367476162.0000015B53643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: ovkmkkgit.exe, 00000009.00000002.2297852840.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp, ovkmkkgit.exe, 0000000F.00000002.3191990543.0000000000B40000.00000004.00000020.00020000.00000000.sdmp, ovkmkkgit.exe, 00000013.00000002.3732602901.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	File created: C:\Windows\depbjdo\	Jump to behavior
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	File created: C:\Windows\depbjdo\ihbjigr37cyf	Jump to behavior
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	File created: C:\Windows\depbjdo\ihbjigr37cyf	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	File created: C:\Windows\depbjdo\ihbjigr37cyf	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe	File created: C:\Windows\depbjdo\ihbjigr37cyf	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	File created: C:\Windows\depbjdo\ihbjigr37cyf	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	File created: C:\Windows\depbjdo\ihbjigr37cyf	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe	File created: C:\Windows\depbjdo\ihbjigr37cyf	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	File created: C:\Windows\depbjdo\ihbjigr37cyf	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe	File created: C:\Windows\depbjdo\ihbjigr37cyf	Jump to behavior

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe

File deleted: C:\Windows\depbjdo\ihbjigr37cyf

Jump to behavior

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Code function: 1_2_005C5760	1_2_005C5760
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Code function: 7_2_00D55760	7_2_00D55760
Source: C:\depbjdo\ovkmkkgit.exe	Code function: 9_2_003F5760	9_2_003F5760
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 10_2_00485760	10_2_00485760
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 16_2_00265760	16_2_00265760
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 20_2_003D5760	20_2_003D5760

Source: nnzZhhVIqM.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@25/6@425/4

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Code function: CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	1_2_005D0FE0
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	7_2_00D60FE0
Source: C:\depbjdo\ovkmkkgit.exe	Code function: CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	9_2_00400FE0
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	10_2_00490FE0
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	16_2_00270FE0
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	20_2_003E0FE0

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe

Code function: 1_2_005C9460 CreateToolhelp32Snapshot,OpenProcess,CloseHandle,Process32Next,CloseHandle,

1_2_005C9460

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe

Code function: 1_2_005E19A0 StartServiceCtrlDispatcherA,

1_2_005E19A0

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Code function: 1_2_005E19A0 StartServiceCtrlDispatcherA,	1_2_005E19A0
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Code function: 7_2_00D719A0 StartServiceCtrlDispatcherA,	7_2_00D719A0
Source: C:\depbjdo\ovkmkkgit.exe	Code function: 9_2_004119A0 StartServiceCtrlDispatcherA,	9_2_004119A0
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 10_2_004A19A0 StartServiceCtrlDispatcherA,	10_2_004A19A0
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 16_2_002819A0 StartServiceCtrlDispatcherA,	16_2_002819A0
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 20_2_003F19A0 StartServiceCtrlDispatcherA,	20_2_003F19A0

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4240:120:WilError_03
Source: C:\depbjdo\ktwsjztevxgl.exe	Mutant created: NULL

Source: C:\Program Files\Windows Defender\MpCmdRun.exe

File created: C:\Windows\SERVIC~1\LOCALS~1\AppData\Local\Temp\MpCmdRun.log

Jump to behavior

Source: nnzZhhVIqM.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: nnzZhhVIqM.exe

ReversingLabs: Detection: 92%

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe

File read: C:\Users\user\Desktop\nnzZhhVIqM.exe

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Users\user\Desktop\nnzZhhVIqM.exe "C:\Users\user\Desktop\nnzZhhVIqM.exe"
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Process created: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe "C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Source: unknown	Process created: C:\depbjdo\ovkmkkgit.exe C:\depbjdo\ovkmkkgit.exe
Source: C:\depbjdo\ovkmkkgit.exe	Process created: C:\depbjdo\ktwsjztevxgl.exe n3eh13quo7ee "c:\depbjdo\ovkmkkgit.exe"
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Process created: C:\depbjdo\ovkmkkgit.exe "C:\depbjdo\ovkmkkgit.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\depbjdo\ktwsjztevxgl.exe	Process created: C:\depbjdo\ovkmkkgit.exe "c:\depbjdo\ovkmkkgit.exe"
Source: C:\depbjdo\ovkmkkgit.exe	Process created: C:\depbjdo\ktwsjztevxgl.exe n3eh13quo7ee "c:\depbjdo\ovkmkkgit.exe"
Source: C:\depbjdo\ktwsjztevxgl.exe	Process created: C:\depbjdo\ovkmkkgit.exe "c:\depbjdo\ovkmkkgit.exe"
Source: C:\depbjdo\ovkmkkgit.exe	Process created: C:\depbjdo\ktwsjztevxgl.exe n3eh13quo7ee "c:\depbjdo\ovkmkkgit.exe"
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Process created: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe "C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Process created: C:\depbjdo\ovkmkkgit.exe "C:\depbjdo\ovkmkkgit.exe"	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Process created: C:\depbjdo\ktwsjztevxgl.exe n3eh13quo7ee "c:\depbjdo\ovkmkkgit.exe"	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe	Process created: C:\depbjdo\ovkmkkgit.exe "c:\depbjdo\ovkmkkgit.exe"	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Process created: C:\depbjdo\ktwsjztevxgl.exe n3eh13quo7ee "c:\depbjdo\ovkmkkgit.exe"	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe	Process created: C:\depbjdo\ovkmkkgit.exe "c:\depbjdo\ovkmkkgit.exe"	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Process created: C:\depbjdo\ktwsjztevxgl.exe n3eh13quo7ee "c:\depbjdo\ovkmkkgit.exe"	Jump to behavior

Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: w32time.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: nnzZhhVIqM.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe

Code function: 1_2_005BCB50 LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,HeapFree,HeapAlloc,FreeLibrary,HeapFree,FreeLibrary,

1_2_005BCB50

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Code function: 1_2_005A8409 push 2B005EE5h; ret	1_2_005A840E
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Code function: 1_2_005E2380 push eax; ret	1_2_005E2394
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Code function: 1_2_005E2380 push eax; ret	1_2_005E23BC
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Code function: 7_2_00D38409 push 2B00D7E5h; ret	7_2_00D3840E
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Code function: 7_2_00D72380 push eax; ret	7_2_00D72394
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Code function: 7_2_00D72380 push eax; ret	7_2_00D723BC
Source: C:\depbjdo\ovkmkkgit.exe	Code function: 9_2_003D8409 push 2B0041E5h; ret	9_2_003D840E
Source: C:\depbjdo\ovkmkkgit.exe	Code function: 9_2_00412380 push eax; ret	9_2_00412394
Source: C:\depbjdo\ovkmkkgit.exe	Code function: 9_2_00412380 push eax; ret	9_2_004123BC
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 10_2_004A2380 push eax; ret	10_2_004A2394
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 10_2_004A2380 push eax; ret	10_2_004A23BC
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 16_2_00248409 push 2B0028E5h; ret	16_2_0024840E
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 16_2_00282380 push eax; ret	16_2_00282394
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 16_2_00282380 push eax; ret	16_2_002823BC
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 20_2_003B8409 push 2B003FE5h; ret	20_2_003B840E
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 20_2_003F2380 push eax; ret	20_2_003F2394
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 20_2_003F2380 push eax; ret	20_2_003F23BC

Source: C:\depbjdo\ovkmkkgit.exe	File created: C:\depbjdo\ktwsjztevxgl.exe	Jump to dropped file
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	File created: C:\depbjdo\ovkmkkgit.exe	Jump to dropped file
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	File created: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Jump to dropped file

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Config

Jump to behavior

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe

Code function: 1_2_005E19A0 StartServiceCtrlDispatcherA,

1_2_005E19A0

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\depbjdo\ktwsjztevxgl.exe

Stalling execution: Execution stalls by calling Sleep

graph_20-6983

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Code function: EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	1_2_005BE380
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Code function: EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	7_2_00D4E380
Source: C:\depbjdo\ovkmkkgit.exe	Code function: EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	9_2_003EE380
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	10_2_0047E380
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	16_2_0025E380
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	20_2_003CE380

Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Code function: LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,FreeLibrary,		7_2_00D4CB50
Source: C:\depbjdo\ovkmkkgit.exe	Code function: LoadLibraryA,GetProcAddress,FreeLibrary,RtlAllocateHeap,FreeLibrary,GetAdaptersInfo,HeapFree,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,FreeLibrary,		9_2_003ECB50

Source: C:\depbjdo\ktwsjztevxgl.exe	Window / User API: threadDelayed 814	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe	Window / User API: threadDelayed 1045	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Window / User API: threadDelayed 1347	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe	Window / User API: threadDelayed 758	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe	Window / User API: threadDelayed 1109	Jump to behavior

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_1-7385
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_7-7551
Source: C:\depbjdo\ktwsjztevxgl.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_10-7508

Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Evasive API call chain: GetSystemTime,DecisionNodes	graph_7-7272
Source: C:\depbjdo\ktwsjztevxgl.exe	Evasive API call chain: GetSystemTime,DecisionNodes	graph_10-7054
Source: C:\depbjdo\ovkmkkgit.exe	Evasive API call chain: GetSystemTime,DecisionNodes	graph_9-6671
Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Evasive API call chain: GetSystemTime,DecisionNodes	graph_1-6996

Source: C:\depbjdo\ovkmkkgit.exe TID: 4188	Thread sleep time: -42218s >= -30000s	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe TID: 5064	Thread sleep count: 814 > 30	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe TID: 5064	Thread sleep time: -814000s >= -30000s	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe TID: 5064	Thread sleep count: 1045 > 30	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe TID: 5064	Thread sleep time: -1045000s >= -30000s	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe TID: 5188	Thread sleep count: 1347 > 30	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe TID: 5188	Thread sleep time: -67350000s >= -30000s	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe TID: 5188	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe TID: 4504	Thread sleep count: 758 > 30	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe TID: 4504	Thread sleep time: -758000s >= -30000s	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe TID: 4504	Thread sleep count: 1109 > 30	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe TID: 4504	Thread sleep time: -1109000s >= -30000s	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe TID: 5260	Thread sleep count: 347 > 30	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe TID: 5260	Thread sleep time: -17350000s >= -30000s	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe TID: 5260	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe TID: 6908	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\depbjdo\ktwsjztevxgl.exe TID: 6908	Thread sleep time: -43000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\depbjdo\ovkmkkgit.exe	Last function: Thread delayed
Source: C:\depbjdo\ovkmkkgit.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\depbjdo\ovkmkkgit.exe	Last function: Thread delayed
Source: C:\depbjdo\ovkmkkgit.exe	Last function: Thread delayed
Source: C:\depbjdo\ovkmkkgit.exe	Last function: Thread delayed
Source: C:\depbjdo\ovkmkkgit.exe	Last function: Thread delayed
Source: C:\depbjdo\ktwsjztevxgl.exe	Last function: Thread delayed
Source: C:\depbjdo\ktwsjztevxgl.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe	Code function: 1_2_005CDB90 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_005CDB90
Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	Code function: 7_2_00D5DB90 Sleep,FindFirstFileA,FindNextFileA,FindClose,	7_2_00D5DB90
Source: C:\depbjdo\ovkmkkgit.exe	Code function: 9_2_003FDB90 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	9_2_003FDB90
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 10_2_0048DB90 Sleep,FindFirstFileA,FindNextFileA,FindClose,	10_2_0048DB90
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 16_2_0026DB90 Sleep,FindFirstFileA,FindNextFileA,FindClose,	16_2_0026DB90
Source: C:\depbjdo\ktwsjztevxgl.exe	Code function: 20_2_003DDB90 Sleep,FindFirstFileA,FindNextFileA,FindClose,	20_2_003DDB90

Source: C:\depbjdo\ovkmkkgit.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\depbjdo\ovkmkkgit.exe	Thread delayed: delay time: 50000	Jump to behavior

Source: svchost.exe, 00000005.00000002.3732189486.000001E64E64B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000005.00000002.3732347770.000001E64E67F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000005.00000002.3732347770.000001E64E664000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000p
Source: svchost.exe, 00000005.00000002.3731814401.000001E64E602000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: svchost.exe, 00000005.00000002.3732347770.000001E64E664000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: svchost.exe, 00000005.00000002.3732347770.000001E64E664000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: svchost.exe, 00000005.00000002.3732056981.000001E64E62B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000005.00000002.3732642663.000001E64E702000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: jbmx3cphxnwpllpjrowiz.exe, 00000007.00000002.1402783754.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3732254281.000001F60702B000.00000004.00000020.00020000.00000000.sdmp, ovkmkkgit.exe, 0000000F.00000002.3191990543.0000000000B40000.00000004.00000020.00020000.00000000.sdmp, ovkmkkgit.exe, 00000013.00000002.3732602901.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: ovkmkkgit.exe, 00000009.00000002.2297852840.0000000000A0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllD

Source: C:\depbjdo\ktwsjztevxgl.exe	API call chain: ExitProcess graph end node	graph_16-8400
Source: C:\depbjdo\ktwsjztevxgl.exe	API call chain: ExitProcess graph end node	graph_16-7481
Source: C:\depbjdo\ktwsjztevxgl.exe	API call chain: ExitProcess graph end node	graph_16-8378
Source: C:\depbjdo\ktwsjztevxgl.exe	API call chain: ExitProcess graph end node	graph_16-8341
Source: C:\depbjdo\ktwsjztevxgl.exe	API call chain: ExitProcess graph end node	graph_16-8354

Source: C:\depbjdo\ovkmkkgit.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe

Code function: 1_2_005BCB50 LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,HeapFree,HeapAlloc,FreeLibrary,HeapFree,FreeLibrary,

1_2_005BCB50

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe

Code function: 1_2_005CFB40 GetProcessHeap,RtlFreeHeap,

1_2_005CFB40

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe

Code function: 1_2_005B0700 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

1_2_005B0700

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\nnzZhhVIqM.exe

Code function: 1_2_005AC3D0 GetSystemTime,SystemTimeToFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

1_2_005AC3D0

Source: C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE

Jump to behavior

Source: svchost.exe, 00000006.00000002.3733218882.0000020B15D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000006.00000002.3733218882.0000020B15D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	14 Windows Service	14 Windows Service	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Service Execution	1 DLL Side-Loading	1 Process Injection	1 Disable or Modify Tools	LSASS Memory	151 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Native API	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Service Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	24 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
nnzZhhVIqM.exe	92%	ReversingLabs	Win32.Spyware.Nivdort
nnzZhhVIqM.exe	100%	Avira	TR/Taranis.1056
nnzZhhVIqM.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\depbjdo\ktwsjztevxgl.exe	100%	Avira	TR/Taranis.1056
C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	100%	Avira	TR/Taranis.1056
C:\depbjdo\ovkmkkgit.exe	100%	Avira	TR/Taranis.1056
C:\depbjdo\ktwsjztevxgl.exe	100%	Joe Sandbox ML
C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	100%	Joe Sandbox ML
C:\depbjdo\ovkmkkgit.exe	100%	Joe Sandbox ML
C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe	92%	ReversingLabs	Win32.Spyware.Nivdort
C:\depbjdo\ktwsjztevxgl.exe	92%	ReversingLabs	Win32.Spyware.Nivdort
C:\depbjdo\ovkmkkgit.exe	92%	ReversingLabs	Win32.Spyware.Nivdort

Name	IP	Active	Malicious	Reputation
degreedaughter.net	85.214.228.140	true	false	high
7450.bodis.com	199.59.243.227	true	false	high
gentleanother.net	54.244.188.177	true	false	high
returnbottle.net	18.143.155.63	true	false	high
pleasantinstead.net	18.143.155.63	true	false	high
forwardpeople.net	unknown	unknown	true	unknown
degreeanother.net	unknown	unknown	true	unknown
degreeexplain.net	unknown	unknown	true	unknown
heaveninside.net	unknown	unknown	true	unknown
answerappear.net	unknown	unknown	true	unknown
heavybusiness.net	unknown	unknown	true	unknown
pleasantinside.net	unknown	unknown	true	unknown
requirebusiness.net	unknown	unknown	true	unknown
forwardinside.net	unknown	unknown	true	unknown
glassmanner.net	unknown	unknown	true	unknown
answerexplain.net	unknown	unknown	true	unknown
orderinside.net	unknown	unknown	true	unknown
variousappear.net	unknown	unknown	true	unknown
returnbright.net	unknown	unknown	true	unknown
difficultanother.net	unknown	unknown	true	unknown
heavyinside.net	unknown	unknown	true	unknown
forwardready.net	unknown	unknown	true	unknown
glassdaughter.net	unknown	unknown	true	unknown
necessarymanner.net	unknown	unknown	true	unknown
leadernothing.net	unknown	unknown	true	unknown
answeranother.net	unknown	unknown	true	unknown
leadermanner.net	unknown	unknown	true	unknown
heavybottle.net	unknown	unknown	true	unknown
heavenbright.net	unknown	unknown	true	unknown
heavydivide.net	unknown	unknown	true	unknown
degreebrown.net	unknown	unknown	true	unknown
gentleinstead.net	unknown	unknown	true	unknown
glassanother.net	unknown	unknown	true	unknown
heavenanother.net	unknown	unknown	true	unknown
difficultmanner.net	unknown	unknown	true	unknown
glassexplain.net	unknown	unknown	true	unknown
requireinside.net	unknown	unknown	true	unknown
heavenexplain.net	unknown	unknown	true	unknown
forwardbusiness.net	unknown	unknown	true	unknown
difficultexplain.net	unknown	unknown	true	unknown
gentleappear.net	unknown	unknown	true	unknown
pleasantbright.net	unknown	unknown	true	unknown
returnexplain.net	unknown	unknown	true	unknown
gentlemanner.net	unknown	unknown	true	unknown
answerdaughter.net	unknown	unknown	true	unknown
heardinside.net	unknown	unknown	true	unknown
requiremanner.net	unknown	unknown	true	unknown
gentleexplain.net	unknown	unknown	true	unknown
glassappear.net	unknown	unknown	true	unknown
necessaryanother.net	unknown	unknown	true	unknown
glassinside.net	unknown	unknown	true	unknown
difficultbright.net	unknown	unknown	true	unknown
glasspeople.net	unknown	unknown	true	unknown
requireinstead.net	unknown	unknown	true	unknown
necessaryinside.net	unknown	unknown	true	unknown
returndivide.net	unknown	unknown	true	unknown
heardinstead.net	unknown	unknown	true	unknown
variousbright.net	unknown	unknown	true	unknown
degreebusiness.net	unknown	unknown	true	unknown
answerbusiness.net	unknown	unknown	true	unknown
heavenbusiness.net	unknown	unknown	true	unknown
gentledivide.net	unknown	unknown	true	unknown
variousinstead.net	unknown	unknown	true	unknown
gentlestream.net	unknown	unknown	true	unknown
pleasantmanner.net	unknown	unknown	true	unknown
necessaryappear.net	unknown	unknown	true	unknown
pleasantbusiness.net	unknown	unknown	true	unknown
heardbright.net	unknown	unknown	true	unknown
heavenbottle.net	unknown	unknown	true	unknown
heavynothing.net	unknown	unknown	true	unknown
gentlebusiness.net	unknown	unknown	true	unknown
ordermanner.net	unknown	unknown	true	unknown
leaderbottle.net	unknown	unknown	true	unknown
pleasantanother.net	unknown	unknown	true	unknown
heavyanother.net	unknown	unknown	true	unknown
degreeinstead.net	unknown	unknown	true	unknown
degreepeople.net	unknown	unknown	true	unknown
answerready.net	unknown	unknown	true	unknown
difficultbrown.net	unknown	unknown	true	unknown
answerbright.net	unknown	unknown	true	unknown
heavennothing.net	unknown	unknown	true	unknown
returninside.net	unknown	unknown	true	unknown
forwardbright.net	unknown	unknown	true	unknown
difficultinside.net	unknown	unknown	true	unknown
heavybright.net	unknown	unknown	true	unknown
leaderanother.net	unknown	unknown	true	unknown
returninstead.net	unknown	unknown	true	unknown
difficultinstead.net	unknown	unknown	true	unknown
heavenappear.net	unknown	unknown	true	unknown
answerinside.net	unknown	unknown	true	unknown
degreebright.net	unknown	unknown	true	unknown
forwardbrown.net	unknown	unknown	true	unknown
heavyinstead.net	unknown	unknown	true	unknown
gentleinside.net	unknown	unknown	true	unknown
heardexplain.net	unknown	unknown	true	unknown
heavyappear.net	unknown	unknown	true	unknown
answerpeople.net	unknown	unknown	true	unknown
pleasantexplain.net	unknown	unknown	true	unknown
requireexplain.net	unknown	unknown	true	unknown
orderappear.net	unknown	unknown	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000000.00000002.1367557188.0000015B5366B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000000.00000003.1366782385.0000015B53642000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000000.00000003.1365924899.0000015B53678000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367588416.0000015B5367A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000000.00000002.1367440782.0000015B5362B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366237476.0000015B5366A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367557188.0000015B5366B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000000.00000002.1367440782.0000015B5362B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367540594.0000015B53666000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366282076.0000015B53665000.00000004.00000020.00020000.00000000.sdmp	false	high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000000.00000003.1366861781.0000015B5363F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366724561.0000015B5364C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367476162.0000015B53643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	svchost.exe, 00000000.00000003.1366782385.0000015B53642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367440782.0000015B5362B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367476162.0000015B53643000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000000.00000002.1367540594.0000015B53666000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366282076.0000015B53665000.00000004.00000020.00020000.00000000.sdmp	false	high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000000.00000003.1366724561.0000015B5364C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367476162.0000015B53643000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000000.00000003.1366782385.0000015B53642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366029892.0000015B53671000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367572572.0000015B53673000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367540594.0000015B53666000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367476162.0000015B53643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366282076.0000015B53665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366640003.0000015B5365D000.00000004.00000020.00020000.00000000.sdmp	false	high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000000.00000003.1366782385.0000015B53642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367440782.0000015B5362B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367476162.0000015B53643000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com	ovkmkkgit.exe, 00000009.00000002.2297852840.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp, ovkmkkgit.exe, 0000000F.00000002.3191990543.0000000000B40000.00000004.00000020.00020000.00000000.sdmp, ovkmkkgit.exe, 00000013.00000002.3732602901.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000000.00000002.1367476162.0000015B53643000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000000.00000003.1366782385.0000015B53642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367476162.0000015B53643000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dynamic.t	svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dev.ditu.live.com/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000000.00000003.1366782385.0000015B53642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367476162.0000015B53643000.00000004.00000020.00020000.00000000.sdmp	false	high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=	svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000000.00000002.1367540594.0000015B53666000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366282076.0000015B53665000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.bingmapsportal.com	svchost.exe, 00000000.00000002.1367403570.0000015B53613000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000000.00000003.1366835788.0000015B5365A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367509198.0000015B5365B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000000.00000002.1367440782.0000015B5362B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367540594.0000015B53666000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366282076.0000015B53665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366640003.0000015B5365D000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000000.00000002.1367440782.0000015B5362B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366237476.0000015B5366A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367557188.0000015B5366B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000000.00000003.1366029892.0000015B53671000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367572572.0000015B53673000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000000.00000003.1366942828.0000015B53632000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1367540594.0000015B53666000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1366282076.0000015B53665000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.143.155.63	returnbottle.net	United States	16509	AMAZON-02US	false
85.214.228.140	degreedaughter.net	Germany	6724	STRATOSTRATOAGDE	false
199.59.243.227	7450.bodis.com	United States	395082	BODIS-NJUS	false
54.244.188.177	gentleanother.net	United States	16509	AMAZON-02US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1551212
Start date and time:	2024-11-07 15:44:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nnzZhhVIqM.exe renamed because original name is a hash value
Original Sample Name:	43ee4772f0efa084eeb18e09cf5f6ea2a41a35c32123d8b6c1d41337ae79e699.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@25/6@425/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 65% Number of executed functions: 80 Number of non-executed functions: 67
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 20.101.57.9
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, twc.trafficmanager.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: nnzZhhVIqM.exe

Simulations

Behavior and APIs

Time	Type	Description
11:17:56	API Interceptor	3676x Sleep call for process: ktwsjztevxgl.exe modified
11:18:07	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
11:18:55	API Interceptor	2113x Sleep call for process: ovkmkkgit.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
18.143.155.63	66HKNPT1fl.exe	Get hash	malicious	Unknown	Browse	returnbottle.net/index.php
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	pleasantinstead.net/index.php
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	pleasantinstead.net/index.php
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	returnbottle.net/index.php
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	returnbottle.net/index.php
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	returnbottle.net/index.php
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	returnbottle.net/index.php
85.214.228.140	66HKNPT1fl.exe	Get hash	malicious	Unknown	Browse	degreedaughter.net/index.php
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	degreedaughter.net/index.php
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	degreedaughter.net/index.php
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	degreedaughter.net/index.php
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	degreedaughter.net/index.php
	AENiBH7X1q.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	dlynankz.biz/mfjpaqkdwglsvxqo
	E_dekont.cmd	Get hash	malicious	DBatLoader, Nitol, PureLog Stealer, XWorm	Browse	dlynankz.biz/rgkgvuyxljjatio
	Y2EM7suNV5.exe	Get hash	malicious	MassLogger RAT	Browse	dlynankz.biz/pio
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	dlynankz.biz/og
	SetupRST.exe	Get hash	malicious	Unknown	Browse	dlynankz.biz/u
199.59.243.227	66HKNPT1fl.exe	Get hash	malicious	Unknown	Browse	variousstream.net/index.php
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	glassbright.net/index.php
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	glassbright.net/index.php
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	variousstream.net/index.php
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	variousstream.net/index.php
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	variousstream.net/index.php
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	glassbright.net/index.php
	DHL_doc.exe	Get hash	malicious	FormBook	Browse	www.adsdomain-195.click/xene/
	Wc7HGBGZfE.exe	Get hash	malicious	FormBook	Browse	www.care-for-baby-1107.xyz/ev0s/
	XhAQ0Rk63O.exe	Get hash	malicious	FormBook	Browse	www.migraine-massages.pro/ym43/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gentleanother.net	66HKNPT1fl.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
returnbottle.net	66HKNPT1fl.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
degreedaughter.net	66HKNPT1fl.exe	Get hash	malicious	Unknown	Browse	85.214.228.140
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	85.214.228.140
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	85.214.228.140
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	85.214.228.140
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	85.214.228.140
pleasantinstead.net	66HKNPT1fl.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
7450.bodis.com	66HKNPT1fl.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	25XrVZw56S.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	25XrVZw56S.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	199.59.243.227

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	66HKNPT1fl.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	ch89yHIa99.exe	Get hash	malicious	Ducktail	Browse	13.35.58.111
	ub7ZX9i3k6.exe	Get hash	malicious	Ducktail	Browse	13.35.58.86
	uupEsxBhAI.exe	Get hash	malicious	Ducktail	Browse	13.35.58.78
	yfM67N9UUL.exe	Get hash	malicious	Ducktail	Browse	13.35.58.67
	byte.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	54.112.121.173
STRATOSTRATOAGDE	66HKNPT1fl.exe	Get hash	malicious	Unknown	Browse	85.214.228.140
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	85.214.228.140
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	85.214.228.140
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	85.214.228.140
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	85.214.228.140
	http://googe.de	Get hash	malicious	Unknown	Browse	85.214.62.112
	debug.dbg.elf	Get hash	malicious	Mirai	Browse	85.215.233.6
	DHL_doc.exe	Get hash	malicious	FormBook	Browse	81.169.145.95
	AENiBH7X1q.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	85.214.228.140
	E_dekont.cmd	Get hash	malicious	DBatLoader, Nitol, PureLog Stealer, XWorm	Browse	85.214.228.140
BODIS-NJUS	66HKNPT1fl.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	DHL_doc.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	Wc7HGBGZfE.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	XhAQ0Rk63O.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
AMAZON-02US	66HKNPT1fl.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	ch89yHIa99.exe	Get hash	malicious	Ducktail	Browse	13.35.58.111
	ub7ZX9i3k6.exe	Get hash	malicious	Ducktail	Browse	13.35.58.86
	uupEsxBhAI.exe	Get hash	malicious	Ducktail	Browse	13.35.58.78
	yfM67N9UUL.exe	Get hash	malicious	Ducktail	Browse	13.35.58.67
	byte.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	54.112.121.173

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	2464
Entropy (8bit):	3.2503621086238583
Encrypted:	false
SSDEEP:	24:QOaqdmuF3rHW+kWReHgHttUKlDENh+pyMySn6tUKlDENh+pyMySwwIPVxcwIPVxb:FaqdF7HW+AAHdKoqKFxcxkF9w
MD5:	1D599052E58FFB3DA8E3EB0E1B0CA624
SHA1:	F9FDA76A2841D3538BB0EE433AAF6A26F87872B9
SHA-256:	ED420E44D35047D2787E8A87BAA506240A1A397308BB8485CB8443F97C709FED
SHA-512:	664EFA59B222E89DA5D48B457175F1DC164F0B38C2F92F5E742755B3C31B2ED87D223E2B5D7F058761A61729BEA1238AFD43A86170D6FCDF85E360A29D938BC3
Malicious:	false
Reputation:	low
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. N.o.v. .. 0.7. .. 2.0.2.4. .1.1.:.1.8.:.0.7.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\depbjdo\ihbjigr37cyf

Download File

Process:	C:\Users\user\Desktop\nnzZhhVIqM.exe
File Type:	data
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.8073549220576046
Encrypted:	false
SSDEEP:	3:tE:O
MD5:	8D624DE570C300607DC0FEDA64F61156
SHA1:	A24A374E64CA9683EB98222AEC24D7B6E60A5B29
SHA-256:	D17B955E8CD44844B6735F059C0D9980CA12CB7A9C5BDEB8CBAF9843B094EF59
SHA-512:	C7FB09BA4E2886F2D57FBEC7D689DC724BDA02A8021546653C4DD0E2ECE71595997DFD6AB65A2C8262C43244901A7801DD50EBFCFDA746E634B93144FDAB82B6
Malicious:	false
Reputation:	low
Preview:	..'t.e

C:\depbjdo\ihbjigr37cyf

Download File

Process:	C:\Users\user\Desktop\nnzZhhVIqM.exe
File Type:	data
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.8073549220576046
Encrypted:	false
SSDEEP:	3:tE:O
MD5:	8D624DE570C300607DC0FEDA64F61156
SHA1:	A24A374E64CA9683EB98222AEC24D7B6E60A5B29
SHA-256:	D17B955E8CD44844B6735F059C0D9980CA12CB7A9C5BDEB8CBAF9843B094EF59
SHA-512:	C7FB09BA4E2886F2D57FBEC7D689DC724BDA02A8021546653C4DD0E2ECE71595997DFD6AB65A2C8262C43244901A7801DD50EBFCFDA746E634B93144FDAB82B6
Malicious:	false
Preview:	..'t.e

C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe

Download File

Process:	C:\Users\user\Desktop\nnzZhhVIqM.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	365568
Entropy (8bit):	6.787123565783872
Encrypted:	false
SSDEEP:	6144:mzIYiNqPGyUPtEvT6RTcvmgHqqnAvwALwFHQbQhhKgk4dz+4ee9iZFEAyoeZYQ4:mELqPGjFJgHqqAvZbh34eXmZYQ
MD5:	D32FB5A87134EE848EC6FC2C081C333E
SHA1:	F2D63086FC54C03F5639E996E2E0F1F6A834625B
SHA-256:	43EE4772F0EFA084EEB18E09CF5F6EA2A41A35C32123D8B6C1D41337AE79E699
SHA-512:	F591FC4CA6339B8D8E0743CC44358B2E4672799B669D76F9FC1B27A6E3CF8BF1845628015307C8B95D94B0AC67C5D17A7D6D68AE5816250E70F8A9F000AE7875
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q1..._.._.._..$.._..^..._.B..._..P.._.B..._.Rich.._.................PE..L....&zV.....................................0....@.......................................@.....................................P...............................`....................................................0.. ............................text............................... ..`.rdata......0......................@..@.data...<...........................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\depbjdo\ktwsjztevxgl.exe

Download File

Process:	C:\depbjdo\ovkmkkgit.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	365568
Entropy (8bit):	6.787123565783872
Encrypted:	false
SSDEEP:	6144:mzIYiNqPGyUPtEvT6RTcvmgHqqnAvwALwFHQbQhhKgk4dz+4ee9iZFEAyoeZYQ4:mELqPGjFJgHqqAvZbh34eXmZYQ
MD5:	D32FB5A87134EE848EC6FC2C081C333E
SHA1:	F2D63086FC54C03F5639E996E2E0F1F6A834625B
SHA-256:	43EE4772F0EFA084EEB18E09CF5F6EA2A41A35C32123D8B6C1D41337AE79E699
SHA-512:	F591FC4CA6339B8D8E0743CC44358B2E4672799B669D76F9FC1B27A6E3CF8BF1845628015307C8B95D94B0AC67C5D17A7D6D68AE5816250E70F8A9F000AE7875
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q1..._.._.._..$.._..^..._.B..._..P.._.B..._.Rich.._.................PE..L....&zV.....................................0....@.......................................@.....................................P...............................`....................................................0.. ............................text............................... ..`.rdata......0......................@..@.data...<...........................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\depbjdo\ovkmkkgit.exe

Download File

Process:	C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	365568
Entropy (8bit):	6.787123565783872
Encrypted:	false
SSDEEP:	6144:mzIYiNqPGyUPtEvT6RTcvmgHqqnAvwALwFHQbQhhKgk4dz+4ee9iZFEAyoeZYQ4:mELqPGjFJgHqqAvZbh34eXmZYQ
MD5:	D32FB5A87134EE848EC6FC2C081C333E
SHA1:	F2D63086FC54C03F5639E996E2E0F1F6A834625B
SHA-256:	43EE4772F0EFA084EEB18E09CF5F6EA2A41A35C32123D8B6C1D41337AE79E699
SHA-512:	F591FC4CA6339B8D8E0743CC44358B2E4672799B669D76F9FC1B27A6E3CF8BF1845628015307C8B95D94B0AC67C5D17A7D6D68AE5816250E70F8A9F000AE7875
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q1..._.._.._..$.._..^..._.B..._..P.._.B..._.Rich.._.................PE..L....&zV.....................................0....@.......................................@.....................................P...............................`....................................................0.. ............................text............................... ..`.rdata......0......................@..@.data...<...........................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.787123565783872
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	nnzZhhVIqM.exe
File size:	365'568 bytes
MD5:	d32fb5a87134ee848ec6fc2c081c333e
SHA1:	f2d63086fc54c03f5639e996e2e0f1f6a834625b
SHA256:	43ee4772f0efa084eeb18e09cf5f6ea2a41a35c32123d8b6c1d41337ae79e699
SHA512:	f591fc4ca6339b8d8e0743cc44358b2e4672799b669d76f9fc1b27a6e3cf8bf1845628015307c8b95d94b0ac67c5d17a7d6d68ae5816250e70f8a9f000ae7875
SSDEEP:	6144:mzIYiNqPGyUPtEvT6RTcvmgHqqnAvwALwFHQbQhhKgk4dz+4ee9iZFEAyoeZYQ4:mELqPGjFJgHqqAvZbh34eXmZYQ
TLSH:	047407ADCE9105EFDC52A4B8041573B7C7AE204173DAB4CB67923B82697F8E4D93160B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q1..._..._..._...$..._...^..._..B...._...P..._..B...._.Rich.._.................PE..L....&zV...................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x42fbb0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x567A26FA [Wed Dec 23 04:45:46 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	d31da6ca62292b87d3a77c52248c1168

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 08h
fld dword ptr [0044E130h]
mov ax, word ptr [0044E2C0h]
movsx ecx, ax
mov dword ptr [ebp-04h], ecx
push esi
fild dword ptr [ebp-04h]
fadd qword ptr [0044E488h]
fadd qword ptr [0044E128h]
fcompp
fstsw
fld qword ptr [0044E488h]
fld1
fadd st(1), st(0)
fxch st(0), st(1)
fstp qword ptr [0044E488h]
fld dword ptr [0044E130h]
fadd st(0), st(1)
fstp dword ptr [0044E130h]
test ah, 00000001h
jne 00007F4CC91E6B88h
fld dword ptr [0044E47Ch]
fsub qword ptr [0044CDD8h]
fadd qword ptr [0044E5F8h]
fstp qword ptr [0044E5F8h]
fadd dword ptr [0044E47Ch]
fstp dword ptr [0044E47Ch]
jmp 00007F4CC91E6B7Fh
mov dx, word ptr [0044E160h]
fstp st(0)
movsx eax, dx
add eax, 396A6038h
mov dword ptr [0044E228h], eax
inc word ptr [0044E160h]
call 00007F4CC91E5FDCh
fld dword ptr [0044E540h]
fadd qword ptr [0044E208h]
fstp qword ptr [0044E208h]
fld dword ptr [0044E540h]
fadd qword ptr [00446E50h]
fstp dword ptr [0044E540h]
call 00007F4CC91D6C13h
movzx ecx, word ptr [0044E0F0h]

Rich Headers

Programming Language:

[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[ASM] VS2003 (.NET) build 3077
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4cde0	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0xca60	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x43000	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x416fa	0x41800	00018aae4be1cb461bcb87e438f3d88f	False	0.5246078840648855	data	6.3054228004696675	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x43000	0xa3dc	0xa400	7fd7b1afca4c98ad26021b00dc417afb	False	0.7465939405487805	data	6.532758631869293	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4e000	0x113c	0x800	bc9a4c4215fed3ea58bd04901474d02a	False	0.70947265625	data	5.48104826112429	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x50000	0xcb0a	0xcc00	87d800a62751c0c8904545e3617f44bb	False	0.6574563419117647	data	6.837399700703921	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
GDI32.dll	SetPixel, GetBkColor, GetRandomRgn, GetMetaRgn, GetTextColor, GetTextCharset, GetTextAlign, GetTextCharacterExtra, UpdateColors
USER32.dll	GetScrollPos, SetFocus, IsWindowUnicode, GetMenuCheckMarkDimensions, IsWindowEnabled, GetWindowDC, GetDlgItem, GetDC, GetWindowContextHelpId, EndDialog, PostMessageA, DrawTextA, GetQueueStatus, GetMenuItemID, GetMenuContextHelpId, GetMenu, GetCursor, GetForegroundWindow, GetDlgItemInt, WindowFromDC, EnableWindow, GetMenuState, CallWindowProcA, LoadIconA, ShowWindow, wvsprintfA, CharLowerBuffA, GetMenuItemCount
KERNEL32.dll	CreateFileA, GetProcAddress, CloseHandle, IsDebuggerPresent, MoveFileA, DeleteFileA, GetCurrentThreadId, LockResource, GetLastError, GlobalFlags, GetModuleHandleA, GetTickCount, GetDriveTypeA, GetCurrentProcess, SetFilePointer, IsProcessorFeaturePresent, GlobalAlloc, GetCurrentProcessId, FindResourceA, GlobalHandle, WriteFile, GetSystemTime, SystemTimeToFileTime, HeapFree, GetStdHandle, GetProcessHeap, HeapReAlloc, HeapAlloc, ExitProcess, lstrlenA, GetFileSize, GetFileTime

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-07T15:45:44.491463+0100	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	1	192.168.2.7	49741	18.143.155.63	80	TCP
2024-11-07T15:45:44.491463+0100	2820680	ETPRO MALWARE W32/Bayrob Attempted Checkin 2	1	192.168.2.7	49741	18.143.155.63	80	TCP
2024-11-07T15:45:44.860541+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.143.155.63	80	192.168.2.7	49741	TCP
2024-11-07T15:45:44.860541+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.143.155.63	80	192.168.2.7	49741	TCP
2024-11-07T15:45:45.985542+0100	2018316	ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses	1	1.1.1.1	53	192.168.2.7	59618	UDP
2024-11-07T15:45:46.264578+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.7	49747	TCP
2024-11-07T15:45:47.796098+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	54.244.188.177	80	192.168.2.7	49766	TCP
2024-11-07T15:45:47.796098+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	54.244.188.177	80	192.168.2.7	49766	TCP
2024-11-07T15:45:53.555903+0100	2811542	ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net)	1	1.1.1.1	53	192.168.2.7	52353	UDP
2024-11-07T15:46:28.077948+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.7	59181	TCP
2024-11-07T15:47:21.074276+0100	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	1	192.168.2.7	59196	199.59.243.227	80	TCP
2024-11-07T15:47:21.074276+0100	2820680	ETPRO MALWARE W32/Bayrob Attempted Checkin 2	1	192.168.2.7	59196	199.59.243.227	80	TCP
2024-11-07T15:47:39.292296+0100	2018316	ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses	1	1.1.1.1	53	192.168.2.7	52514	UDP
2024-11-07T15:48:23.922912+0100	2811542	ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net)	1	1.1.1.1	53	192.168.2.7	61961	UDP
2024-11-07T15:48:32.910412+0100	2811542	ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net)	1	1.1.1.1	53	192.168.2.7	54726	UDP
2024-11-07T15:48:57.445301+0100	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	1	192.168.2.7	53566	18.143.155.63	80	TCP
2024-11-07T15:48:57.445301+0100	2820680	ETPRO MALWARE W32/Bayrob Attempted Checkin 2	1	192.168.2.7	53566	18.143.155.63	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 15:45:40.055995941 CET	49736	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:45:40.062048912 CET	80	49736	199.59.243.227	192.168.2.7
Nov 7, 2024 15:45:40.062117100 CET	49736	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:45:40.062153101 CET	49736	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:45:40.067504883 CET	80	49736	199.59.243.227	192.168.2.7
Nov 7, 2024 15:45:41.096541882 CET	80	49736	199.59.243.227	192.168.2.7
Nov 7, 2024 15:45:41.096568108 CET	80	49736	199.59.243.227	192.168.2.7
Nov 7, 2024 15:45:41.096657038 CET	49736	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:45:41.098155022 CET	80	49736	199.59.243.227	192.168.2.7
Nov 7, 2024 15:45:41.098217010 CET	49736	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:45:41.104949951 CET	49736	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:45:41.109947920 CET	80	49736	199.59.243.227	192.168.2.7
Nov 7, 2024 15:45:42.011037111 CET	49741	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:45:42.018182039 CET	80	49741	18.143.155.63	192.168.2.7
Nov 7, 2024 15:45:42.018259048 CET	49741	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:45:42.022706985 CET	49741	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:45:42.027487040 CET	80	49741	18.143.155.63	192.168.2.7
Nov 7, 2024 15:45:44.450783968 CET	80	49741	18.143.155.63	192.168.2.7
Nov 7, 2024 15:45:44.491462946 CET	49741	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:45:44.860541105 CET	80	49741	18.143.155.63	192.168.2.7
Nov 7, 2024 15:45:44.860649109 CET	49741	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:45:44.861993074 CET	49741	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:45:44.866821051 CET	80	49741	18.143.155.63	192.168.2.7
Nov 7, 2024 15:45:46.850189924 CET	49766	80	192.168.2.7	54.244.188.177
Nov 7, 2024 15:45:46.855092049 CET	80	49766	54.244.188.177	192.168.2.7
Nov 7, 2024 15:45:46.855225086 CET	49766	80	192.168.2.7	54.244.188.177
Nov 7, 2024 15:45:46.855274916 CET	49766	80	192.168.2.7	54.244.188.177
Nov 7, 2024 15:45:46.860177994 CET	80	49766	54.244.188.177	192.168.2.7
Nov 7, 2024 15:45:47.679689884 CET	80	49766	54.244.188.177	192.168.2.7
Nov 7, 2024 15:45:47.725883961 CET	49766	80	192.168.2.7	54.244.188.177
Nov 7, 2024 15:45:47.796097994 CET	80	49766	54.244.188.177	192.168.2.7
Nov 7, 2024 15:45:47.796224117 CET	49766	80	192.168.2.7	54.244.188.177
Nov 7, 2024 15:45:47.796262980 CET	49766	80	192.168.2.7	54.244.188.177
Nov 7, 2024 15:45:47.801141024 CET	80	49766	54.244.188.177	192.168.2.7
Nov 7, 2024 15:45:49.656003952 CET	49779	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:45:49.660877943 CET	80	49779	199.59.243.227	192.168.2.7
Nov 7, 2024 15:45:49.660947084 CET	49779	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:45:49.660986900 CET	49779	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:45:49.665860891 CET	80	49779	199.59.243.227	192.168.2.7
Nov 7, 2024 15:45:50.287405014 CET	80	49779	199.59.243.227	192.168.2.7
Nov 7, 2024 15:45:50.287599087 CET	80	49779	199.59.243.227	192.168.2.7
Nov 7, 2024 15:45:50.287976980 CET	80	49779	199.59.243.227	192.168.2.7
Nov 7, 2024 15:45:50.288053989 CET	49779	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:45:50.288429022 CET	49779	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:45:50.293566942 CET	80	49779	199.59.243.227	192.168.2.7
Nov 7, 2024 15:45:51.287554026 CET	59007	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:45:51.292598009 CET	80	59007	18.143.155.63	192.168.2.7
Nov 7, 2024 15:45:51.292706013 CET	59007	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:45:51.292831898 CET	59007	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:45:51.297915936 CET	80	59007	18.143.155.63	192.168.2.7
Nov 7, 2024 15:45:52.730571032 CET	80	59007	18.143.155.63	192.168.2.7
Nov 7, 2024 15:45:52.772789001 CET	59007	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:45:53.146565914 CET	80	59007	18.143.155.63	192.168.2.7
Nov 7, 2024 15:45:53.146717072 CET	59007	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:45:53.146789074 CET	59007	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:45:53.151802063 CET	80	59007	18.143.155.63	192.168.2.7
Nov 7, 2024 15:45:53.979644060 CET	59021	80	192.168.2.7	85.214.228.140
Nov 7, 2024 15:45:53.984690905 CET	80	59021	85.214.228.140	192.168.2.7
Nov 7, 2024 15:45:53.984767914 CET	59021	80	192.168.2.7	85.214.228.140
Nov 7, 2024 15:45:53.984852076 CET	59021	80	192.168.2.7	85.214.228.140
Nov 7, 2024 15:45:53.989682913 CET	80	59021	85.214.228.140	192.168.2.7
Nov 7, 2024 15:45:54.861473083 CET	80	59021	85.214.228.140	192.168.2.7
Nov 7, 2024 15:45:54.861820936 CET	59021	80	192.168.2.7	85.214.228.140
Nov 7, 2024 15:45:54.871623039 CET	80	59021	85.214.228.140	192.168.2.7
Nov 7, 2024 15:45:54.871675968 CET	59021	80	192.168.2.7	85.214.228.140
Nov 7, 2024 15:47:20.370877028 CET	59196	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:47:20.375958920 CET	80	59196	199.59.243.227	192.168.2.7
Nov 7, 2024 15:47:20.376111031 CET	59196	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:47:20.376177073 CET	59196	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:47:20.381112099 CET	80	59196	199.59.243.227	192.168.2.7
Nov 7, 2024 15:47:21.074049950 CET	80	59196	199.59.243.227	192.168.2.7
Nov 7, 2024 15:47:21.074215889 CET	80	59196	199.59.243.227	192.168.2.7
Nov 7, 2024 15:47:21.074275970 CET	59196	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:47:21.106496096 CET	80	59196	199.59.243.227	192.168.2.7
Nov 7, 2024 15:47:21.106637001 CET	59196	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:47:21.106713057 CET	59196	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:47:21.111495018 CET	80	59196	199.59.243.227	192.168.2.7
Nov 7, 2024 15:47:26.308845997 CET	59197	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:47:26.314380884 CET	80	59197	18.143.155.63	192.168.2.7
Nov 7, 2024 15:47:26.314533949 CET	59197	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:47:26.328320980 CET	59197	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:47:26.333317041 CET	80	59197	18.143.155.63	192.168.2.7
Nov 7, 2024 15:47:27.754359007 CET	80	59197	18.143.155.63	192.168.2.7
Nov 7, 2024 15:47:27.804498911 CET	59197	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:47:28.169269085 CET	80	59197	18.143.155.63	192.168.2.7
Nov 7, 2024 15:47:28.171562910 CET	59197	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:47:28.190102100 CET	59197	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:47:28.195342064 CET	80	59197	18.143.155.63	192.168.2.7
Nov 7, 2024 15:48:14.540657997 CET	59198	80	192.168.2.7	54.244.188.177
Nov 7, 2024 15:48:14.545592070 CET	80	59198	54.244.188.177	192.168.2.7
Nov 7, 2024 15:48:14.545744896 CET	59198	80	192.168.2.7	54.244.188.177
Nov 7, 2024 15:48:14.550292015 CET	59198	80	192.168.2.7	54.244.188.177
Nov 7, 2024 15:48:14.555094004 CET	80	59198	54.244.188.177	192.168.2.7
Nov 7, 2024 15:48:15.386919022 CET	80	59198	54.244.188.177	192.168.2.7
Nov 7, 2024 15:48:15.387104988 CET	59198	80	192.168.2.7	54.244.188.177
Nov 7, 2024 15:48:15.392210960 CET	80	59198	54.244.188.177	192.168.2.7
Nov 7, 2024 15:48:15.392292976 CET	59198	80	192.168.2.7	54.244.188.177
Nov 7, 2024 15:48:24.551971912 CET	63728	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:48:24.556976080 CET	80	63728	199.59.243.227	192.168.2.7
Nov 7, 2024 15:48:24.557085991 CET	63728	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:48:24.563097000 CET	63728	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:48:24.567948103 CET	80	63728	199.59.243.227	192.168.2.7
Nov 7, 2024 15:48:25.184014082 CET	80	63728	199.59.243.227	192.168.2.7
Nov 7, 2024 15:48:25.184243917 CET	63728	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:48:25.184308052 CET	80	63728	199.59.243.227	192.168.2.7
Nov 7, 2024 15:48:25.184374094 CET	63728	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:48:25.184798002 CET	80	63728	199.59.243.227	192.168.2.7
Nov 7, 2024 15:48:25.184851885 CET	63728	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:48:27.863373995 CET	63729	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:48:27.868429899 CET	80	63729	18.143.155.63	192.168.2.7
Nov 7, 2024 15:48:27.868604898 CET	63729	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:48:27.868604898 CET	63729	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:48:27.873460054 CET	80	63729	18.143.155.63	192.168.2.7
Nov 7, 2024 15:48:29.299015045 CET	80	63729	18.143.155.63	192.168.2.7
Nov 7, 2024 15:48:29.300492048 CET	63729	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:48:29.306214094 CET	80	63729	18.143.155.63	192.168.2.7
Nov 7, 2024 15:48:29.306313992 CET	63729	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:48:36.290261030 CET	53564	80	192.168.2.7	85.214.228.140
Nov 7, 2024 15:48:36.295233011 CET	80	53564	85.214.228.140	192.168.2.7
Nov 7, 2024 15:48:36.295377970 CET	53564	80	192.168.2.7	85.214.228.140
Nov 7, 2024 15:48:36.295449972 CET	53564	80	192.168.2.7	85.214.228.140
Nov 7, 2024 15:48:36.300400019 CET	80	53564	85.214.228.140	192.168.2.7
Nov 7, 2024 15:48:37.986795902 CET	53564	80	192.168.2.7	85.214.228.140
Nov 7, 2024 15:48:38.201598883 CET	80	53564	85.214.228.140	192.168.2.7
Nov 7, 2024 15:48:38.201783895 CET	53564	80	192.168.2.7	85.214.228.140
Nov 7, 2024 15:48:38.201849937 CET	80	53564	85.214.228.140	192.168.2.7
Nov 7, 2024 15:48:38.201863050 CET	80	53564	85.214.228.140	192.168.2.7
Nov 7, 2024 15:48:38.201894999 CET	53564	80	192.168.2.7	85.214.228.140
Nov 7, 2024 15:48:38.201914072 CET	53564	80	192.168.2.7	85.214.228.140
Nov 7, 2024 15:48:38.202255011 CET	80	53564	85.214.228.140	192.168.2.7
Nov 7, 2024 15:48:38.202301025 CET	53564	80	192.168.2.7	85.214.228.140
Nov 7, 2024 15:48:38.203160048 CET	80	53564	85.214.228.140	192.168.2.7
Nov 7, 2024 15:48:38.203208923 CET	53564	80	192.168.2.7	85.214.228.140
Nov 7, 2024 15:48:49.967658043 CET	53565	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:48:49.972805977 CET	80	53565	199.59.243.227	192.168.2.7
Nov 7, 2024 15:48:49.972959042 CET	53565	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:48:49.973134041 CET	53565	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:48:49.978147030 CET	80	53565	199.59.243.227	192.168.2.7
Nov 7, 2024 15:48:50.629836082 CET	80	53565	199.59.243.227	192.168.2.7
Nov 7, 2024 15:48:50.629859924 CET	80	53565	199.59.243.227	192.168.2.7
Nov 7, 2024 15:48:50.630088091 CET	53565	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:48:50.661349058 CET	80	53565	199.59.243.227	192.168.2.7
Nov 7, 2024 15:48:50.661487103 CET	53565	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:48:50.661562920 CET	53565	80	192.168.2.7	199.59.243.227
Nov 7, 2024 15:48:50.666491032 CET	80	53565	199.59.243.227	192.168.2.7
Nov 7, 2024 15:48:55.929825068 CET	53566	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:48:55.934919119 CET	80	53566	18.143.155.63	192.168.2.7
Nov 7, 2024 15:48:55.935008049 CET	53566	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:48:55.935058117 CET	53566	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:48:55.941485882 CET	80	53566	18.143.155.63	192.168.2.7
Nov 7, 2024 15:48:57.390021086 CET	80	53566	18.143.155.63	192.168.2.7
Nov 7, 2024 15:48:57.445301056 CET	53566	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:48:57.784553051 CET	80	53566	18.143.155.63	192.168.2.7
Nov 7, 2024 15:48:57.784621000 CET	53566	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:48:57.784693956 CET	53566	80	192.168.2.7	18.143.155.63
Nov 7, 2024 15:48:57.789515018 CET	80	53566	18.143.155.63	192.168.2.7
Nov 7, 2024 15:49:32.618122101 CET	53567	80	192.168.2.7	54.244.188.177
Nov 7, 2024 15:49:32.623050928 CET	80	53567	54.244.188.177	192.168.2.7
Nov 7, 2024 15:49:32.623121977 CET	53567	80	192.168.2.7	54.244.188.177
Nov 7, 2024 15:49:32.623164892 CET	53567	80	192.168.2.7	54.244.188.177
Nov 7, 2024 15:49:32.627973080 CET	80	53567	54.244.188.177	192.168.2.7
Nov 7, 2024 15:49:33.465475082 CET	80	53567	54.244.188.177	192.168.2.7
Nov 7, 2024 15:49:33.507523060 CET	53567	80	192.168.2.7	54.244.188.177
Nov 7, 2024 15:49:33.585498095 CET	80	53567	54.244.188.177	192.168.2.7
Nov 7, 2024 15:49:33.585565090 CET	53567	80	192.168.2.7	54.244.188.177

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 15:45:29.882528067 CET	59032	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:39.195172071 CET	55748	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:39.205601931 CET	53	55748	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:39.212680101 CET	53657	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:39.222706079 CET	53	53657	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:39.223707914 CET	59255	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:39.233980894 CET	53	59255	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:39.234980106 CET	54229	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:39.266169071 CET	53	54229	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:39.283978939 CET	51693	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:39.293807030 CET	53	51693	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:39.295016050 CET	51682	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:39.326287031 CET	53	51682	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:39.367964983 CET	62934	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:39.378201008 CET	53	62934	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:39.379122019 CET	56747	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:39.386414051 CET	53	56747	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:39.387370110 CET	54361	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:39.418633938 CET	53	54361	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:39.461944103 CET	58520	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:39.471555948 CET	53	58520	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:39.472575903 CET	51161	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:39.503926992 CET	53	51161	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:39.505261898 CET	63786	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:39.514765024 CET	53	63786	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:39.515866041 CET	50677	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:39.528707981 CET	53	50677	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:39.538793087 CET	50494	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:39.570266962 CET	53	50494	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:39.589893103 CET	56041	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:39.621146917 CET	53	56041	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:39.633749008 CET	54472	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:40.053379059 CET	53	54472	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:41.106199980 CET	64791	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:41.138125896 CET	53	64791	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:41.164911985 CET	61826	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:41.175170898 CET	53	61826	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:41.222471952 CET	53617	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:41.235069036 CET	53	53617	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:41.501915932 CET	59783	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:41.511198997 CET	53	59783	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:41.788975000 CET	64908	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:41.997653008 CET	53	64908	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:44.869575977 CET	62239	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:44.899873972 CET	53	62239	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:44.946666956 CET	63642	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:44.956662893 CET	53	63642	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:44.958372116 CET	50357	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:44.989387989 CET	53	50357	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:44.995703936 CET	56530	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.003556967 CET	53	56530	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.007930040 CET	52925	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.018589020 CET	53	52925	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.020747900 CET	57831	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.053020954 CET	53	57831	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.242847919 CET	58626	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.253304005 CET	53	58626	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.298520088 CET	57938	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.308054924 CET	53	57938	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.494503975 CET	63015	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.505397081 CET	53	63015	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.522684097 CET	49415	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.532428980 CET	53	49415	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.544776917 CET	59723	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.555891991 CET	53	59723	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.636492014 CET	65228	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.646226883 CET	53	65228	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.672415972 CET	54405	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.682687998 CET	53	54405	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.685192108 CET	52592	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.717176914 CET	53	52592	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.721342087 CET	60465	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.752434015 CET	53	60465	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.753844976 CET	50473	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.763411999 CET	53	50473	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.766288042 CET	61171	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.777071953 CET	53	61171	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.781775951 CET	51514	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.791405916 CET	53	51514	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.792460918 CET	63579	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.801882029 CET	53	63579	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.803014040 CET	63369	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.833827019 CET	53	63369	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.834960938 CET	64378	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.844834089 CET	53	64378	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.846095085 CET	62879	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.855729103 CET	53	62879	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.856945992 CET	61119	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.867039919 CET	53	61119	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.868194103 CET	51205	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.878251076 CET	53	51205	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.879343033 CET	59456	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.889200926 CET	53	59456	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.890355110 CET	58360	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.925838947 CET	53	58360	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.927963018 CET	61648	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.937310934 CET	53	61648	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.943157911 CET	58443	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.974498034 CET	53	58443	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.975663900 CET	59618	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.985542059 CET	53	59618	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.986983061 CET	53489	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:45.995786905 CET	53	53489	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:45.996815920 CET	61766	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.008716106 CET	53	61766	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.009721994 CET	61628	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.040318966 CET	53	61628	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.041311979 CET	57946	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.072149992 CET	53	57946	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.073184013 CET	65102	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.083511114 CET	53	65102	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.084465981 CET	53552	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.091953993 CET	53	53552	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.092950106 CET	61118	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.257002115 CET	53	61118	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.258414984 CET	62164	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.288775921 CET	53	62164	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.294318914 CET	65057	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.325613022 CET	53	65057	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.330678940 CET	54690	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.340306997 CET	53	54690	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.341322899 CET	54365	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.351475000 CET	53	54365	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.355289936 CET	60745	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.387085915 CET	53	60745	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.388036966 CET	60851	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.398104906 CET	53	60851	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.399058104 CET	58485	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.430134058 CET	53	58485	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.431219101 CET	57323	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.439989090 CET	53	57323	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.440839052 CET	51097	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.472632885 CET	53	51097	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.473637104 CET	52124	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.482677937 CET	53	52124	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.483618021 CET	60370	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.515053034 CET	53	60370	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.516104937 CET	59264	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.526947021 CET	53	59264	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.528136969 CET	54725	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.559309006 CET	53	54725	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.560391903 CET	57782	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.570326090 CET	53	57782	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.571386099 CET	63844	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.602530003 CET	53	63844	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.603563070 CET	64141	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.615008116 CET	53	64141	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.615854979 CET	64829	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.646024942 CET	53	64829	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:46.647156954 CET	52522	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:46.849656105 CET	53	52522	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:47.797807932 CET	52793	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:47.807607889 CET	53	52793	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:47.809288979 CET	50140	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:47.840451002 CET	53	50140	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:47.846888065 CET	61949	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:47.856904984 CET	53	61949	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:47.877831936 CET	56013	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:47.887675047 CET	53	56013	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:47.947757959 CET	57455	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:47.958278894 CET	53	57455	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:47.967143059 CET	65413	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:47.997606039 CET	53	65413	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:48.005851984 CET	60307	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:48.015758991 CET	53	60307	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:48.016844988 CET	59733	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:48.050712109 CET	53	59733	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:48.116158009 CET	51529	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:48.126291037 CET	53	51529	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:48.143291950 CET	56743	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:48.173867941 CET	53	56743	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:48.222491026 CET	54796	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:48.231750011 CET	53	54796	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:48.283291101 CET	56719	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:48.294966936 CET	53	56719	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:48.333503962 CET	64123	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:48.342644930 CET	53	64123	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:48.384469986 CET	54465	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:48.394596100 CET	53	54465	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:48.397708893 CET	63597	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:48.407912016 CET	53	63597	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:48.419559956 CET	55828	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:48.449863911 CET	53	55828	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:48.892050028 CET	53127	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:48.902751923 CET	53	53127	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:48.968820095 CET	58990	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:48.978048086 CET	53	58990	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:49.021589994 CET	65257	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:49.031347036 CET	53	65257	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:49.069485903 CET	64378	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:49.080104113 CET	53	64378	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:49.147680044 CET	50723	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:49.157799959 CET	53	50723	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:49.162651062 CET	64828	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:49.196077108 CET	53	64828	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:49.202260017 CET	55355	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:49.211878061 CET	53	55355	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:49.217499018 CET	59829	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:49.226680040 CET	53	59829	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:49.236474037 CET	56438	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:49.249440908 CET	53	56438	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:49.255563021 CET	51570	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:49.655292988 CET	53	51570	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:50.289617062 CET	51176	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:50.299163103 CET	53	51176	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:50.300679922 CET	58684	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:50.311077118 CET	53	58684	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:50.312773943 CET	62664	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:50.322791100 CET	53	62664	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:50.324120998 CET	59134	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:50.333774090 CET	53	59134	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:50.334965944 CET	63391	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:50.345694065 CET	53	63391	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:50.346837997 CET	58684	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:50.353492975 CET	53	58684	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:50.992711067 CET	60457	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:51.003468037 CET	53	60457	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:51.005141020 CET	62144	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:51.016943932 CET	53	62144	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:51.018274069 CET	64176	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:51.029829979 CET	53	64176	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:51.031049967 CET	53862	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:51.061512947 CET	53	53862	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:51.062916994 CET	49489	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:51.286855936 CET	53	49489	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.147828102 CET	62434	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.158044100 CET	53	62434	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.159425974 CET	54728	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.169641972 CET	53	54728	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.171077967 CET	62877	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.180339098 CET	53	62877	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.181705952 CET	54851	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.191616058 CET	53	54851	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.192887068 CET	53895	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.225189924 CET	53	53895	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.227081060 CET	64899	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.238513947 CET	53	64899	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.240158081 CET	56433	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.251727104 CET	53	56433	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.258727074 CET	56419	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.290137053 CET	53	56419	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.291563034 CET	61739	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.322496891 CET	53	61739	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.323553085 CET	62982	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.335423946 CET	53	62982	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.336600065 CET	49694	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.369194031 CET	53	49694	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.370305061 CET	55158	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.390347004 CET	53	55158	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.391722918 CET	49459	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.402626038 CET	53	49459	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.403655052 CET	57644	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.434916973 CET	53	57644	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.435967922 CET	58024	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.447256088 CET	53	58024	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.448168039 CET	55409	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.457931995 CET	53	55409	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.459016085 CET	63774	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.468565941 CET	53	63774	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.469578981 CET	59055	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.479265928 CET	53	59055	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.480264902 CET	55028	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.510854006 CET	53	55028	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.512146950 CET	63279	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.521965027 CET	53	63279	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.523240089 CET	52353	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.555902958 CET	53	52353	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.557307005 CET	64106	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.567476988 CET	53	64106	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.568568945 CET	58061	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.580188990 CET	53	58061	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.581316948 CET	57705	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.591973066 CET	53	57705	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.597734928 CET	64202	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.630712986 CET	53	64202	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.632042885 CET	57761	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.644300938 CET	53	57761	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.645456076 CET	63364	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.655724049 CET	53	63364	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.656711102 CET	61992	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.666896105 CET	53	61992	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.667845964 CET	54809	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.675434113 CET	53	54809	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.676352978 CET	56306	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.688810110 CET	53	56306	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.689754009 CET	55060	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.699552059 CET	53	55060	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.700498104 CET	59116	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.710692883 CET	53	59116	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.711838007 CET	55948	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.723654032 CET	53	55948	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.724678993 CET	50080	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.736327887 CET	53	50080	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.737308979 CET	63961	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.748059988 CET	53	63961	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.749061108 CET	59637	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.759829998 CET	53	59637	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.760852098 CET	60880	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.771646976 CET	53	60880	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.772764921 CET	58180	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.804122925 CET	53	58180	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.805566072 CET	57601	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.817605972 CET	53	57601	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.818880081 CET	51016	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.829118967 CET	53	51016	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.830318928 CET	64083	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.842514992 CET	53	64083	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.843672991 CET	53766	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.854720116 CET	53	53766	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.855798006 CET	57380	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.866816998 CET	53	57380	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.867925882 CET	63607	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.878925085 CET	53	63607	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.880028963 CET	59655	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.890496969 CET	53	59655	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:53.891483068 CET	64946	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:53.979002953 CET	53	64946	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:54.863320112 CET	59732	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:54.873836040 CET	53	59732	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:54.875051022 CET	53056	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:55.033710003 CET	53	53056	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:55.035176039 CET	52996	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:55.047808886 CET	53	52996	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:55.048975945 CET	50848	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:55.080410957 CET	53	50848	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:55.081573963 CET	54351	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:55.091777086 CET	53	54351	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:55.092876911 CET	60252	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:55.126807928 CET	53	60252	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:55.128062010 CET	52806	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:55.160115004 CET	53	52806	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:55.161550999 CET	62861	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:55.172604084 CET	53	62861	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:55.173804045 CET	59852	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:55.183147907 CET	53	59852	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:55.184489965 CET	60044	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:55.194773912 CET	53	60044	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:55.195979118 CET	52464	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:55.205777884 CET	53	52464	1.1.1.1	192.168.2.7
Nov 7, 2024 15:45:55.206831932 CET	63021	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:45:55.237097979 CET	53	63021	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:17.318182945 CET	49838	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:17.329459906 CET	53	49838	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:18.336927891 CET	55304	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:18.347439051 CET	53	55304	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:19.354698896 CET	63170	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:19.364573002 CET	53	63170	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:22.129497051 CET	60852	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:22.140253067 CET	53	60852	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:23.150427103 CET	60292	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:23.162026882 CET	53	60292	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:24.165189028 CET	49593	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:24.195491076 CET	53	49593	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:25.212475061 CET	51595	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:25.222521067 CET	53	51595	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:29.196729898 CET	50419	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:29.231187105 CET	53	50419	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:30.243380070 CET	55602	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:30.900557995 CET	53	55602	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:31.931302071 CET	54112	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:31.939469099 CET	53	54112	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:32.946608067 CET	61871	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:32.979634047 CET	53	61871	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:33.993242979 CET	61325	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:34.003432989 CET	53	61325	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:35.009228945 CET	63268	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:35.017405987 CET	53	63268	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:36.047905922 CET	65121	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:36.080646038 CET	53	65121	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:37.088992119 CET	56339	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:37.125143051 CET	53	56339	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:38.134237051 CET	56421	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:38.165364981 CET	53	56421	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:39.260796070 CET	52514	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:39.292295933 CET	53	52514	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:40.306925058 CET	63931	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:40.316740990 CET	53	63931	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:41.322659969 CET	65319	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:41.335952044 CET	53	65319	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:42.352828026 CET	53420	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:42.365339994 CET	53	53420	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:43.370385885 CET	63168	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:43.382335901 CET	53	63168	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:44.507329941 CET	62864	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:44.518202066 CET	53	62864	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:45.806250095 CET	56021	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:45.817903996 CET	53	56021	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:46.825875044 CET	61983	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:46.839298010 CET	53	61983	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:47.852505922 CET	54516	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:47.885808945 CET	53	54516	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:49.165158987 CET	59944	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:49.175554991 CET	53	59944	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:50.183178902 CET	51868	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:50.193437099 CET	53	51868	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:51.196610928 CET	51823	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:51.266875982 CET	53	51823	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:52.274736881 CET	54884	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:52.307188988 CET	53	54884	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:53.402307987 CET	52772	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:53.413204908 CET	53	52772	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:54.385422945 CET	63070	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:54.683372021 CET	53	63070	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:55.634200096 CET	64979	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:55.645575047 CET	53	64979	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:56.556694031 CET	50996	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:56.566319942 CET	53	50996	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:57.640389919 CET	57683	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:57.880589008 CET	53	57683	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:58.744445086 CET	64356	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:58.754204035 CET	53	64356	1.1.1.1	192.168.2.7
Nov 7, 2024 15:47:59.587172985 CET	53202	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:47:59.597512007 CET	53	53202	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:00.399708986 CET	56578	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:00.433732033 CET	53	56578	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:01.212312937 CET	63485	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:01.408253908 CET	53	63485	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:02.149959087 CET	59618	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:02.159754038 CET	53	59618	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:02.884236097 CET	65088	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:02.917041063 CET	53	65088	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:03.618550062 CET	57799	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:03.649275064 CET	53	57799	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:04.321945906 CET	51786	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:04.332106113 CET	53	51786	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:04.977751970 CET	60321	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:05.010143042 CET	53	60321	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:05.649920940 CET	64455	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:05.659559011 CET	53	64455	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:06.301430941 CET	54942	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:06.459430933 CET	53	54942	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:07.055938005 CET	52770	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:07.067027092 CET	53	52770	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:07.634098053 CET	54424	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:07.643768072 CET	53	54424	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:08.196326017 CET	63494	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:08.206088066 CET	53	63494	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:08.743308067 CET	50358	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:08.751694918 CET	53	50358	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:09.274709940 CET	64895	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:09.284990072 CET	53	64895	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:09.790124893 CET	49645	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:09.872879982 CET	53	49645	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:10.352701902 CET	49295	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:10.363998890 CET	53	49295	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:10.837445974 CET	61321	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:10.847821951 CET	53	61321	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:11.305897951 CET	59197	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:11.337233067 CET	53	59197	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:11.774600983 CET	55169	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:11.809323072 CET	53	55169	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:12.228214979 CET	62446	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:12.239849091 CET	53	62446	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:12.649682045 CET	64641	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:12.662370920 CET	53	64641	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:13.056227922 CET	63077	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:13.065957069 CET	53	63077	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:13.446904898 CET	55308	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:13.456454039 CET	53	55308	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:13.821544886 CET	51923	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:14.177906036 CET	53	51923	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:15.727790117 CET	61819	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:15.737447977 CET	53	61819	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:16.071486950 CET	57097	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:16.102859020 CET	53	57097	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:16.431504011 CET	58650	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:16.443111897 CET	53	58650	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:16.893035889 CET	55153	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:16.902192116 CET	53	55153	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:17.413999081 CET	55674	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:17.808022022 CET	53	55674	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:18.118585110 CET	58574	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:18.128607035 CET	53	58574	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:18.430990934 CET	53186	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:18.462203979 CET	53	53186	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:18.743508101 CET	58436	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:18.960921049 CET	53	58436	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:19.227941036 CET	56424	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:19.237272024 CET	53	56424	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:19.493522882 CET	65266	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:19.503874063 CET	53	65266	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:19.758841038 CET	56369	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:19.789231062 CET	56369	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:19.790683985 CET	53	56369	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:19.796540976 CET	53	56369	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:20.040896893 CET	60923	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:20.070359945 CET	60923	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:20.072175026 CET	53	60923	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:20.077205896 CET	53	60923	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:20.305879116 CET	52492	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:20.316308022 CET	53	52492	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:20.582335949 CET	54216	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:20.604475975 CET	54216	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:20.614869118 CET	53	54216	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:20.614895105 CET	53	54216	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:21.101937056 CET	56412	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:21.134262085 CET	53	56412	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:21.193141937 CET	56412	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:21.200928926 CET	53	56412	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:21.399564028 CET	58859	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:21.434356928 CET	53	58859	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:21.440855026 CET	58859	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:21.448807001 CET	53	58859	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:21.649555922 CET	53662	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:21.659688950 CET	53	53662	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:21.853164911 CET	65188	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:21.863521099 CET	53	65188	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:22.062396049 CET	62541	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:22.085963964 CET	62541	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:22.250886917 CET	53	62541	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:22.250904083 CET	53	62541	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:22.430793047 CET	52835	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:22.440489054 CET	53	52835	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:22.620712042 CET	60591	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:22.634126902 CET	53	60591	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:22.806372881 CET	55563	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:22.836167097 CET	55563	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:22.913486958 CET	53	55563	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:22.913531065 CET	53	55563	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:23.096759081 CET	62236	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:23.117966890 CET	62236	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:23.124676943 CET	53	62236	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:23.127672911 CET	53	62236	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:23.912750006 CET	61961	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:23.922911882 CET	53	61961	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:24.103384972 CET	52192	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:24.114126921 CET	53	52192	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:25.337084055 CET	49244	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:25.367227077 CET	49244	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:26.382818937 CET	49244	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:26.411914110 CET	53	49244	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:26.411926985 CET	53	49244	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:26.412106991 CET	53	49244	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:26.557614088 CET	60508	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:26.588625908 CET	53	60508	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:26.592777967 CET	60508	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:26.599363089 CET	53	60508	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:26.728442907 CET	65101	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:26.737772942 CET	53	65101	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:26.868855953 CET	55285	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:26.878453016 CET	53	55285	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:27.009212971 CET	55612	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:27.019515991 CET	53	55612	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:27.155544043 CET	64265	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:27.166743040 CET	53	64265	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:27.307543993 CET	58283	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:27.337090969 CET	58283	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:27.339406013 CET	53	58283	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:27.344079018 CET	53	58283	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:27.462034941 CET	57095	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:27.471292973 CET	53	57095	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:27.591533899 CET	52528	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:27.601310015 CET	53	52528	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:27.727910995 CET	54433	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:27.737670898 CET	53	54433	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:29.477516890 CET	49827	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:29.488197088 CET	53	49827	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:29.768317938 CET	56368	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:29.778662920 CET	53	56368	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:30.338917017 CET	56963	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:30.495100975 CET	53	56963	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:30.518397093 CET	56963	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:30.525641918 CET	53	56963	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:30.640073061 CET	51009	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:30.650337934 CET	53	51009	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:30.780633926 CET	59617	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:30.793802977 CET	53	59617	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:30.884208918 CET	58687	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:30.914335012 CET	58687	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:31.060096979 CET	53	58687	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:31.060117960 CET	53	58687	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:31.150300980 CET	55175	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:31.164114952 CET	53	55175	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:31.243473053 CET	63406	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:31.256942034 CET	53	63406	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:31.337857962 CET	62616	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:31.350817919 CET	53	62616	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:31.433024883 CET	52422	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:31.461136103 CET	52422	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:31.585196972 CET	53	52422	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:31.585510969 CET	53	52422	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:31.668397903 CET	64351	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:31.678994894 CET	53	64351	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:31.759423971 CET	58110	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:31.769699097 CET	53	58110	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:31.837239027 CET	61185	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:31.867687941 CET	53	61185	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:31.868613005 CET	61185	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:31.875946999 CET	53	61185	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:31.946568012 CET	63873	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:31.978992939 CET	53	63873	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:31.981189013 CET	63873	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:31.988354921 CET	53	63873	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:32.055700064 CET	64859	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:32.086138010 CET	64859	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:32.087588072 CET	53	64859	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:32.093138933 CET	53	64859	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:32.150412083 CET	65354	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:32.160165071 CET	53	65354	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:32.227852106 CET	50029	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:32.239224911 CET	53	50029	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:32.306739092 CET	62612	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:32.319255114 CET	53	62612	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:32.385936022 CET	58652	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:32.414309025 CET	58652	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:32.416802883 CET	53	58652	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:32.421180964 CET	53	58652	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:32.477581978 CET	56640	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:32.507901907 CET	56640	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:32.508683920 CET	53	56640	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:32.514941931 CET	53	56640	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:32.571324110 CET	53415	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:32.601989031 CET	53415	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:32.840837955 CET	53	53415	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:32.840944052 CET	53	53415	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:32.900717020 CET	54726	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:32.910412073 CET	53	54726	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:33.073250055 CET	62453	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:33.083415031 CET	53	62453	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:33.191922903 CET	60931	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:33.224020958 CET	53	60931	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:33.295730114 CET	59636	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:33.304806948 CET	53	59636	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:33.494947910 CET	60664	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:33.504869938 CET	53	60664	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:33.768928051 CET	49795	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:33.778686047 CET	53	49795	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:34.138286114 CET	53743	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:34.149015903 CET	53	53743	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:34.207389116 CET	51192	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:34.250905037 CET	51192	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:34.364427090 CET	53	51192	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:34.364674091 CET	53	51192	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:34.415200949 CET	50330	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:34.425369978 CET	53	50330	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:34.478024006 CET	64321	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:34.487839937 CET	53	64321	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:34.524578094 CET	60514	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:34.555087090 CET	60514	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:34.556169987 CET	53	60514	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:34.562015057 CET	53	60514	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:34.602869987 CET	61282	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:34.613326073 CET	53	61282	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:34.649647951 CET	59105	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:34.657371998 CET	53	59105	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:35.306086063 CET	50795	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:35.336247921 CET	50795	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:35.465291977 CET	53	50795	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:35.465434074 CET	53	50795	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:35.509063005 CET	65223	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:35.519063950 CET	53	65223	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:35.555753946 CET	60251	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:35.586054087 CET	60251	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:35.815395117 CET	53	60251	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:35.817243099 CET	53	60251	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:35.854835033 CET	59734	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:35.864568949 CET	53	59734	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:35.899580956 CET	53296	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:35.909902096 CET	53	53296	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:35.948620081 CET	50659	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:35.958308935 CET	53	50659	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:35.993952036 CET	63597	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:36.005693913 CET	53	63597	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:36.040404081 CET	64266	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:36.050704002 CET	53	64266	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:36.088157892 CET	54230	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:36.118500948 CET	53	54230	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:36.132467031 CET	54230	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:36.139738083 CET	53	54230	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:36.165267944 CET	60690	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:36.195557117 CET	60690	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:36.196898937 CET	53	60690	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:36.203749895 CET	53	60690	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:36.228594065 CET	54034	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:36.258158922 CET	54034	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:36.259665012 CET	53	54034	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:36.265321016 CET	53	54034	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:46.644052982 CET	64385	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:46.654200077 CET	53	64385	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:47.668015957 CET	63932	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:47.695807934 CET	63932	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:47.829866886 CET	53	63932	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:47.829883099 CET	53	63932	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:48.901993036 CET	54568	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:48.930041075 CET	54568	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:48.936986923 CET	53	54568	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:48.937156916 CET	53	54568	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:51.665941954 CET	65007	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:51.695863008 CET	65007	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:51.700069904 CET	53	65007	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:51.702807903 CET	53	65007	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:52.801403046 CET	54880	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:52.811311007 CET	53	54880	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:53.822525024 CET	59257	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:53.834790945 CET	53	59257	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:54.837580919 CET	51077	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:54.847590923 CET	53	51077	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:58.790436029 CET	57856	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:58.801486969 CET	53	57856	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:59.806617022 CET	49786	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:59.836002111 CET	49786	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:48:59.838306904 CET	53	49786	1.1.1.1	192.168.2.7
Nov 7, 2024 15:48:59.843863010 CET	53	49786	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:00.853251934 CET	60383	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:00.873752117 CET	53	60383	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:02.159569025 CET	54007	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:02.191256046 CET	53	54007	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:02.339268923 CET	54007	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:02.346141100 CET	53	54007	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:03.353137970 CET	60770	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:03.383233070 CET	60770	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:03.383965969 CET	53	60770	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:03.390038967 CET	53	60770	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:04.399580002 CET	52302	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:04.410001993 CET	53	52302	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:05.542633057 CET	53453	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:05.553742886 CET	53	53453	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:06.558545113 CET	60504	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:06.569065094 CET	53	60504	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:07.587553978 CET	54968	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:07.618638039 CET	54968	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:07.621398926 CET	53	54968	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:07.626070023 CET	53	54968	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:08.633991957 CET	53326	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:08.643743992 CET	53	53326	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:09.649861097 CET	63494	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:09.679822922 CET	63494	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:09.683768034 CET	53	63494	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:09.689234018 CET	53	63494	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:10.698786974 CET	51805	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:10.709177971 CET	53	51805	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:11.712479115 CET	55447	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:11.742435932 CET	55447	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:11.743356943 CET	53	55447	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:11.749572039 CET	53	55447	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:12.759193897 CET	49935	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:12.770028114 CET	53	49935	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:13.774729013 CET	57199	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:13.805536985 CET	57199	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:13.931530952 CET	53	57199	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:13.931555033 CET	53	57199	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:14.946934938 CET	55139	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:14.957216024 CET	53	55139	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:15.962485075 CET	56002	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:15.974334955 CET	53	56002	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:16.977842093 CET	59508	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:16.987416983 CET	53	59508	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:17.993449926 CET	63516	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:18.018956900 CET	53	63516	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:19.026237011 CET	56474	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:19.060008049 CET	53	56474	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:19.077532053 CET	56474	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:19.086890936 CET	53	56474	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:20.087246895 CET	64500	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:20.117229939 CET	64500	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:20.247617006 CET	53	64500	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:20.247632027 CET	53	64500	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:21.395494938 CET	58157	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:21.404721022 CET	53	58157	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:22.540474892 CET	55015	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:22.551405907 CET	53	55015	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:23.525777102 CET	51807	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:23.554950953 CET	51807	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:23.557789087 CET	53	51807	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:23.561767101 CET	53	51807	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:24.526809931 CET	53593	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:24.537394047 CET	53	53593	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:25.463411093 CET	54865	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:25.476054907 CET	53	54865	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:26.368493080 CET	57121	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:26.398572922 CET	57121	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:26.400167942 CET	53	57121	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:26.405486107 CET	53	57121	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:27.258769035 CET	52927	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:27.288976908 CET	52927	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:27.289585114 CET	53	52927	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:27.296027899 CET	53	52927	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:29.570950031 CET	60771	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:29.581877947 CET	53	60771	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:30.383754969 CET	52468	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:30.414103985 CET	52468	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:30.423507929 CET	53	52468	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:30.423638105 CET	53	52468	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:31.196443081 CET	51353	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:31.206420898 CET	53	51353	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.151487112 CET	50947	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.161506891 CET	53	50947	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.164164066 CET	65283	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.174408913 CET	53	65283	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.175600052 CET	54119	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.195239067 CET	54119	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.206408024 CET	53	54119	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.206418037 CET	53	54119	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.207525015 CET	51229	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.219037056 CET	53	51229	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.220139980 CET	60779	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.229975939 CET	53	60779	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.230946064 CET	57354	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.257622004 CET	57354	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.262800932 CET	53	57354	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.265744925 CET	53	57354	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.266495943 CET	62516	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.276480913 CET	53	62516	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.277467966 CET	57668	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.287267923 CET	53	57668	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.288275003 CET	58383	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.297280073 CET	53	58383	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.298252106 CET	49335	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.307106018 CET	53	49335	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.308059931 CET	58443	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.335825920 CET	58443	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.339063883 CET	53	58443	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.340956926 CET	52028	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.342976093 CET	53	58443	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.350512028 CET	53	52028	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.351475954 CET	64589	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.382587910 CET	64589	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.383716106 CET	53	64589	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.384730101 CET	54258	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.389497042 CET	53	64589	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.413872957 CET	54258	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.416784048 CET	53	54258	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.417745113 CET	56725	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.420627117 CET	53	54258	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.445089102 CET	56725	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.448662996 CET	53	56725	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.449697971 CET	59182	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.452183008 CET	53	56725	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.476372004 CET	59182	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.481813908 CET	53	59182	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.483062029 CET	63976	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.483397961 CET	53	59182	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.507639885 CET	63976	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.515870094 CET	53	63976	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.515881062 CET	53	63976	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.516957998 CET	62403	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.538914919 CET	62403	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.548527956 CET	53	62403	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.548799038 CET	53	62403	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.549879074 CET	49907	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.561647892 CET	53	49907	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.564286947 CET	49553	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.585895061 CET	49553	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.594696045 CET	53	49553	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.594710112 CET	53	49553	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.595668077 CET	58914	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.606139898 CET	53	58914	1.1.1.1	192.168.2.7
Nov 7, 2024 15:49:32.607058048 CET	60811	53	192.168.2.7	1.1.1.1
Nov 7, 2024 15:49:32.616691113 CET	53	60811	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 7, 2024 15:45:29.882528067 CET	192.168.2.7	1.1.1.1	0xe630	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.195172071 CET	192.168.2.7	1.1.1.1	0x279c	Standard query (0)	heavenstream.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.212680101 CET	192.168.2.7	1.1.1.1	0xcd13	Standard query (0)	leadernothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.223707914 CET	192.168.2.7	1.1.1.1	0x5afa	Standard query (0)	heavennothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.234980106 CET	192.168.2.7	1.1.1.1	0x3269	Standard query (0)	leaderbottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.283978939 CET	192.168.2.7	1.1.1.1	0x73b	Standard query (0)	heavenbottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.295016050 CET	192.168.2.7	1.1.1.1	0xa6d6	Standard query (0)	leaderdivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.367964983 CET	192.168.2.7	1.1.1.1	0xb464	Standard query (0)	heavendivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.379122019 CET	192.168.2.7	1.1.1.1	0xce8c	Standard query (0)	heavystream.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.387370110 CET	192.168.2.7	1.1.1.1	0x6c6c	Standard query (0)	gentlestream.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.461944103 CET	192.168.2.7	1.1.1.1	0x5c4c	Standard query (0)	heavynothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.472575903 CET	192.168.2.7	1.1.1.1	0x40f5	Standard query (0)	gentlenothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.505261898 CET	192.168.2.7	1.1.1.1	0x99d4	Standard query (0)	heavybottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.515866041 CET	192.168.2.7	1.1.1.1	0xd5b8	Standard query (0)	gentlebottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.538793087 CET	192.168.2.7	1.1.1.1	0x533	Standard query (0)	heavydivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.589893103 CET	192.168.2.7	1.1.1.1	0x1eda	Standard query (0)	gentledivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.633749008 CET	192.168.2.7	1.1.1.1	0x2f31	Standard query (0)	variousstream.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:41.106199980 CET	192.168.2.7	1.1.1.1	0x1e93	Standard query (0)	returnstream.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:41.164911985 CET	192.168.2.7	1.1.1.1	0x828a	Standard query (0)	variousnothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:41.222471952 CET	192.168.2.7	1.1.1.1	0x6315	Standard query (0)	returnnothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:41.501915932 CET	192.168.2.7	1.1.1.1	0x4759	Standard query (0)	variousbottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:41.788975000 CET	192.168.2.7	1.1.1.1	0x2014	Standard query (0)	returnbottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:44.869575977 CET	192.168.2.7	1.1.1.1	0x3f	Standard query (0)	variousdivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:44.946666956 CET	192.168.2.7	1.1.1.1	0x2aba	Standard query (0)	returndivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:44.958372116 CET	192.168.2.7	1.1.1.1	0x98f4	Standard query (0)	degreemanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:44.995703936 CET	192.168.2.7	1.1.1.1	0x4319	Standard query (0)	forwardmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.007930040 CET	192.168.2.7	1.1.1.1	0xefdc	Standard query (0)	degreeanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.020747900 CET	192.168.2.7	1.1.1.1	0xf5f1	Standard query (0)	forwardanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.242847919 CET	192.168.2.7	1.1.1.1	0x7ade	Standard query (0)	degreebusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.298520088 CET	192.168.2.7	1.1.1.1	0x36d1	Standard query (0)	forwardbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.494503975 CET	192.168.2.7	1.1.1.1	0x9a8c	Standard query (0)	degreeappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.522684097 CET	192.168.2.7	1.1.1.1	0xd753	Standard query (0)	forwardappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.544776917 CET	192.168.2.7	1.1.1.1	0x58f7	Standard query (0)	answermanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.636492014 CET	192.168.2.7	1.1.1.1	0x323f	Standard query (0)	glassmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.672415972 CET	192.168.2.7	1.1.1.1	0xed67	Standard query (0)	answeranother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.685192108 CET	192.168.2.7	1.1.1.1	0xcf94	Standard query (0)	glassanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.721342087 CET	192.168.2.7	1.1.1.1	0x7afe	Standard query (0)	answerbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.753844976 CET	192.168.2.7	1.1.1.1	0x327	Standard query (0)	glassbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.766288042 CET	192.168.2.7	1.1.1.1	0x2295	Standard query (0)	answerappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.781775951 CET	192.168.2.7	1.1.1.1	0x9ce3	Standard query (0)	glassappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.792460918 CET	192.168.2.7	1.1.1.1	0xe132	Standard query (0)	difficultmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.803014040 CET	192.168.2.7	1.1.1.1	0x1bdc	Standard query (0)	heardmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.834960938 CET	192.168.2.7	1.1.1.1	0x32c4	Standard query (0)	difficultanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.846095085 CET	192.168.2.7	1.1.1.1	0x5343	Standard query (0)	heardanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.856945992 CET	192.168.2.7	1.1.1.1	0xcded	Standard query (0)	difficultbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.868194103 CET	192.168.2.7	1.1.1.1	0x8eb9	Standard query (0)	heardbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.879343033 CET	192.168.2.7	1.1.1.1	0x239c	Standard query (0)	difficultappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.890355110 CET	192.168.2.7	1.1.1.1	0x7d73	Standard query (0)	heardappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.927963018 CET	192.168.2.7	1.1.1.1	0x65a9	Standard query (0)	pleasantmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.943157911 CET	192.168.2.7	1.1.1.1	0xd68e	Standard query (0)	necessarymanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.975663900 CET	192.168.2.7	1.1.1.1	0xea79	Standard query (0)	pleasantanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.986983061 CET	192.168.2.7	1.1.1.1	0x7fca	Standard query (0)	necessaryanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.996815920 CET	192.168.2.7	1.1.1.1	0xf1c2	Standard query (0)	pleasantbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.009721994 CET	192.168.2.7	1.1.1.1	0xa85f	Standard query (0)	necessarybusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.041311979 CET	192.168.2.7	1.1.1.1	0xb389	Standard query (0)	pleasantappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.073184013 CET	192.168.2.7	1.1.1.1	0x18c6	Standard query (0)	necessaryappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.084465981 CET	192.168.2.7	1.1.1.1	0xee4e	Standard query (0)	ordermanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.092950106 CET	192.168.2.7	1.1.1.1	0xd9cf	Standard query (0)	requiremanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.258414984 CET	192.168.2.7	1.1.1.1	0xb7b1	Standard query (0)	orderanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.294318914 CET	192.168.2.7	1.1.1.1	0x5092	Standard query (0)	requireanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.330678940 CET	192.168.2.7	1.1.1.1	0xd288	Standard query (0)	orderbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.341322899 CET	192.168.2.7	1.1.1.1	0x9c0f	Standard query (0)	requirebusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.355289936 CET	192.168.2.7	1.1.1.1	0xfe9e	Standard query (0)	orderappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.388036966 CET	192.168.2.7	1.1.1.1	0x725a	Standard query (0)	requireappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.399058104 CET	192.168.2.7	1.1.1.1	0x6900	Standard query (0)	leadermanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.431219101 CET	192.168.2.7	1.1.1.1	0x33b5	Standard query (0)	heavenmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.440839052 CET	192.168.2.7	1.1.1.1	0xbf2f	Standard query (0)	leaderanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.473637104 CET	192.168.2.7	1.1.1.1	0x83cb	Standard query (0)	heavenanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.483618021 CET	192.168.2.7	1.1.1.1	0x8cfc	Standard query (0)	leaderbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.516104937 CET	192.168.2.7	1.1.1.1	0x7cbd	Standard query (0)	heavenbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.528136969 CET	192.168.2.7	1.1.1.1	0x4845	Standard query (0)	leaderappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.560391903 CET	192.168.2.7	1.1.1.1	0x710	Standard query (0)	heavenappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.571386099 CET	192.168.2.7	1.1.1.1	0x3f8f	Standard query (0)	heavymanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.603563070 CET	192.168.2.7	1.1.1.1	0xed1e	Standard query (0)	gentlemanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.615854979 CET	192.168.2.7	1.1.1.1	0xd659	Standard query (0)	heavyanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.647156954 CET	192.168.2.7	1.1.1.1	0x8e27	Standard query (0)	gentleanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:47.797807932 CET	192.168.2.7	1.1.1.1	0x5bd9	Standard query (0)	heavybusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:47.809288979 CET	192.168.2.7	1.1.1.1	0xc6fd	Standard query (0)	gentlebusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:47.846888065 CET	192.168.2.7	1.1.1.1	0x9e48	Standard query (0)	heavyappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:47.877831936 CET	192.168.2.7	1.1.1.1	0xcc7a	Standard query (0)	gentleappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:47.947757959 CET	192.168.2.7	1.1.1.1	0x3af2	Standard query (0)	variousmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:47.967143059 CET	192.168.2.7	1.1.1.1	0x8fb7	Standard query (0)	returnmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.005851984 CET	192.168.2.7	1.1.1.1	0xd479	Standard query (0)	variousanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.016844988 CET	192.168.2.7	1.1.1.1	0x6165	Standard query (0)	returnanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.116158009 CET	192.168.2.7	1.1.1.1	0x1f1a	Standard query (0)	variousbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.143291950 CET	192.168.2.7	1.1.1.1	0xe64f	Standard query (0)	returnbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.222491026 CET	192.168.2.7	1.1.1.1	0xb5a9	Standard query (0)	variousappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.283291101 CET	192.168.2.7	1.1.1.1	0x7300	Standard query (0)	returnappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.333503962 CET	192.168.2.7	1.1.1.1	0xe94a	Standard query (0)	degreeinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.384469986 CET	192.168.2.7	1.1.1.1	0x7bf5	Standard query (0)	forwardinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.397708893 CET	192.168.2.7	1.1.1.1	0x9b92	Standard query (0)	degreeexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.419559956 CET	192.168.2.7	1.1.1.1	0x9567	Standard query (0)	forwardexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.892050028 CET	192.168.2.7	1.1.1.1	0x18be	Standard query (0)	degreebright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.968820095 CET	192.168.2.7	1.1.1.1	0x82d9	Standard query (0)	forwardbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:49.021589994 CET	192.168.2.7	1.1.1.1	0x29a1	Standard query (0)	degreeinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:49.069485903 CET	192.168.2.7	1.1.1.1	0xd69e	Standard query (0)	forwardinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:49.147680044 CET	192.168.2.7	1.1.1.1	0xd0b4	Standard query (0)	answerinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:49.162651062 CET	192.168.2.7	1.1.1.1	0x7bc7	Standard query (0)	glassinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:49.202260017 CET	192.168.2.7	1.1.1.1	0xba17	Standard query (0)	answerexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:49.217499018 CET	192.168.2.7	1.1.1.1	0x2021	Standard query (0)	glassexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:49.236474037 CET	192.168.2.7	1.1.1.1	0xba28	Standard query (0)	answerbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:49.255563021 CET	192.168.2.7	1.1.1.1	0xc787	Standard query (0)	glassbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:50.289617062 CET	192.168.2.7	1.1.1.1	0x6f4c	Standard query (0)	answerinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:50.300679922 CET	192.168.2.7	1.1.1.1	0x2ef5	Standard query (0)	glassinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:50.312773943 CET	192.168.2.7	1.1.1.1	0xe2f	Standard query (0)	difficultinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:50.324120998 CET	192.168.2.7	1.1.1.1	0xe3c0	Standard query (0)	heardinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:50.334965944 CET	192.168.2.7	1.1.1.1	0x3555	Standard query (0)	difficultexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:50.346837997 CET	192.168.2.7	1.1.1.1	0x65ae	Standard query (0)	heardexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:50.992711067 CET	192.168.2.7	1.1.1.1	0x391e	Standard query (0)	difficultbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:51.005141020 CET	192.168.2.7	1.1.1.1	0xaddf	Standard query (0)	heardbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:51.018274069 CET	192.168.2.7	1.1.1.1	0xbf65	Standard query (0)	difficultinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:51.031049967 CET	192.168.2.7	1.1.1.1	0xb81a	Standard query (0)	heardinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:51.062916994 CET	192.168.2.7	1.1.1.1	0x33e1	Standard query (0)	pleasantinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.147828102 CET	192.168.2.7	1.1.1.1	0xb728	Standard query (0)	necessaryinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.159425974 CET	192.168.2.7	1.1.1.1	0xfed8	Standard query (0)	pleasantexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.171077967 CET	192.168.2.7	1.1.1.1	0x3758	Standard query (0)	necessaryexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.181705952 CET	192.168.2.7	1.1.1.1	0x1a17	Standard query (0)	pleasantbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.192887068 CET	192.168.2.7	1.1.1.1	0x8c8e	Standard query (0)	necessarybright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.227081060 CET	192.168.2.7	1.1.1.1	0x8601	Standard query (0)	pleasantinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.240158081 CET	192.168.2.7	1.1.1.1	0x71e3	Standard query (0)	necessaryinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.258727074 CET	192.168.2.7	1.1.1.1	0x35d9	Standard query (0)	orderinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.291563034 CET	192.168.2.7	1.1.1.1	0xae1b	Standard query (0)	requireinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.323553085 CET	192.168.2.7	1.1.1.1	0xb210	Standard query (0)	orderexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.336600065 CET	192.168.2.7	1.1.1.1	0x9c52	Standard query (0)	requireexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.370305061 CET	192.168.2.7	1.1.1.1	0xa156	Standard query (0)	orderbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.391722918 CET	192.168.2.7	1.1.1.1	0x1908	Standard query (0)	requirebright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.403655052 CET	192.168.2.7	1.1.1.1	0xc822	Standard query (0)	orderinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.435967922 CET	192.168.2.7	1.1.1.1	0x26f3	Standard query (0)	requireinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.448168039 CET	192.168.2.7	1.1.1.1	0x8c37	Standard query (0)	leaderinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.459016085 CET	192.168.2.7	1.1.1.1	0x3e3b	Standard query (0)	heaveninstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.469578981 CET	192.168.2.7	1.1.1.1	0x1946	Standard query (0)	leaderexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.480264902 CET	192.168.2.7	1.1.1.1	0x3e55	Standard query (0)	heavenexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.512146950 CET	192.168.2.7	1.1.1.1	0xf57f	Standard query (0)	leaderbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.523240089 CET	192.168.2.7	1.1.1.1	0x1445	Standard query (0)	heavenbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.557307005 CET	192.168.2.7	1.1.1.1	0x7c9b	Standard query (0)	leaderinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.568568945 CET	192.168.2.7	1.1.1.1	0x1207	Standard query (0)	heaveninside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.581316948 CET	192.168.2.7	1.1.1.1	0x132c	Standard query (0)	heavyinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.597734928 CET	192.168.2.7	1.1.1.1	0x2e81	Standard query (0)	gentleinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.632042885 CET	192.168.2.7	1.1.1.1	0x5dde	Standard query (0)	heavyexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.645456076 CET	192.168.2.7	1.1.1.1	0x4735	Standard query (0)	gentleexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.656711102 CET	192.168.2.7	1.1.1.1	0x8961	Standard query (0)	heavybright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.667845964 CET	192.168.2.7	1.1.1.1	0x48d1	Standard query (0)	gentlebright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.676352978 CET	192.168.2.7	1.1.1.1	0xc472	Standard query (0)	heavyinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.689754009 CET	192.168.2.7	1.1.1.1	0x87c5	Standard query (0)	gentleinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.700498104 CET	192.168.2.7	1.1.1.1	0xe66a	Standard query (0)	variousinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.711838007 CET	192.168.2.7	1.1.1.1	0x3a24	Standard query (0)	returninstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.724678993 CET	192.168.2.7	1.1.1.1	0x35d2	Standard query (0)	variousexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.737308979 CET	192.168.2.7	1.1.1.1	0xa39c	Standard query (0)	returnexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.749061108 CET	192.168.2.7	1.1.1.1	0x4fc9	Standard query (0)	variousbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.760852098 CET	192.168.2.7	1.1.1.1	0xb84d	Standard query (0)	returnbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.772764921 CET	192.168.2.7	1.1.1.1	0x41d9	Standard query (0)	variousinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.805566072 CET	192.168.2.7	1.1.1.1	0xbe0b	Standard query (0)	returninside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.818880081 CET	192.168.2.7	1.1.1.1	0x2eff	Standard query (0)	degreeready.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.830318928 CET	192.168.2.7	1.1.1.1	0x3402	Standard query (0)	forwardready.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.843672991 CET	192.168.2.7	1.1.1.1	0x9f91	Standard query (0)	degreebrown.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.855798006 CET	192.168.2.7	1.1.1.1	0x4c6b	Standard query (0)	forwardbrown.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.867925882 CET	192.168.2.7	1.1.1.1	0x9870	Standard query (0)	degreepeople.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.880028963 CET	192.168.2.7	1.1.1.1	0x81f7	Standard query (0)	forwardpeople.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.891483068 CET	192.168.2.7	1.1.1.1	0x51c7	Standard query (0)	degreedaughter.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:54.863320112 CET	192.168.2.7	1.1.1.1	0x2e70	Standard query (0)	forwarddaughter.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:54.875051022 CET	192.168.2.7	1.1.1.1	0x1b3a	Standard query (0)	answerready.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.035176039 CET	192.168.2.7	1.1.1.1	0x9bb0	Standard query (0)	glassready.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.048975945 CET	192.168.2.7	1.1.1.1	0xe124	Standard query (0)	answerbrown.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.081573963 CET	192.168.2.7	1.1.1.1	0x57d7	Standard query (0)	glassbrown.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.092876911 CET	192.168.2.7	1.1.1.1	0xaa65	Standard query (0)	answerpeople.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.128062010 CET	192.168.2.7	1.1.1.1	0xd93d	Standard query (0)	glasspeople.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.161550999 CET	192.168.2.7	1.1.1.1	0xdc20	Standard query (0)	answerdaughter.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.173804045 CET	192.168.2.7	1.1.1.1	0x83a4	Standard query (0)	glassdaughter.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.184489965 CET	192.168.2.7	1.1.1.1	0xd210	Standard query (0)	difficultready.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.195979118 CET	192.168.2.7	1.1.1.1	0xd0b6	Standard query (0)	heardready.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.206831932 CET	192.168.2.7	1.1.1.1	0xf7fc	Standard query (0)	difficultbrown.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:17.318182945 CET	192.168.2.7	1.1.1.1	0x1aee	Standard query (0)	gentlebottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:18.336927891 CET	192.168.2.7	1.1.1.1	0x4fbe	Standard query (0)	heavydivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:19.354698896 CET	192.168.2.7	1.1.1.1	0x131c	Standard query (0)	gentledivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:22.129497051 CET	192.168.2.7	1.1.1.1	0xa458	Standard query (0)	returnstream.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:23.150427103 CET	192.168.2.7	1.1.1.1	0xd966	Standard query (0)	variousnothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:24.165189028 CET	192.168.2.7	1.1.1.1	0xcb16	Standard query (0)	returnnothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:25.212475061 CET	192.168.2.7	1.1.1.1	0xff40	Standard query (0)	variousbottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:29.196729898 CET	192.168.2.7	1.1.1.1	0x324b	Standard query (0)	variousdivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:30.243380070 CET	192.168.2.7	1.1.1.1	0x48ef	Standard query (0)	returndivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:31.931302071 CET	192.168.2.7	1.1.1.1	0x8e75	Standard query (0)	degreemanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:32.946608067 CET	192.168.2.7	1.1.1.1	0xda17	Standard query (0)	forwardmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:33.993242979 CET	192.168.2.7	1.1.1.1	0xf2bb	Standard query (0)	degreeanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:35.009228945 CET	192.168.2.7	1.1.1.1	0x8cb4	Standard query (0)	forwardanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:36.047905922 CET	192.168.2.7	1.1.1.1	0xdef7	Standard query (0)	degreebusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:37.088992119 CET	192.168.2.7	1.1.1.1	0xf9f1	Standard query (0)	forwardbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:38.134237051 CET	192.168.2.7	1.1.1.1	0xe535	Standard query (0)	degreeappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:39.260796070 CET	192.168.2.7	1.1.1.1	0xfc93	Standard query (0)	forwardappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:40.306925058 CET	192.168.2.7	1.1.1.1	0xc05	Standard query (0)	answermanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:41.322659969 CET	192.168.2.7	1.1.1.1	0x472d	Standard query (0)	glassmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:42.352828026 CET	192.168.2.7	1.1.1.1	0x4f3e	Standard query (0)	answeranother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:43.370385885 CET	192.168.2.7	1.1.1.1	0xebb7	Standard query (0)	glassanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:44.507329941 CET	192.168.2.7	1.1.1.1	0x3899	Standard query (0)	answerbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:45.806250095 CET	192.168.2.7	1.1.1.1	0xe017	Standard query (0)	glassbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:46.825875044 CET	192.168.2.7	1.1.1.1	0x111e	Standard query (0)	answerappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:47.852505922 CET	192.168.2.7	1.1.1.1	0x69aa	Standard query (0)	glassappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:49.165158987 CET	192.168.2.7	1.1.1.1	0xdb97	Standard query (0)	difficultmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:50.183178902 CET	192.168.2.7	1.1.1.1	0x4e21	Standard query (0)	heardmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:51.196610928 CET	192.168.2.7	1.1.1.1	0x952a	Standard query (0)	difficultanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:52.274736881 CET	192.168.2.7	1.1.1.1	0xd842	Standard query (0)	heardanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:53.402307987 CET	192.168.2.7	1.1.1.1	0x2966	Standard query (0)	difficultbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:54.385422945 CET	192.168.2.7	1.1.1.1	0x7603	Standard query (0)	heardbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:55.634200096 CET	192.168.2.7	1.1.1.1	0x15f8	Standard query (0)	difficultappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:56.556694031 CET	192.168.2.7	1.1.1.1	0x9daa	Standard query (0)	heardappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:57.640389919 CET	192.168.2.7	1.1.1.1	0xe2a3	Standard query (0)	pleasantmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:58.744445086 CET	192.168.2.7	1.1.1.1	0xea00	Standard query (0)	necessarymanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:59.587172985 CET	192.168.2.7	1.1.1.1	0xae0c	Standard query (0)	pleasantanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:00.399708986 CET	192.168.2.7	1.1.1.1	0x40	Standard query (0)	necessaryanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:01.212312937 CET	192.168.2.7	1.1.1.1	0x2afc	Standard query (0)	pleasantbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:02.149959087 CET	192.168.2.7	1.1.1.1	0xe986	Standard query (0)	necessarybusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:02.884236097 CET	192.168.2.7	1.1.1.1	0xb22a	Standard query (0)	pleasantappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:03.618550062 CET	192.168.2.7	1.1.1.1	0x496b	Standard query (0)	necessaryappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:04.321945906 CET	192.168.2.7	1.1.1.1	0x1d2e	Standard query (0)	ordermanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:04.977751970 CET	192.168.2.7	1.1.1.1	0x3d01	Standard query (0)	requiremanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:05.649920940 CET	192.168.2.7	1.1.1.1	0x20ef	Standard query (0)	orderanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:06.301430941 CET	192.168.2.7	1.1.1.1	0xdb08	Standard query (0)	requireanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:07.055938005 CET	192.168.2.7	1.1.1.1	0x10dd	Standard query (0)	orderbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:07.634098053 CET	192.168.2.7	1.1.1.1	0x8e3f	Standard query (0)	requirebusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:08.196326017 CET	192.168.2.7	1.1.1.1	0x16ec	Standard query (0)	orderappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:08.743308067 CET	192.168.2.7	1.1.1.1	0xef2e	Standard query (0)	requireappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:09.274709940 CET	192.168.2.7	1.1.1.1	0x8e68	Standard query (0)	leadermanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:09.790124893 CET	192.168.2.7	1.1.1.1	0x3978	Standard query (0)	heavenmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:10.352701902 CET	192.168.2.7	1.1.1.1	0x99c3	Standard query (0)	leaderanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:10.837445974 CET	192.168.2.7	1.1.1.1	0x68da	Standard query (0)	heavenanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:11.305897951 CET	192.168.2.7	1.1.1.1	0x13	Standard query (0)	leaderbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:11.774600983 CET	192.168.2.7	1.1.1.1	0x1752	Standard query (0)	heavenbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:12.228214979 CET	192.168.2.7	1.1.1.1	0x2149	Standard query (0)	leaderappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:12.649682045 CET	192.168.2.7	1.1.1.1	0x8ad3	Standard query (0)	heavenappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:13.056227922 CET	192.168.2.7	1.1.1.1	0x4447	Standard query (0)	heavymanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:13.446904898 CET	192.168.2.7	1.1.1.1	0x3f26	Standard query (0)	gentlemanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:13.821544886 CET	192.168.2.7	1.1.1.1	0x6cc5	Standard query (0)	heavyanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:15.727790117 CET	192.168.2.7	1.1.1.1	0xd170	Standard query (0)	heavybusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:16.071486950 CET	192.168.2.7	1.1.1.1	0xd950	Standard query (0)	gentlebusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:16.431504011 CET	192.168.2.7	1.1.1.1	0xa8a1	Standard query (0)	heavyappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:16.893035889 CET	192.168.2.7	1.1.1.1	0x69f	Standard query (0)	gentleappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:17.413999081 CET	192.168.2.7	1.1.1.1	0x805b	Standard query (0)	variousmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:18.118585110 CET	192.168.2.7	1.1.1.1	0x9951	Standard query (0)	returnmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:18.430990934 CET	192.168.2.7	1.1.1.1	0x79b6	Standard query (0)	variousanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:18.743508101 CET	192.168.2.7	1.1.1.1	0xecbd	Standard query (0)	returnanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:19.227941036 CET	192.168.2.7	1.1.1.1	0xd2b9	Standard query (0)	variousbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:19.493522882 CET	192.168.2.7	1.1.1.1	0x4968	Standard query (0)	returnbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:19.758841038 CET	192.168.2.7	1.1.1.1	0x51a	Standard query (0)	variousappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:19.789231062 CET	192.168.2.7	1.1.1.1	0x51a	Standard query (0)	variousappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:20.040896893 CET	192.168.2.7	1.1.1.1	0x1d8f	Standard query (0)	returnappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:20.070359945 CET	192.168.2.7	1.1.1.1	0x1d8f	Standard query (0)	returnappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:20.305879116 CET	192.168.2.7	1.1.1.1	0x8741	Standard query (0)	degreeinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:20.582335949 CET	192.168.2.7	1.1.1.1	0x338	Standard query (0)	forwardinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:20.604475975 CET	192.168.2.7	1.1.1.1	0x338	Standard query (0)	forwardinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:21.101937056 CET	192.168.2.7	1.1.1.1	0x273	Standard query (0)	degreeexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:21.193141937 CET	192.168.2.7	1.1.1.1	0x273	Standard query (0)	degreeexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:21.399564028 CET	192.168.2.7	1.1.1.1	0x29e9	Standard query (0)	forwardexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:21.440855026 CET	192.168.2.7	1.1.1.1	0x29e9	Standard query (0)	forwardexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:21.649555922 CET	192.168.2.7	1.1.1.1	0xa52b	Standard query (0)	degreebright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:21.853164911 CET	192.168.2.7	1.1.1.1	0xeb95	Standard query (0)	forwardbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:22.062396049 CET	192.168.2.7	1.1.1.1	0x3a92	Standard query (0)	degreeinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:22.085963964 CET	192.168.2.7	1.1.1.1	0x3a92	Standard query (0)	degreeinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:22.430793047 CET	192.168.2.7	1.1.1.1	0x493a	Standard query (0)	forwardinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:22.620712042 CET	192.168.2.7	1.1.1.1	0xb0bc	Standard query (0)	answerinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:22.806372881 CET	192.168.2.7	1.1.1.1	0x50aa	Standard query (0)	glassinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:22.836167097 CET	192.168.2.7	1.1.1.1	0x50aa	Standard query (0)	glassinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:23.096759081 CET	192.168.2.7	1.1.1.1	0x4012	Standard query (0)	answerexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:23.117966890 CET	192.168.2.7	1.1.1.1	0x4012	Standard query (0)	answerexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:23.912750006 CET	192.168.2.7	1.1.1.1	0x6593	Standard query (0)	glassexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:24.103384972 CET	192.168.2.7	1.1.1.1	0xd250	Standard query (0)	answerbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:25.337084055 CET	192.168.2.7	1.1.1.1	0xadb6	Standard query (0)	answerinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:25.367227077 CET	192.168.2.7	1.1.1.1	0xadb6	Standard query (0)	answerinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:26.382818937 CET	192.168.2.7	1.1.1.1	0xadb6	Standard query (0)	answerinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:26.557614088 CET	192.168.2.7	1.1.1.1	0x66a4	Standard query (0)	glassinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:26.592777967 CET	192.168.2.7	1.1.1.1	0x66a4	Standard query (0)	glassinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:26.728442907 CET	192.168.2.7	1.1.1.1	0x7bd6	Standard query (0)	difficultinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:26.868855953 CET	192.168.2.7	1.1.1.1	0x4966	Standard query (0)	heardinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:27.009212971 CET	192.168.2.7	1.1.1.1	0xb72e	Standard query (0)	difficultexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:27.155544043 CET	192.168.2.7	1.1.1.1	0x99ad	Standard query (0)	heardexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:27.307543993 CET	192.168.2.7	1.1.1.1	0x89d2	Standard query (0)	difficultbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:27.337090969 CET	192.168.2.7	1.1.1.1	0x89d2	Standard query (0)	difficultbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:27.462034941 CET	192.168.2.7	1.1.1.1	0x94b7	Standard query (0)	heardbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:27.591533899 CET	192.168.2.7	1.1.1.1	0xdd1d	Standard query (0)	difficultinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:27.727910995 CET	192.168.2.7	1.1.1.1	0x9acf	Standard query (0)	heardinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:29.477516890 CET	192.168.2.7	1.1.1.1	0x1839	Standard query (0)	necessaryinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:29.768317938 CET	192.168.2.7	1.1.1.1	0x7961	Standard query (0)	pleasantexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:30.338917017 CET	192.168.2.7	1.1.1.1	0x8870	Standard query (0)	necessaryexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:30.518397093 CET	192.168.2.7	1.1.1.1	0x8870	Standard query (0)	necessaryexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:30.640073061 CET	192.168.2.7	1.1.1.1	0x863c	Standard query (0)	pleasantbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:30.780633926 CET	192.168.2.7	1.1.1.1	0x8a5a	Standard query (0)	necessarybright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:30.884208918 CET	192.168.2.7	1.1.1.1	0xa4cd	Standard query (0)	pleasantinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:30.914335012 CET	192.168.2.7	1.1.1.1	0xa4cd	Standard query (0)	pleasantinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.150300980 CET	192.168.2.7	1.1.1.1	0x97b	Standard query (0)	necessaryinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.243473053 CET	192.168.2.7	1.1.1.1	0x230b	Standard query (0)	orderinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.337857962 CET	192.168.2.7	1.1.1.1	0x5da6	Standard query (0)	requireinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.433024883 CET	192.168.2.7	1.1.1.1	0xd05	Standard query (0)	orderexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.461136103 CET	192.168.2.7	1.1.1.1	0xd05	Standard query (0)	orderexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.668397903 CET	192.168.2.7	1.1.1.1	0x4d0c	Standard query (0)	requireexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.759423971 CET	192.168.2.7	1.1.1.1	0xbaf0	Standard query (0)	orderbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.837239027 CET	192.168.2.7	1.1.1.1	0x1338	Standard query (0)	requirebright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.868613005 CET	192.168.2.7	1.1.1.1	0x1338	Standard query (0)	requirebright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.946568012 CET	192.168.2.7	1.1.1.1	0x62d0	Standard query (0)	orderinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.981189013 CET	192.168.2.7	1.1.1.1	0x62d0	Standard query (0)	orderinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.055700064 CET	192.168.2.7	1.1.1.1	0x37aa	Standard query (0)	requireinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.086138010 CET	192.168.2.7	1.1.1.1	0x37aa	Standard query (0)	requireinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.150412083 CET	192.168.2.7	1.1.1.1	0xdffd	Standard query (0)	leaderinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.227852106 CET	192.168.2.7	1.1.1.1	0x6de4	Standard query (0)	heaveninstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.306739092 CET	192.168.2.7	1.1.1.1	0x1185	Standard query (0)	leaderexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.385936022 CET	192.168.2.7	1.1.1.1	0x4149	Standard query (0)	heavenexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.414309025 CET	192.168.2.7	1.1.1.1	0x4149	Standard query (0)	heavenexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.477581978 CET	192.168.2.7	1.1.1.1	0xf215	Standard query (0)	leaderbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.507901907 CET	192.168.2.7	1.1.1.1	0xf215	Standard query (0)	leaderbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.571324110 CET	192.168.2.7	1.1.1.1	0x7d56	Standard query (0)	heavenbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.601989031 CET	192.168.2.7	1.1.1.1	0x7d56	Standard query (0)	heavenbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.900717020 CET	192.168.2.7	1.1.1.1	0x23ad	Standard query (0)	leaderinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:33.073250055 CET	192.168.2.7	1.1.1.1	0xccc4	Standard query (0)	heaveninside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:33.191922903 CET	192.168.2.7	1.1.1.1	0x437a	Standard query (0)	heavyinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:33.295730114 CET	192.168.2.7	1.1.1.1	0xd495	Standard query (0)	gentleinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:33.494947910 CET	192.168.2.7	1.1.1.1	0xc5b4	Standard query (0)	heavyexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:33.768928051 CET	192.168.2.7	1.1.1.1	0xc742	Standard query (0)	gentleexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:34.138286114 CET	192.168.2.7	1.1.1.1	0x75ae	Standard query (0)	heavybright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:34.207389116 CET	192.168.2.7	1.1.1.1	0x6081	Standard query (0)	gentlebright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:34.250905037 CET	192.168.2.7	1.1.1.1	0x6081	Standard query (0)	gentlebright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:34.415200949 CET	192.168.2.7	1.1.1.1	0x850	Standard query (0)	heavyinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:34.478024006 CET	192.168.2.7	1.1.1.1	0x7389	Standard query (0)	gentleinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:34.524578094 CET	192.168.2.7	1.1.1.1	0x5cab	Standard query (0)	variousinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:34.555087090 CET	192.168.2.7	1.1.1.1	0x5cab	Standard query (0)	variousinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:34.602869987 CET	192.168.2.7	1.1.1.1	0xfb18	Standard query (0)	returninstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:34.649647951 CET	192.168.2.7	1.1.1.1	0xbfd2	Standard query (0)	variousexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:35.306086063 CET	192.168.2.7	1.1.1.1	0x86a6	Standard query (0)	returnexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:35.336247921 CET	192.168.2.7	1.1.1.1	0x86a6	Standard query (0)	returnexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:35.509063005 CET	192.168.2.7	1.1.1.1	0x287c	Standard query (0)	variousbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:35.555753946 CET	192.168.2.7	1.1.1.1	0xe04b	Standard query (0)	returnbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:35.586054087 CET	192.168.2.7	1.1.1.1	0xe04b	Standard query (0)	returnbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:35.854835033 CET	192.168.2.7	1.1.1.1	0x9691	Standard query (0)	variousinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:35.899580956 CET	192.168.2.7	1.1.1.1	0x2e33	Standard query (0)	returninside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:35.948620081 CET	192.168.2.7	1.1.1.1	0xfc5f	Standard query (0)	degreeready.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:35.993952036 CET	192.168.2.7	1.1.1.1	0x2ec7	Standard query (0)	forwardready.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:36.040404081 CET	192.168.2.7	1.1.1.1	0x5661	Standard query (0)	degreebrown.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:36.088157892 CET	192.168.2.7	1.1.1.1	0x9ce5	Standard query (0)	forwardbrown.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:36.132467031 CET	192.168.2.7	1.1.1.1	0x9ce5	Standard query (0)	forwardbrown.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:36.165267944 CET	192.168.2.7	1.1.1.1	0x984d	Standard query (0)	degreepeople.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:36.195557117 CET	192.168.2.7	1.1.1.1	0x984d	Standard query (0)	degreepeople.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:36.228594065 CET	192.168.2.7	1.1.1.1	0x6dc2	Standard query (0)	forwardpeople.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:36.258158922 CET	192.168.2.7	1.1.1.1	0x6dc2	Standard query (0)	forwardpeople.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:46.644052982 CET	192.168.2.7	1.1.1.1	0xb1c5	Standard query (0)	gentlebottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:47.668015957 CET	192.168.2.7	1.1.1.1	0x8b18	Standard query (0)	heavydivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:47.695807934 CET	192.168.2.7	1.1.1.1	0x8b18	Standard query (0)	heavydivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:48.901993036 CET	192.168.2.7	1.1.1.1	0x7542	Standard query (0)	gentledivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:48.930041075 CET	192.168.2.7	1.1.1.1	0x7542	Standard query (0)	gentledivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:51.665941954 CET	192.168.2.7	1.1.1.1	0x2ae7	Standard query (0)	returnstream.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:51.695863008 CET	192.168.2.7	1.1.1.1	0x2ae7	Standard query (0)	returnstream.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:52.801403046 CET	192.168.2.7	1.1.1.1	0x254b	Standard query (0)	variousnothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:53.822525024 CET	192.168.2.7	1.1.1.1	0x7d45	Standard query (0)	returnnothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:54.837580919 CET	192.168.2.7	1.1.1.1	0xbf5	Standard query (0)	variousbottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:58.790436029 CET	192.168.2.7	1.1.1.1	0x9f28	Standard query (0)	variousdivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:59.806617022 CET	192.168.2.7	1.1.1.1	0x9dc9	Standard query (0)	returndivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:59.836002111 CET	192.168.2.7	1.1.1.1	0x9dc9	Standard query (0)	returndivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:00.853251934 CET	192.168.2.7	1.1.1.1	0xed41	Standard query (0)	degreemanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:02.159569025 CET	192.168.2.7	1.1.1.1	0xb999	Standard query (0)	forwardmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:02.339268923 CET	192.168.2.7	1.1.1.1	0xb999	Standard query (0)	forwardmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:03.353137970 CET	192.168.2.7	1.1.1.1	0x8445	Standard query (0)	degreeanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:03.383233070 CET	192.168.2.7	1.1.1.1	0x8445	Standard query (0)	degreeanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:04.399580002 CET	192.168.2.7	1.1.1.1	0xc4a9	Standard query (0)	forwardanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:05.542633057 CET	192.168.2.7	1.1.1.1	0xd007	Standard query (0)	degreebusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:06.558545113 CET	192.168.2.7	1.1.1.1	0xd267	Standard query (0)	forwardbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:07.587553978 CET	192.168.2.7	1.1.1.1	0x8594	Standard query (0)	degreeappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:07.618638039 CET	192.168.2.7	1.1.1.1	0x8594	Standard query (0)	degreeappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:08.633991957 CET	192.168.2.7	1.1.1.1	0x6fe3	Standard query (0)	forwardappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:09.649861097 CET	192.168.2.7	1.1.1.1	0xa0ed	Standard query (0)	answermanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:09.679822922 CET	192.168.2.7	1.1.1.1	0xa0ed	Standard query (0)	answermanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:10.698786974 CET	192.168.2.7	1.1.1.1	0x7eaa	Standard query (0)	glassmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:11.712479115 CET	192.168.2.7	1.1.1.1	0x47a9	Standard query (0)	answeranother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:11.742435932 CET	192.168.2.7	1.1.1.1	0x47a9	Standard query (0)	answeranother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:12.759193897 CET	192.168.2.7	1.1.1.1	0xa857	Standard query (0)	glassanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:13.774729013 CET	192.168.2.7	1.1.1.1	0xe18c	Standard query (0)	answerbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:13.805536985 CET	192.168.2.7	1.1.1.1	0xe18c	Standard query (0)	answerbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:14.946934938 CET	192.168.2.7	1.1.1.1	0x8509	Standard query (0)	glassbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:15.962485075 CET	192.168.2.7	1.1.1.1	0x1e0	Standard query (0)	answerappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:16.977842093 CET	192.168.2.7	1.1.1.1	0xf27d	Standard query (0)	glassappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:17.993449926 CET	192.168.2.7	1.1.1.1	0xdf8e	Standard query (0)	difficultmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:19.026237011 CET	192.168.2.7	1.1.1.1	0xc45f	Standard query (0)	heardmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:19.077532053 CET	192.168.2.7	1.1.1.1	0xc45f	Standard query (0)	heardmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:20.087246895 CET	192.168.2.7	1.1.1.1	0x8c5	Standard query (0)	difficultanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:20.117229939 CET	192.168.2.7	1.1.1.1	0x8c5	Standard query (0)	difficultanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:21.395494938 CET	192.168.2.7	1.1.1.1	0xe669	Standard query (0)	heardanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:22.540474892 CET	192.168.2.7	1.1.1.1	0xc4b4	Standard query (0)	difficultbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:23.525777102 CET	192.168.2.7	1.1.1.1	0xa517	Standard query (0)	heardbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:23.554950953 CET	192.168.2.7	1.1.1.1	0xa517	Standard query (0)	heardbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:24.526809931 CET	192.168.2.7	1.1.1.1	0x6eb	Standard query (0)	difficultappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:25.463411093 CET	192.168.2.7	1.1.1.1	0xb861	Standard query (0)	heardappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:26.368493080 CET	192.168.2.7	1.1.1.1	0x972f	Standard query (0)	pleasantmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:26.398572922 CET	192.168.2.7	1.1.1.1	0x972f	Standard query (0)	pleasantmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:27.258769035 CET	192.168.2.7	1.1.1.1	0xdf06	Standard query (0)	necessarymanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:27.288976908 CET	192.168.2.7	1.1.1.1	0xdf06	Standard query (0)	necessarymanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:29.570950031 CET	192.168.2.7	1.1.1.1	0xe254	Standard query (0)	pleasantanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:30.383754969 CET	192.168.2.7	1.1.1.1	0x2ce2	Standard query (0)	necessaryanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:30.414103985 CET	192.168.2.7	1.1.1.1	0x2ce2	Standard query (0)	necessaryanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:31.196443081 CET	192.168.2.7	1.1.1.1	0x3fb9	Standard query (0)	pleasantbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.151487112 CET	192.168.2.7	1.1.1.1	0x4e3c	Standard query (0)	necessarybusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.164164066 CET	192.168.2.7	1.1.1.1	0xe6a0	Standard query (0)	pleasantappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.175600052 CET	192.168.2.7	1.1.1.1	0x181c	Standard query (0)	necessaryappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.195239067 CET	192.168.2.7	1.1.1.1	0x181c	Standard query (0)	necessaryappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.207525015 CET	192.168.2.7	1.1.1.1	0x716e	Standard query (0)	ordermanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.220139980 CET	192.168.2.7	1.1.1.1	0xb855	Standard query (0)	requiremanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.230946064 CET	192.168.2.7	1.1.1.1	0x6565	Standard query (0)	orderanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.257622004 CET	192.168.2.7	1.1.1.1	0x6565	Standard query (0)	orderanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.266495943 CET	192.168.2.7	1.1.1.1	0x9184	Standard query (0)	requireanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.277467966 CET	192.168.2.7	1.1.1.1	0x148e	Standard query (0)	orderbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.288275003 CET	192.168.2.7	1.1.1.1	0xcbb7	Standard query (0)	requirebusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.298252106 CET	192.168.2.7	1.1.1.1	0xb003	Standard query (0)	orderappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.308059931 CET	192.168.2.7	1.1.1.1	0x4caf	Standard query (0)	requireappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.335825920 CET	192.168.2.7	1.1.1.1	0x4caf	Standard query (0)	requireappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.340956926 CET	192.168.2.7	1.1.1.1	0x4860	Standard query (0)	leadermanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.351475954 CET	192.168.2.7	1.1.1.1	0x1949	Standard query (0)	heavenmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.382587910 CET	192.168.2.7	1.1.1.1	0x1949	Standard query (0)	heavenmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.384730101 CET	192.168.2.7	1.1.1.1	0xec4a	Standard query (0)	leaderanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.413872957 CET	192.168.2.7	1.1.1.1	0xec4a	Standard query (0)	leaderanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.417745113 CET	192.168.2.7	1.1.1.1	0xd023	Standard query (0)	heavenanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.445089102 CET	192.168.2.7	1.1.1.1	0xd023	Standard query (0)	heavenanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.449697971 CET	192.168.2.7	1.1.1.1	0xbd22	Standard query (0)	leaderbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.476372004 CET	192.168.2.7	1.1.1.1	0xbd22	Standard query (0)	leaderbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.483062029 CET	192.168.2.7	1.1.1.1	0x602f	Standard query (0)	heavenbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.507639885 CET	192.168.2.7	1.1.1.1	0x602f	Standard query (0)	heavenbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.516957998 CET	192.168.2.7	1.1.1.1	0x362c	Standard query (0)	leaderappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.538914919 CET	192.168.2.7	1.1.1.1	0x362c	Standard query (0)	leaderappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.549879074 CET	192.168.2.7	1.1.1.1	0xa6bd	Standard query (0)	heavenappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.564286947 CET	192.168.2.7	1.1.1.1	0x2167	Standard query (0)	heavymanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.585895061 CET	192.168.2.7	1.1.1.1	0x2167	Standard query (0)	heavymanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.595668077 CET	192.168.2.7	1.1.1.1	0xe11f	Standard query (0)	gentlemanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.607058048 CET	192.168.2.7	1.1.1.1	0x96d1	Standard query (0)	heavyanother.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 7, 2024 15:45:29.889688015 CET	1.1.1.1	192.168.2.7	0xe630	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 15:45:39.205601931 CET	1.1.1.1	192.168.2.7	0x279c	Name error (3)	heavenstream.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.222706079 CET	1.1.1.1	192.168.2.7	0xcd13	Name error (3)	leadernothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.233980894 CET	1.1.1.1	192.168.2.7	0x5afa	Name error (3)	heavennothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.266169071 CET	1.1.1.1	192.168.2.7	0x3269	Name error (3)	leaderbottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.293807030 CET	1.1.1.1	192.168.2.7	0x73b	Name error (3)	heavenbottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.326287031 CET	1.1.1.1	192.168.2.7	0xa6d6	Name error (3)	leaderdivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.378201008 CET	1.1.1.1	192.168.2.7	0xb464	Name error (3)	heavendivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.386414051 CET	1.1.1.1	192.168.2.7	0xce8c	Name error (3)	heavystream.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.418633938 CET	1.1.1.1	192.168.2.7	0x6c6c	Name error (3)	gentlestream.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.471555948 CET	1.1.1.1	192.168.2.7	0x5c4c	Name error (3)	heavynothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.503926992 CET	1.1.1.1	192.168.2.7	0x40f5	Name error (3)	gentlenothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.514765024 CET	1.1.1.1	192.168.2.7	0x99d4	Name error (3)	heavybottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.528707981 CET	1.1.1.1	192.168.2.7	0xd5b8	Name error (3)	gentlebottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.570266962 CET	1.1.1.1	192.168.2.7	0x533	Name error (3)	heavydivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:39.621146917 CET	1.1.1.1	192.168.2.7	0x1eda	Name error (3)	gentledivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:40.053379059 CET	1.1.1.1	192.168.2.7	0x2f31	No error (0)	variousstream.net	7450.bodis.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 15:45:40.053379059 CET	1.1.1.1	192.168.2.7	0x2f31	No error (0)	7450.bodis.com		199.59.243.227	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:41.138125896 CET	1.1.1.1	192.168.2.7	0x1e93	Name error (3)	returnstream.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:41.175170898 CET	1.1.1.1	192.168.2.7	0x828a	Name error (3)	variousnothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:41.235069036 CET	1.1.1.1	192.168.2.7	0x6315	Name error (3)	returnnothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:41.511198997 CET	1.1.1.1	192.168.2.7	0x4759	Name error (3)	variousbottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:41.997653008 CET	1.1.1.1	192.168.2.7	0x2014	No error (0)	returnbottle.net		18.143.155.63	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:44.899873972 CET	1.1.1.1	192.168.2.7	0x3f	Name error (3)	variousdivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:44.956662893 CET	1.1.1.1	192.168.2.7	0x2aba	Name error (3)	returndivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:44.989387989 CET	1.1.1.1	192.168.2.7	0x98f4	Name error (3)	degreemanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.003556967 CET	1.1.1.1	192.168.2.7	0x4319	Name error (3)	forwardmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.018589020 CET	1.1.1.1	192.168.2.7	0xefdc	Name error (3)	degreeanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.053020954 CET	1.1.1.1	192.168.2.7	0xf5f1	Name error (3)	forwardanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.253304005 CET	1.1.1.1	192.168.2.7	0x7ade	Name error (3)	degreebusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.308054924 CET	1.1.1.1	192.168.2.7	0x36d1	Name error (3)	forwardbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.505397081 CET	1.1.1.1	192.168.2.7	0x9a8c	Name error (3)	degreeappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.532428980 CET	1.1.1.1	192.168.2.7	0xd753	Name error (3)	forwardappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.555891991 CET	1.1.1.1	192.168.2.7	0x58f7	Name error (3)	answermanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.646226883 CET	1.1.1.1	192.168.2.7	0x323f	Name error (3)	glassmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.682687998 CET	1.1.1.1	192.168.2.7	0xed67	Name error (3)	answeranother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.717176914 CET	1.1.1.1	192.168.2.7	0xcf94	Name error (3)	glassanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.752434015 CET	1.1.1.1	192.168.2.7	0x7afe	Name error (3)	answerbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.763411999 CET	1.1.1.1	192.168.2.7	0x327	Name error (3)	glassbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.777071953 CET	1.1.1.1	192.168.2.7	0x2295	Name error (3)	answerappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.791405916 CET	1.1.1.1	192.168.2.7	0x9ce3	Name error (3)	glassappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.801882029 CET	1.1.1.1	192.168.2.7	0xe132	Name error (3)	difficultmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.833827019 CET	1.1.1.1	192.168.2.7	0x1bdc	Name error (3)	heardmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.844834089 CET	1.1.1.1	192.168.2.7	0x32c4	Name error (3)	difficultanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.855729103 CET	1.1.1.1	192.168.2.7	0x5343	Name error (3)	heardanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.867039919 CET	1.1.1.1	192.168.2.7	0xcded	Name error (3)	difficultbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.878251076 CET	1.1.1.1	192.168.2.7	0x8eb9	Name error (3)	heardbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.889200926 CET	1.1.1.1	192.168.2.7	0x239c	Name error (3)	difficultappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.925838947 CET	1.1.1.1	192.168.2.7	0x7d73	Name error (3)	heardappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.937310934 CET	1.1.1.1	192.168.2.7	0x65a9	Name error (3)	pleasantmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.974498034 CET	1.1.1.1	192.168.2.7	0xd68e	Name error (3)	necessarymanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.985542059 CET	1.1.1.1	192.168.2.7	0xea79	Name error (3)	pleasantanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:45.995786905 CET	1.1.1.1	192.168.2.7	0x7fca	Name error (3)	necessaryanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.008716106 CET	1.1.1.1	192.168.2.7	0xf1c2	Name error (3)	pleasantbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.040318966 CET	1.1.1.1	192.168.2.7	0xa85f	Name error (3)	necessarybusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.072149992 CET	1.1.1.1	192.168.2.7	0xb389	Name error (3)	pleasantappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.083511114 CET	1.1.1.1	192.168.2.7	0x18c6	Name error (3)	necessaryappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.091953993 CET	1.1.1.1	192.168.2.7	0xee4e	Name error (3)	ordermanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.257002115 CET	1.1.1.1	192.168.2.7	0xd9cf	Name error (3)	requiremanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.288775921 CET	1.1.1.1	192.168.2.7	0xb7b1	Name error (3)	orderanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.325613022 CET	1.1.1.1	192.168.2.7	0x5092	Name error (3)	requireanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.340306997 CET	1.1.1.1	192.168.2.7	0xd288	Name error (3)	orderbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.351475000 CET	1.1.1.1	192.168.2.7	0x9c0f	Name error (3)	requirebusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.387085915 CET	1.1.1.1	192.168.2.7	0xfe9e	Name error (3)	orderappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.398104906 CET	1.1.1.1	192.168.2.7	0x725a	Name error (3)	requireappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.430134058 CET	1.1.1.1	192.168.2.7	0x6900	Name error (3)	leadermanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.439989090 CET	1.1.1.1	192.168.2.7	0x33b5	Name error (3)	heavenmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.472632885 CET	1.1.1.1	192.168.2.7	0xbf2f	Name error (3)	leaderanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.482677937 CET	1.1.1.1	192.168.2.7	0x83cb	Name error (3)	heavenanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.515053034 CET	1.1.1.1	192.168.2.7	0x8cfc	Name error (3)	leaderbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.526947021 CET	1.1.1.1	192.168.2.7	0x7cbd	Name error (3)	heavenbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.559309006 CET	1.1.1.1	192.168.2.7	0x4845	Name error (3)	leaderappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.570326090 CET	1.1.1.1	192.168.2.7	0x710	Name error (3)	heavenappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.602530003 CET	1.1.1.1	192.168.2.7	0x3f8f	Name error (3)	heavymanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.615008116 CET	1.1.1.1	192.168.2.7	0xed1e	Name error (3)	gentlemanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.646024942 CET	1.1.1.1	192.168.2.7	0xd659	Name error (3)	heavyanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:46.849656105 CET	1.1.1.1	192.168.2.7	0x8e27	No error (0)	gentleanother.net		54.244.188.177	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:47.807607889 CET	1.1.1.1	192.168.2.7	0x5bd9	Name error (3)	heavybusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:47.840451002 CET	1.1.1.1	192.168.2.7	0xc6fd	Name error (3)	gentlebusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:47.856904984 CET	1.1.1.1	192.168.2.7	0x9e48	Name error (3)	heavyappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:47.887675047 CET	1.1.1.1	192.168.2.7	0xcc7a	Name error (3)	gentleappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:47.958278894 CET	1.1.1.1	192.168.2.7	0x3af2	Name error (3)	variousmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:47.997606039 CET	1.1.1.1	192.168.2.7	0x8fb7	Name error (3)	returnmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.015758991 CET	1.1.1.1	192.168.2.7	0xd479	Name error (3)	variousanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.050712109 CET	1.1.1.1	192.168.2.7	0x6165	Name error (3)	returnanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.126291037 CET	1.1.1.1	192.168.2.7	0x1f1a	Name error (3)	variousbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.173867941 CET	1.1.1.1	192.168.2.7	0xe64f	Name error (3)	returnbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.231750011 CET	1.1.1.1	192.168.2.7	0xb5a9	Name error (3)	variousappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.294966936 CET	1.1.1.1	192.168.2.7	0x7300	Name error (3)	returnappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.342644930 CET	1.1.1.1	192.168.2.7	0xe94a	Name error (3)	degreeinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.394596100 CET	1.1.1.1	192.168.2.7	0x7bf5	Name error (3)	forwardinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.407912016 CET	1.1.1.1	192.168.2.7	0x9b92	Name error (3)	degreeexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.449863911 CET	1.1.1.1	192.168.2.7	0x9567	Name error (3)	forwardexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.902751923 CET	1.1.1.1	192.168.2.7	0x18be	Name error (3)	degreebright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:48.978048086 CET	1.1.1.1	192.168.2.7	0x82d9	Name error (3)	forwardbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:49.031347036 CET	1.1.1.1	192.168.2.7	0x29a1	Name error (3)	degreeinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:49.080104113 CET	1.1.1.1	192.168.2.7	0xd69e	Name error (3)	forwardinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:49.157799959 CET	1.1.1.1	192.168.2.7	0xd0b4	Name error (3)	answerinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:49.196077108 CET	1.1.1.1	192.168.2.7	0x7bc7	Name error (3)	glassinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:49.211878061 CET	1.1.1.1	192.168.2.7	0xba17	Name error (3)	answerexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:49.226680040 CET	1.1.1.1	192.168.2.7	0x2021	Name error (3)	glassexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:49.249440908 CET	1.1.1.1	192.168.2.7	0xba28	Name error (3)	answerbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:49.655292988 CET	1.1.1.1	192.168.2.7	0xc787	No error (0)	glassbright.net	7450.bodis.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 15:45:49.655292988 CET	1.1.1.1	192.168.2.7	0xc787	No error (0)	7450.bodis.com		199.59.243.227	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:50.299163103 CET	1.1.1.1	192.168.2.7	0x6f4c	Name error (3)	answerinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:50.311077118 CET	1.1.1.1	192.168.2.7	0x2ef5	Name error (3)	glassinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:50.322791100 CET	1.1.1.1	192.168.2.7	0xe2f	Name error (3)	difficultinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:50.333774090 CET	1.1.1.1	192.168.2.7	0xe3c0	Name error (3)	heardinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:50.345694065 CET	1.1.1.1	192.168.2.7	0x3555	Name error (3)	difficultexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:51.003468037 CET	1.1.1.1	192.168.2.7	0x391e	Name error (3)	difficultbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:51.016943932 CET	1.1.1.1	192.168.2.7	0xaddf	Name error (3)	heardbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:51.029829979 CET	1.1.1.1	192.168.2.7	0xbf65	Name error (3)	difficultinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:51.061512947 CET	1.1.1.1	192.168.2.7	0xb81a	Name error (3)	heardinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:51.286855936 CET	1.1.1.1	192.168.2.7	0x33e1	No error (0)	pleasantinstead.net		18.143.155.63	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.158044100 CET	1.1.1.1	192.168.2.7	0xb728	Name error (3)	necessaryinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.169641972 CET	1.1.1.1	192.168.2.7	0xfed8	Name error (3)	pleasantexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.180339098 CET	1.1.1.1	192.168.2.7	0x3758	Name error (3)	necessaryexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.191616058 CET	1.1.1.1	192.168.2.7	0x1a17	Name error (3)	pleasantbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.225189924 CET	1.1.1.1	192.168.2.7	0x8c8e	Name error (3)	necessarybright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.238513947 CET	1.1.1.1	192.168.2.7	0x8601	Name error (3)	pleasantinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.251727104 CET	1.1.1.1	192.168.2.7	0x71e3	Name error (3)	necessaryinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.290137053 CET	1.1.1.1	192.168.2.7	0x35d9	Name error (3)	orderinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.322496891 CET	1.1.1.1	192.168.2.7	0xae1b	Name error (3)	requireinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.335423946 CET	1.1.1.1	192.168.2.7	0xb210	Name error (3)	orderexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.369194031 CET	1.1.1.1	192.168.2.7	0x9c52	Name error (3)	requireexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.390347004 CET	1.1.1.1	192.168.2.7	0xa156	Name error (3)	orderbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.402626038 CET	1.1.1.1	192.168.2.7	0x1908	Name error (3)	requirebright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.434916973 CET	1.1.1.1	192.168.2.7	0xc822	Name error (3)	orderinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.447256088 CET	1.1.1.1	192.168.2.7	0x26f3	Name error (3)	requireinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.457931995 CET	1.1.1.1	192.168.2.7	0x8c37	Name error (3)	leaderinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.468565941 CET	1.1.1.1	192.168.2.7	0x3e3b	Name error (3)	heaveninstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.479265928 CET	1.1.1.1	192.168.2.7	0x1946	Name error (3)	leaderexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.510854006 CET	1.1.1.1	192.168.2.7	0x3e55	Name error (3)	heavenexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.521965027 CET	1.1.1.1	192.168.2.7	0xf57f	Name error (3)	leaderbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.555902958 CET	1.1.1.1	192.168.2.7	0x1445	Name error (3)	heavenbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.567476988 CET	1.1.1.1	192.168.2.7	0x7c9b	Name error (3)	leaderinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.580188990 CET	1.1.1.1	192.168.2.7	0x1207	Name error (3)	heaveninside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.591973066 CET	1.1.1.1	192.168.2.7	0x132c	Name error (3)	heavyinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.630712986 CET	1.1.1.1	192.168.2.7	0x2e81	Name error (3)	gentleinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.644300938 CET	1.1.1.1	192.168.2.7	0x5dde	Name error (3)	heavyexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.655724049 CET	1.1.1.1	192.168.2.7	0x4735	Name error (3)	gentleexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.666896105 CET	1.1.1.1	192.168.2.7	0x8961	Name error (3)	heavybright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.675434113 CET	1.1.1.1	192.168.2.7	0x48d1	Name error (3)	gentlebright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.688810110 CET	1.1.1.1	192.168.2.7	0xc472	Name error (3)	heavyinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.699552059 CET	1.1.1.1	192.168.2.7	0x87c5	Name error (3)	gentleinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.710692883 CET	1.1.1.1	192.168.2.7	0xe66a	Name error (3)	variousinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.723654032 CET	1.1.1.1	192.168.2.7	0x3a24	Name error (3)	returninstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.736327887 CET	1.1.1.1	192.168.2.7	0x35d2	Name error (3)	variousexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.748059988 CET	1.1.1.1	192.168.2.7	0xa39c	Name error (3)	returnexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.759829998 CET	1.1.1.1	192.168.2.7	0x4fc9	Name error (3)	variousbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.771646976 CET	1.1.1.1	192.168.2.7	0xb84d	Name error (3)	returnbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.804122925 CET	1.1.1.1	192.168.2.7	0x41d9	Name error (3)	variousinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.817605972 CET	1.1.1.1	192.168.2.7	0xbe0b	Name error (3)	returninside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.829118967 CET	1.1.1.1	192.168.2.7	0x2eff	Name error (3)	degreeready.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.842514992 CET	1.1.1.1	192.168.2.7	0x3402	Name error (3)	forwardready.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.854720116 CET	1.1.1.1	192.168.2.7	0x9f91	Name error (3)	degreebrown.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.866816998 CET	1.1.1.1	192.168.2.7	0x4c6b	Name error (3)	forwardbrown.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.878925085 CET	1.1.1.1	192.168.2.7	0x9870	Name error (3)	degreepeople.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.890496969 CET	1.1.1.1	192.168.2.7	0x81f7	Name error (3)	forwardpeople.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:53.979002953 CET	1.1.1.1	192.168.2.7	0x51c7	No error (0)	degreedaughter.net		85.214.228.140	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:54.873836040 CET	1.1.1.1	192.168.2.7	0x2e70	Name error (3)	forwarddaughter.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.033710003 CET	1.1.1.1	192.168.2.7	0x1b3a	Name error (3)	answerready.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.047808886 CET	1.1.1.1	192.168.2.7	0x9bb0	Name error (3)	glassready.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.080410957 CET	1.1.1.1	192.168.2.7	0xe124	Name error (3)	answerbrown.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.091777086 CET	1.1.1.1	192.168.2.7	0x57d7	Name error (3)	glassbrown.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.126807928 CET	1.1.1.1	192.168.2.7	0xaa65	Name error (3)	answerpeople.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.160115004 CET	1.1.1.1	192.168.2.7	0xd93d	Name error (3)	glasspeople.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.172604084 CET	1.1.1.1	192.168.2.7	0xdc20	Name error (3)	answerdaughter.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.183147907 CET	1.1.1.1	192.168.2.7	0x83a4	Name error (3)	glassdaughter.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.194773912 CET	1.1.1.1	192.168.2.7	0xd210	Name error (3)	difficultready.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.205777884 CET	1.1.1.1	192.168.2.7	0xd0b6	Name error (3)	heardready.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:45:55.237097979 CET	1.1.1.1	192.168.2.7	0xf7fc	Name error (3)	difficultbrown.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:17.329459906 CET	1.1.1.1	192.168.2.7	0x1aee	Name error (3)	gentlebottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:18.347439051 CET	1.1.1.1	192.168.2.7	0x4fbe	Name error (3)	heavydivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:19.364573002 CET	1.1.1.1	192.168.2.7	0x131c	Name error (3)	gentledivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:22.140253067 CET	1.1.1.1	192.168.2.7	0xa458	Name error (3)	returnstream.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:23.162026882 CET	1.1.1.1	192.168.2.7	0xd966	Name error (3)	variousnothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:24.195491076 CET	1.1.1.1	192.168.2.7	0xcb16	Name error (3)	returnnothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:25.222521067 CET	1.1.1.1	192.168.2.7	0xff40	Name error (3)	variousbottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:29.231187105 CET	1.1.1.1	192.168.2.7	0x324b	Name error (3)	variousdivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:30.900557995 CET	1.1.1.1	192.168.2.7	0x48ef	Name error (3)	returndivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:31.939469099 CET	1.1.1.1	192.168.2.7	0x8e75	Name error (3)	degreemanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:32.979634047 CET	1.1.1.1	192.168.2.7	0xda17	Name error (3)	forwardmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:34.003432989 CET	1.1.1.1	192.168.2.7	0xf2bb	Name error (3)	degreeanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:35.017405987 CET	1.1.1.1	192.168.2.7	0x8cb4	Name error (3)	forwardanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:36.080646038 CET	1.1.1.1	192.168.2.7	0xdef7	Name error (3)	degreebusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:37.125143051 CET	1.1.1.1	192.168.2.7	0xf9f1	Name error (3)	forwardbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:38.165364981 CET	1.1.1.1	192.168.2.7	0xe535	Name error (3)	degreeappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:39.292295933 CET	1.1.1.1	192.168.2.7	0xfc93	Name error (3)	forwardappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:40.316740990 CET	1.1.1.1	192.168.2.7	0xc05	Name error (3)	answermanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:41.335952044 CET	1.1.1.1	192.168.2.7	0x472d	Name error (3)	glassmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:42.365339994 CET	1.1.1.1	192.168.2.7	0x4f3e	Name error (3)	answeranother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:43.382335901 CET	1.1.1.1	192.168.2.7	0xebb7	Name error (3)	glassanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:44.518202066 CET	1.1.1.1	192.168.2.7	0x3899	Name error (3)	answerbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:45.817903996 CET	1.1.1.1	192.168.2.7	0xe017	Name error (3)	glassbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:46.839298010 CET	1.1.1.1	192.168.2.7	0x111e	Name error (3)	answerappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:47.885808945 CET	1.1.1.1	192.168.2.7	0x69aa	Name error (3)	glassappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:49.175554991 CET	1.1.1.1	192.168.2.7	0xdb97	Name error (3)	difficultmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:50.193437099 CET	1.1.1.1	192.168.2.7	0x4e21	Name error (3)	heardmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:51.266875982 CET	1.1.1.1	192.168.2.7	0x952a	Name error (3)	difficultanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:52.307188988 CET	1.1.1.1	192.168.2.7	0xd842	Name error (3)	heardanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:53.413204908 CET	1.1.1.1	192.168.2.7	0x2966	Name error (3)	difficultbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:54.683372021 CET	1.1.1.1	192.168.2.7	0x7603	Name error (3)	heardbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:55.645575047 CET	1.1.1.1	192.168.2.7	0x15f8	Name error (3)	difficultappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:56.566319942 CET	1.1.1.1	192.168.2.7	0x9daa	Name error (3)	heardappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:57.880589008 CET	1.1.1.1	192.168.2.7	0xe2a3	Name error (3)	pleasantmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:58.754204035 CET	1.1.1.1	192.168.2.7	0xea00	Name error (3)	necessarymanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:47:59.597512007 CET	1.1.1.1	192.168.2.7	0xae0c	Name error (3)	pleasantanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:00.433732033 CET	1.1.1.1	192.168.2.7	0x40	Name error (3)	necessaryanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:01.408253908 CET	1.1.1.1	192.168.2.7	0x2afc	Name error (3)	pleasantbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:02.159754038 CET	1.1.1.1	192.168.2.7	0xe986	Name error (3)	necessarybusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:02.917041063 CET	1.1.1.1	192.168.2.7	0xb22a	Name error (3)	pleasantappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:03.649275064 CET	1.1.1.1	192.168.2.7	0x496b	Name error (3)	necessaryappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:04.332106113 CET	1.1.1.1	192.168.2.7	0x1d2e	Name error (3)	ordermanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:05.010143042 CET	1.1.1.1	192.168.2.7	0x3d01	Name error (3)	requiremanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:05.659559011 CET	1.1.1.1	192.168.2.7	0x20ef	Name error (3)	orderanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:06.459430933 CET	1.1.1.1	192.168.2.7	0xdb08	Name error (3)	requireanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:07.067027092 CET	1.1.1.1	192.168.2.7	0x10dd	Name error (3)	orderbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:07.643768072 CET	1.1.1.1	192.168.2.7	0x8e3f	Name error (3)	requirebusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:08.206088066 CET	1.1.1.1	192.168.2.7	0x16ec	Name error (3)	orderappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:08.751694918 CET	1.1.1.1	192.168.2.7	0xef2e	Name error (3)	requireappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:09.284990072 CET	1.1.1.1	192.168.2.7	0x8e68	Name error (3)	leadermanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:09.872879982 CET	1.1.1.1	192.168.2.7	0x3978	Name error (3)	heavenmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:10.363998890 CET	1.1.1.1	192.168.2.7	0x99c3	Name error (3)	leaderanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:10.847821951 CET	1.1.1.1	192.168.2.7	0x68da	Name error (3)	heavenanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:11.337233067 CET	1.1.1.1	192.168.2.7	0x13	Name error (3)	leaderbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:11.809323072 CET	1.1.1.1	192.168.2.7	0x1752	Name error (3)	heavenbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:12.239849091 CET	1.1.1.1	192.168.2.7	0x2149	Name error (3)	leaderappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:12.662370920 CET	1.1.1.1	192.168.2.7	0x8ad3	Name error (3)	heavenappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:13.065957069 CET	1.1.1.1	192.168.2.7	0x4447	Name error (3)	heavymanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:13.456454039 CET	1.1.1.1	192.168.2.7	0x3f26	Name error (3)	gentlemanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:14.177906036 CET	1.1.1.1	192.168.2.7	0x6cc5	Name error (3)	heavyanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:15.737447977 CET	1.1.1.1	192.168.2.7	0xd170	Name error (3)	heavybusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:16.102859020 CET	1.1.1.1	192.168.2.7	0xd950	Name error (3)	gentlebusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:16.443111897 CET	1.1.1.1	192.168.2.7	0xa8a1	Name error (3)	heavyappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:16.902192116 CET	1.1.1.1	192.168.2.7	0x69f	Name error (3)	gentleappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:17.808022022 CET	1.1.1.1	192.168.2.7	0x805b	Name error (3)	variousmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:18.128607035 CET	1.1.1.1	192.168.2.7	0x9951	Name error (3)	returnmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:18.462203979 CET	1.1.1.1	192.168.2.7	0x79b6	Name error (3)	variousanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:18.960921049 CET	1.1.1.1	192.168.2.7	0xecbd	Name error (3)	returnanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:19.237272024 CET	1.1.1.1	192.168.2.7	0xd2b9	Name error (3)	variousbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:19.503874063 CET	1.1.1.1	192.168.2.7	0x4968	Name error (3)	returnbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:19.790683985 CET	1.1.1.1	192.168.2.7	0x51a	Name error (3)	variousappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:19.796540976 CET	1.1.1.1	192.168.2.7	0x51a	Name error (3)	variousappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:20.072175026 CET	1.1.1.1	192.168.2.7	0x1d8f	Name error (3)	returnappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:20.077205896 CET	1.1.1.1	192.168.2.7	0x1d8f	Name error (3)	returnappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:20.316308022 CET	1.1.1.1	192.168.2.7	0x8741	Name error (3)	degreeinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:20.614869118 CET	1.1.1.1	192.168.2.7	0x338	Name error (3)	forwardinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:20.614895105 CET	1.1.1.1	192.168.2.7	0x338	Name error (3)	forwardinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:21.134262085 CET	1.1.1.1	192.168.2.7	0x273	Name error (3)	degreeexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:21.434356928 CET	1.1.1.1	192.168.2.7	0x29e9	Name error (3)	forwardexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:21.448807001 CET	1.1.1.1	192.168.2.7	0x29e9	Name error (3)	forwardexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:21.659688950 CET	1.1.1.1	192.168.2.7	0xa52b	Name error (3)	degreebright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:21.863521099 CET	1.1.1.1	192.168.2.7	0xeb95	Name error (3)	forwardbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:22.250886917 CET	1.1.1.1	192.168.2.7	0x3a92	Name error (3)	degreeinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:22.250904083 CET	1.1.1.1	192.168.2.7	0x3a92	Name error (3)	degreeinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:22.440489054 CET	1.1.1.1	192.168.2.7	0x493a	Name error (3)	forwardinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:22.634126902 CET	1.1.1.1	192.168.2.7	0xb0bc	Name error (3)	answerinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:22.913486958 CET	1.1.1.1	192.168.2.7	0x50aa	Name error (3)	glassinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:22.913531065 CET	1.1.1.1	192.168.2.7	0x50aa	Name error (3)	glassinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:23.127672911 CET	1.1.1.1	192.168.2.7	0x4012	Name error (3)	answerexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:23.922911882 CET	1.1.1.1	192.168.2.7	0x6593	Name error (3)	glassexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:24.114126921 CET	1.1.1.1	192.168.2.7	0xd250	Name error (3)	answerbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:26.411914110 CET	1.1.1.1	192.168.2.7	0xadb6	Name error (3)	answerinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:26.411926985 CET	1.1.1.1	192.168.2.7	0xadb6	Name error (3)	answerinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:26.412106991 CET	1.1.1.1	192.168.2.7	0xadb6	Name error (3)	answerinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:26.588625908 CET	1.1.1.1	192.168.2.7	0x66a4	Name error (3)	glassinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:26.737772942 CET	1.1.1.1	192.168.2.7	0x7bd6	Name error (3)	difficultinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:26.878453016 CET	1.1.1.1	192.168.2.7	0x4966	Name error (3)	heardinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:27.019515991 CET	1.1.1.1	192.168.2.7	0xb72e	Name error (3)	difficultexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:27.166743040 CET	1.1.1.1	192.168.2.7	0x99ad	Name error (3)	heardexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:27.339406013 CET	1.1.1.1	192.168.2.7	0x89d2	Name error (3)	difficultbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:27.471292973 CET	1.1.1.1	192.168.2.7	0x94b7	Name error (3)	heardbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:27.601310015 CET	1.1.1.1	192.168.2.7	0xdd1d	Name error (3)	difficultinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:27.737670898 CET	1.1.1.1	192.168.2.7	0x9acf	Name error (3)	heardinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:29.488197088 CET	1.1.1.1	192.168.2.7	0x1839	Name error (3)	necessaryinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:29.778662920 CET	1.1.1.1	192.168.2.7	0x7961	Name error (3)	pleasantexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:30.495100975 CET	1.1.1.1	192.168.2.7	0x8870	Name error (3)	necessaryexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:30.525641918 CET	1.1.1.1	192.168.2.7	0x8870	Name error (3)	necessaryexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:30.650337934 CET	1.1.1.1	192.168.2.7	0x863c	Name error (3)	pleasantbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:30.793802977 CET	1.1.1.1	192.168.2.7	0x8a5a	Name error (3)	necessarybright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.060096979 CET	1.1.1.1	192.168.2.7	0xa4cd	Name error (3)	pleasantinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.060117960 CET	1.1.1.1	192.168.2.7	0xa4cd	Name error (3)	pleasantinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.164114952 CET	1.1.1.1	192.168.2.7	0x97b	Name error (3)	necessaryinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.256942034 CET	1.1.1.1	192.168.2.7	0x230b	Name error (3)	orderinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.350817919 CET	1.1.1.1	192.168.2.7	0x5da6	Name error (3)	requireinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.585196972 CET	1.1.1.1	192.168.2.7	0xd05	Name error (3)	orderexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.585510969 CET	1.1.1.1	192.168.2.7	0xd05	Name error (3)	orderexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.678994894 CET	1.1.1.1	192.168.2.7	0x4d0c	Name error (3)	requireexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.769699097 CET	1.1.1.1	192.168.2.7	0xbaf0	Name error (3)	orderbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.867687941 CET	1.1.1.1	192.168.2.7	0x1338	Name error (3)	requirebright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.875946999 CET	1.1.1.1	192.168.2.7	0x1338	Name error (3)	requirebright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.978992939 CET	1.1.1.1	192.168.2.7	0x62d0	Name error (3)	orderinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:31.988354921 CET	1.1.1.1	192.168.2.7	0x62d0	Name error (3)	orderinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.087588072 CET	1.1.1.1	192.168.2.7	0x37aa	Name error (3)	requireinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.093138933 CET	1.1.1.1	192.168.2.7	0x37aa	Name error (3)	requireinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.160165071 CET	1.1.1.1	192.168.2.7	0xdffd	Name error (3)	leaderinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.239224911 CET	1.1.1.1	192.168.2.7	0x6de4	Name error (3)	heaveninstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.319255114 CET	1.1.1.1	192.168.2.7	0x1185	Name error (3)	leaderexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.416802883 CET	1.1.1.1	192.168.2.7	0x4149	Name error (3)	heavenexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.421180964 CET	1.1.1.1	192.168.2.7	0x4149	Name error (3)	heavenexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.508683920 CET	1.1.1.1	192.168.2.7	0xf215	Name error (3)	leaderbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.840837955 CET	1.1.1.1	192.168.2.7	0x7d56	Name error (3)	heavenbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.840944052 CET	1.1.1.1	192.168.2.7	0x7d56	Name error (3)	heavenbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:32.910412073 CET	1.1.1.1	192.168.2.7	0x23ad	Name error (3)	leaderinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:33.083415031 CET	1.1.1.1	192.168.2.7	0xccc4	Name error (3)	heaveninside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:33.224020958 CET	1.1.1.1	192.168.2.7	0x437a	Name error (3)	heavyinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:33.304806948 CET	1.1.1.1	192.168.2.7	0xd495	Name error (3)	gentleinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:33.504869938 CET	1.1.1.1	192.168.2.7	0xc5b4	Name error (3)	heavyexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:33.778686047 CET	1.1.1.1	192.168.2.7	0xc742	Name error (3)	gentleexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:34.149015903 CET	1.1.1.1	192.168.2.7	0x75ae	Name error (3)	heavybright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:34.364427090 CET	1.1.1.1	192.168.2.7	0x6081	Name error (3)	gentlebright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:34.364674091 CET	1.1.1.1	192.168.2.7	0x6081	Name error (3)	gentlebright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:34.425369978 CET	1.1.1.1	192.168.2.7	0x850	Name error (3)	heavyinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:34.487839937 CET	1.1.1.1	192.168.2.7	0x7389	Name error (3)	gentleinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:34.556169987 CET	1.1.1.1	192.168.2.7	0x5cab	Name error (3)	variousinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:34.562015057 CET	1.1.1.1	192.168.2.7	0x5cab	Name error (3)	variousinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:34.613326073 CET	1.1.1.1	192.168.2.7	0xfb18	Name error (3)	returninstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:35.465291977 CET	1.1.1.1	192.168.2.7	0x86a6	Name error (3)	returnexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:35.465434074 CET	1.1.1.1	192.168.2.7	0x86a6	Name error (3)	returnexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:35.519063950 CET	1.1.1.1	192.168.2.7	0x287c	Name error (3)	variousbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:35.815395117 CET	1.1.1.1	192.168.2.7	0xe04b	Name error (3)	returnbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:35.817243099 CET	1.1.1.1	192.168.2.7	0xe04b	Name error (3)	returnbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:35.864568949 CET	1.1.1.1	192.168.2.7	0x9691	Name error (3)	variousinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:35.909902096 CET	1.1.1.1	192.168.2.7	0x2e33	Name error (3)	returninside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:35.958308935 CET	1.1.1.1	192.168.2.7	0xfc5f	Name error (3)	degreeready.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:36.005693913 CET	1.1.1.1	192.168.2.7	0x2ec7	Name error (3)	forwardready.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:36.050704002 CET	1.1.1.1	192.168.2.7	0x5661	Name error (3)	degreebrown.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:36.118500948 CET	1.1.1.1	192.168.2.7	0x9ce5	Name error (3)	forwardbrown.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:36.139738083 CET	1.1.1.1	192.168.2.7	0x9ce5	Name error (3)	forwardbrown.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:36.196898937 CET	1.1.1.1	192.168.2.7	0x984d	Name error (3)	degreepeople.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:36.203749895 CET	1.1.1.1	192.168.2.7	0x984d	Name error (3)	degreepeople.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:36.259665012 CET	1.1.1.1	192.168.2.7	0x6dc2	Name error (3)	forwardpeople.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:36.265321016 CET	1.1.1.1	192.168.2.7	0x6dc2	Name error (3)	forwardpeople.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:46.654200077 CET	1.1.1.1	192.168.2.7	0xb1c5	Name error (3)	gentlebottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:47.829866886 CET	1.1.1.1	192.168.2.7	0x8b18	Name error (3)	heavydivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:47.829883099 CET	1.1.1.1	192.168.2.7	0x8b18	Name error (3)	heavydivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:48.936986923 CET	1.1.1.1	192.168.2.7	0x7542	Name error (3)	gentledivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:48.937156916 CET	1.1.1.1	192.168.2.7	0x7542	Name error (3)	gentledivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:51.700069904 CET	1.1.1.1	192.168.2.7	0x2ae7	Name error (3)	returnstream.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:51.702807903 CET	1.1.1.1	192.168.2.7	0x2ae7	Name error (3)	returnstream.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:52.811311007 CET	1.1.1.1	192.168.2.7	0x254b	Name error (3)	variousnothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:53.834790945 CET	1.1.1.1	192.168.2.7	0x7d45	Name error (3)	returnnothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:54.847590923 CET	1.1.1.1	192.168.2.7	0xbf5	Name error (3)	variousbottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:58.801486969 CET	1.1.1.1	192.168.2.7	0x9f28	Name error (3)	variousdivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:59.838306904 CET	1.1.1.1	192.168.2.7	0x9dc9	Name error (3)	returndivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:48:59.843863010 CET	1.1.1.1	192.168.2.7	0x9dc9	Name error (3)	returndivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:00.873752117 CET	1.1.1.1	192.168.2.7	0xed41	Name error (3)	degreemanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:02.191256046 CET	1.1.1.1	192.168.2.7	0xb999	Name error (3)	forwardmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:03.383965969 CET	1.1.1.1	192.168.2.7	0x8445	Name error (3)	degreeanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:03.390038967 CET	1.1.1.1	192.168.2.7	0x8445	Name error (3)	degreeanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:04.410001993 CET	1.1.1.1	192.168.2.7	0xc4a9	Name error (3)	forwardanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:05.553742886 CET	1.1.1.1	192.168.2.7	0xd007	Name error (3)	degreebusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:06.569065094 CET	1.1.1.1	192.168.2.7	0xd267	Name error (3)	forwardbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:07.621398926 CET	1.1.1.1	192.168.2.7	0x8594	Name error (3)	degreeappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:07.626070023 CET	1.1.1.1	192.168.2.7	0x8594	Name error (3)	degreeappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:08.643743992 CET	1.1.1.1	192.168.2.7	0x6fe3	Name error (3)	forwardappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:09.683768034 CET	1.1.1.1	192.168.2.7	0xa0ed	Name error (3)	answermanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:09.689234018 CET	1.1.1.1	192.168.2.7	0xa0ed	Name error (3)	answermanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:10.709177971 CET	1.1.1.1	192.168.2.7	0x7eaa	Name error (3)	glassmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:11.743356943 CET	1.1.1.1	192.168.2.7	0x47a9	Name error (3)	answeranother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:11.749572039 CET	1.1.1.1	192.168.2.7	0x47a9	Name error (3)	answeranother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:12.770028114 CET	1.1.1.1	192.168.2.7	0xa857	Name error (3)	glassanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:13.931530952 CET	1.1.1.1	192.168.2.7	0xe18c	Name error (3)	answerbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:13.931555033 CET	1.1.1.1	192.168.2.7	0xe18c	Name error (3)	answerbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:14.957216024 CET	1.1.1.1	192.168.2.7	0x8509	Name error (3)	glassbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:15.974334955 CET	1.1.1.1	192.168.2.7	0x1e0	Name error (3)	answerappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:16.987416983 CET	1.1.1.1	192.168.2.7	0xf27d	Name error (3)	glassappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:18.018956900 CET	1.1.1.1	192.168.2.7	0xdf8e	Name error (3)	difficultmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:19.060008049 CET	1.1.1.1	192.168.2.7	0xc45f	Name error (3)	heardmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:19.086890936 CET	1.1.1.1	192.168.2.7	0xc45f	Name error (3)	heardmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:20.247617006 CET	1.1.1.1	192.168.2.7	0x8c5	Name error (3)	difficultanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:20.247632027 CET	1.1.1.1	192.168.2.7	0x8c5	Name error (3)	difficultanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:21.404721022 CET	1.1.1.1	192.168.2.7	0xe669	Name error (3)	heardanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:22.551405907 CET	1.1.1.1	192.168.2.7	0xc4b4	Name error (3)	difficultbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:23.557789087 CET	1.1.1.1	192.168.2.7	0xa517	Name error (3)	heardbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:23.561767101 CET	1.1.1.1	192.168.2.7	0xa517	Name error (3)	heardbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:24.537394047 CET	1.1.1.1	192.168.2.7	0x6eb	Name error (3)	difficultappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:25.476054907 CET	1.1.1.1	192.168.2.7	0xb861	Name error (3)	heardappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:26.400167942 CET	1.1.1.1	192.168.2.7	0x972f	Name error (3)	pleasantmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:26.405486107 CET	1.1.1.1	192.168.2.7	0x972f	Name error (3)	pleasantmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:27.289585114 CET	1.1.1.1	192.168.2.7	0xdf06	Name error (3)	necessarymanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:27.296027899 CET	1.1.1.1	192.168.2.7	0xdf06	Name error (3)	necessarymanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:29.581877947 CET	1.1.1.1	192.168.2.7	0xe254	Name error (3)	pleasantanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:30.423507929 CET	1.1.1.1	192.168.2.7	0x2ce2	Name error (3)	necessaryanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:30.423638105 CET	1.1.1.1	192.168.2.7	0x2ce2	Name error (3)	necessaryanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:31.206420898 CET	1.1.1.1	192.168.2.7	0x3fb9	Name error (3)	pleasantbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.161506891 CET	1.1.1.1	192.168.2.7	0x4e3c	Name error (3)	necessarybusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.174408913 CET	1.1.1.1	192.168.2.7	0xe6a0	Name error (3)	pleasantappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.206408024 CET	1.1.1.1	192.168.2.7	0x181c	Name error (3)	necessaryappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.206418037 CET	1.1.1.1	192.168.2.7	0x181c	Name error (3)	necessaryappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.219037056 CET	1.1.1.1	192.168.2.7	0x716e	Name error (3)	ordermanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.229975939 CET	1.1.1.1	192.168.2.7	0xb855	Name error (3)	requiremanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.262800932 CET	1.1.1.1	192.168.2.7	0x6565	Name error (3)	orderanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.265744925 CET	1.1.1.1	192.168.2.7	0x6565	Name error (3)	orderanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.276480913 CET	1.1.1.1	192.168.2.7	0x9184	Name error (3)	requireanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.287267923 CET	1.1.1.1	192.168.2.7	0x148e	Name error (3)	orderbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.297280073 CET	1.1.1.1	192.168.2.7	0xcbb7	Name error (3)	requirebusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.307106018 CET	1.1.1.1	192.168.2.7	0xb003	Name error (3)	orderappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.339063883 CET	1.1.1.1	192.168.2.7	0x4caf	Name error (3)	requireappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.342976093 CET	1.1.1.1	192.168.2.7	0x4caf	Name error (3)	requireappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.350512028 CET	1.1.1.1	192.168.2.7	0x4860	Name error (3)	leadermanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.383716106 CET	1.1.1.1	192.168.2.7	0x1949	Name error (3)	heavenmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.389497042 CET	1.1.1.1	192.168.2.7	0x1949	Name error (3)	heavenmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.416784048 CET	1.1.1.1	192.168.2.7	0xec4a	Name error (3)	leaderanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.420627117 CET	1.1.1.1	192.168.2.7	0xec4a	Name error (3)	leaderanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.448662996 CET	1.1.1.1	192.168.2.7	0xd023	Name error (3)	heavenanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.452183008 CET	1.1.1.1	192.168.2.7	0xd023	Name error (3)	heavenanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.481813908 CET	1.1.1.1	192.168.2.7	0xbd22	Name error (3)	leaderbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.483397961 CET	1.1.1.1	192.168.2.7	0xbd22	Name error (3)	leaderbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.515870094 CET	1.1.1.1	192.168.2.7	0x602f	Name error (3)	heavenbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.515881062 CET	1.1.1.1	192.168.2.7	0x602f	Name error (3)	heavenbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.548527956 CET	1.1.1.1	192.168.2.7	0x362c	Name error (3)	leaderappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.548799038 CET	1.1.1.1	192.168.2.7	0x362c	Name error (3)	leaderappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.561647892 CET	1.1.1.1	192.168.2.7	0xa6bd	Name error (3)	heavenappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.594696045 CET	1.1.1.1	192.168.2.7	0x2167	Name error (3)	heavymanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.594710112 CET	1.1.1.1	192.168.2.7	0x2167	Name error (3)	heavymanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.606139898 CET	1.1.1.1	192.168.2.7	0xe11f	Name error (3)	gentlemanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:49:32.616691113 CET	1.1.1.1	192.168.2.7	0x96d1	Name error (3)	heavyanother.net	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

variousstream.net

returnbottle.net

gentleanother.net

glassbright.net

pleasantinstead.net

degreedaughter.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49736	199.59.243.227	80	5932	C:\depbjdo\ovkmkkgit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:45:40.062153101 CET	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: variousstream.net
Nov 7, 2024 15:45:41.096541882 CET	1236	IN	HTTP/1.1 200 OK date: Thu, 07 Nov 2024 14:45:40 GMT content-type: text/html; charset=utf-8 content-length: 1066 x-request-id: 269bb25d-1369-4faf-a490-8212d87ad748 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_SHWxKaDwoDowf6LK87H7CgandudCZDmQGZDfulHzF3+qa77WR6zSAOp2GnomDKEzaEbdPgFOG1Hw8AghzNNtEQ== set-cookie: parking_session=269bb25d-1369-4faf-a490-8212d87ad748; expires=Thu, 07 Nov 2024 15:00:41 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 53 48 57 78 4b 61 44 77 6f 44 6f 77 66 36 4c 4b 38 37 48 37 43 67 61 6e 64 75 64 43 5a 44 6d 51 47 5a 44 66 75 6c 48 7a 46 33 2b 71 61 37 37 57 52 36 7a 53 41 4f 70 32 47 6e 6f 6d 44 4b 45 7a 61 45 62 64 50 67 46 4f 47 31 48 77 38 41 67 68 7a 4e 4e 74 45 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_SHWxKaDwoDowf6LK87H7CgandudCZDmQGZDfulHzF3+qa77WR6zSAOp2GnomDKEzaEbdPgFOG1Hw8AghzNNtEQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 7, 2024 15:45:41.096568108 CET	519	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMjY5YmIyNWQtMTM2OS00ZmFmLWE0OTAtODIxMmQ4N2FkNzQ4IiwicGFnZV90aW1lIjoxNzMwOTkwNz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49741	18.143.155.63	80	5932	C:\depbjdo\ovkmkkgit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:45:42.022706985 CET	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: returnbottle.net
Nov 7, 2024 15:45:44.450783968 CET	387	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 14:45:44 GMT Content-Type: text/html Connection: close Set-Cookie: btst=8c47b531eb3a4f091b0dd21fd9cd9338\|173.254.250.79\|1730990744\|1730990744\|0\|1\|0; path=/; domain=.returnbottle.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.79; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49766	54.244.188.177	80	5932	C:\depbjdo\ovkmkkgit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:45:46.855274916 CET	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: gentleanother.net
Nov 7, 2024 15:45:47.679689884 CET	388	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 14:45:47 GMT Content-Type: text/html Connection: close Set-Cookie: btst=45b09316e0ec25ddd35908e58e002e71\|173.254.250.79\|1730990747\|1730990747\|0\|1\|0; path=/; domain=.gentleanother.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.79; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49779	199.59.243.227	80	5932	C:\depbjdo\ovkmkkgit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:45:49.660986900 CET	82	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: glassbright.net
Nov 7, 2024 15:45:50.287405014 CET	1236	IN	HTTP/1.1 200 OK date: Thu, 07 Nov 2024 14:45:49 GMT content-type: text/html; charset=utf-8 content-length: 1062 x-request-id: 3d5d5b00-11ce-4a43-815f-b798d607b814 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_s1OLzxnUOnEH716kBpk/hwkQW3g8J3psjBCQ57GUAZtZS2F4eueKl4iEoqmB9qt7hkS99NIC/yKfNwi3+MVPyg== set-cookie: parking_session=3d5d5b00-11ce-4a43-815f-b798d607b814; expires=Thu, 07 Nov 2024 15:00:50 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 73 31 4f 4c 7a 78 6e 55 4f 6e 45 48 37 31 36 6b 42 70 6b 2f 68 77 6b 51 57 33 67 38 4a 33 70 73 6a 42 43 51 35 37 47 55 41 5a 74 5a 53 32 46 34 65 75 65 4b 6c 34 69 45 6f 71 6d 42 39 71 74 37 68 6b 53 39 39 4e 49 43 2f 79 4b 66 4e 77 69 33 2b 4d 56 50 79 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_s1OLzxnUOnEH716kBpk/hwkQW3g8J3psjBCQ57GUAZtZS2F4eueKl4iEoqmB9qt7hkS99NIC/yKfNwi3+MVPyg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 7, 2024 15:45:50.287599087 CET	515	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiM2Q1ZDViMDAtMTFjZS00YTQzLTgxNWYtYjc5OGQ2MDdiODE0IiwicGFnZV90aW1lIjoxNzMwOTkwNz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	59007	18.143.155.63	80	5932	C:\depbjdo\ovkmkkgit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:45:51.292831898 CET	86	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: pleasantinstead.net
Nov 7, 2024 15:45:52.730571032 CET	390	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 14:45:52 GMT Content-Type: text/html Connection: close Set-Cookie: btst=12b33a0bedc117e434eac0ff2bee162c\|173.254.250.79\|1730990752\|1730990752\|0\|1\|0; path=/; domain=.pleasantinstead.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.79; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	59021	85.214.228.140	80	5932	C:\depbjdo\ovkmkkgit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:45:53.984852076 CET	85	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: degreedaughter.net
Nov 7, 2024 15:45:54.861473083 CET	176	IN	HTTP/1.0 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 07 Nov 2024 14:45:54 GMT Content-Length: 19 Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	59196	199.59.243.227	80	5580	C:\depbjdo\ovkmkkgit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:47:20.376177073 CET	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: variousstream.net
Nov 7, 2024 15:47:21.074049950 CET	1236	IN	HTTP/1.1 200 OK date: Thu, 07 Nov 2024 14:47:20 GMT content-type: text/html; charset=utf-8 content-length: 1066 x-request-id: 7fdcda0c-5c4e-4105-bc00-4876f46c71bb cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_SHWxKaDwoDowf6LK87H7CgandudCZDmQGZDfulHzF3+qa77WR6zSAOp2GnomDKEzaEbdPgFOG1Hw8AghzNNtEQ== set-cookie: parking_session=7fdcda0c-5c4e-4105-bc00-4876f46c71bb; expires=Thu, 07 Nov 2024 15:02:20 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 53 48 57 78 4b 61 44 77 6f 44 6f 77 66 36 4c 4b 38 37 48 37 43 67 61 6e 64 75 64 43 5a 44 6d 51 47 5a 44 66 75 6c 48 7a 46 33 2b 71 61 37 37 57 52 36 7a 53 41 4f 70 32 47 6e 6f 6d 44 4b 45 7a 61 45 62 64 50 67 46 4f 47 31 48 77 38 41 67 68 7a 4e 4e 74 45 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_SHWxKaDwoDowf6LK87H7CgandudCZDmQGZDfulHzF3+qa77WR6zSAOp2GnomDKEzaEbdPgFOG1Hw8AghzNNtEQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 7, 2024 15:47:21.074215889 CET	519	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiN2ZkY2RhMGMtNWM0ZS00MTA1LWJjMDAtNDg3NmY0NmM3MWJiIiwicGFnZV90aW1lIjoxNzMwOTkwOD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	59197	18.143.155.63	80	5580	C:\depbjdo\ovkmkkgit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:47:26.328320980 CET	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: returnbottle.net
Nov 7, 2024 15:47:27.754359007 CET	387	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 14:47:27 GMT Content-Type: text/html Connection: close Set-Cookie: btst=248dda240bd1f82a0ccc70f477e1e62d\|173.254.250.79\|1730990847\|1730990847\|0\|1\|0; path=/; domain=.returnbottle.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.79; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	59198	54.244.188.177	80	5580	C:\depbjdo\ovkmkkgit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:48:14.550292015 CET	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: gentleanother.net
Nov 7, 2024 15:48:15.386919022 CET	388	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 14:48:15 GMT Content-Type: text/html Connection: close Set-Cookie: btst=08352f4db869f65ff634194c9d1d77eb\|173.254.250.79\|1730990895\|1730990895\|0\|1\|0; path=/; domain=.gentleanother.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.79; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	63728	199.59.243.227	80	5580	C:\depbjdo\ovkmkkgit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:48:24.563097000 CET	82	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: glassbright.net
Nov 7, 2024 15:48:25.184014082 CET	1236	IN	HTTP/1.1 200 OK date: Thu, 07 Nov 2024 14:48:24 GMT content-type: text/html; charset=utf-8 content-length: 1062 x-request-id: 5f4db1a1-ee12-4822-8c1d-adf73e7ddaf5 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_s1OLzxnUOnEH716kBpk/hwkQW3g8J3psjBCQ57GUAZtZS2F4eueKl4iEoqmB9qt7hkS99NIC/yKfNwi3+MVPyg== set-cookie: parking_session=5f4db1a1-ee12-4822-8c1d-adf73e7ddaf5; expires=Thu, 07 Nov 2024 15:03:25 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 73 31 4f 4c 7a 78 6e 55 4f 6e 45 48 37 31 36 6b 42 70 6b 2f 68 77 6b 51 57 33 67 38 4a 33 70 73 6a 42 43 51 35 37 47 55 41 5a 74 5a 53 32 46 34 65 75 65 4b 6c 34 69 45 6f 71 6d 42 39 71 74 37 68 6b 53 39 39 4e 49 43 2f 79 4b 66 4e 77 69 33 2b 4d 56 50 79 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_s1OLzxnUOnEH716kBpk/hwkQW3g8J3psjBCQ57GUAZtZS2F4eueKl4iEoqmB9qt7hkS99NIC/yKfNwi3+MVPyg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 7, 2024 15:48:25.184308052 CET	515	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNWY0ZGIxYTEtZWUxMi00ODIyLThjMWQtYWRmNzNlN2RkYWY1IiwicGFnZV90aW1lIjoxNzMwOTkwOT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	63729	18.143.155.63	80	5580	C:\depbjdo\ovkmkkgit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:48:27.868604898 CET	86	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: pleasantinstead.net
Nov 7, 2024 15:48:29.299015045 CET	390	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 14:48:29 GMT Content-Type: text/html Connection: close Set-Cookie: btst=7c4b9fb9be845d9e2c675ca67ce72f5d\|173.254.250.79\|1730990909\|1730990909\|0\|1\|0; path=/; domain=.pleasantinstead.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.79; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	53564	85.214.228.140	80	5580	C:\depbjdo\ovkmkkgit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:48:36.295449972 CET	85	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: degreedaughter.net
Nov 7, 2024 15:48:38.201598883 CET	176	IN	HTTP/1.0 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 07 Nov 2024 14:48:37 GMT Content-Length: 19 Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Nov 7, 2024 15:48:38.202255011 CET	176	IN	HTTP/1.0 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 07 Nov 2024 14:48:37 GMT Content-Length: 19 Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Nov 7, 2024 15:48:38.203160048 CET	176	IN	HTTP/1.0 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 07 Nov 2024 14:48:37 GMT Content-Length: 19 Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	53565	199.59.243.227	80	5920	C:\depbjdo\ovkmkkgit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:48:49.973134041 CET	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: variousstream.net
Nov 7, 2024 15:48:50.629836082 CET	1236	IN	HTTP/1.1 200 OK date: Thu, 07 Nov 2024 14:48:50 GMT content-type: text/html; charset=utf-8 content-length: 1066 x-request-id: 4e43e246-88fa-4f28-ae09-3a7b20f9ec6e cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_SHWxKaDwoDowf6LK87H7CgandudCZDmQGZDfulHzF3+qa77WR6zSAOp2GnomDKEzaEbdPgFOG1Hw8AghzNNtEQ== set-cookie: parking_session=4e43e246-88fa-4f28-ae09-3a7b20f9ec6e; expires=Thu, 07 Nov 2024 15:03:50 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 53 48 57 78 4b 61 44 77 6f 44 6f 77 66 36 4c 4b 38 37 48 37 43 67 61 6e 64 75 64 43 5a 44 6d 51 47 5a 44 66 75 6c 48 7a 46 33 2b 71 61 37 37 57 52 36 7a 53 41 4f 70 32 47 6e 6f 6d 44 4b 45 7a 61 45 62 64 50 67 46 4f 47 31 48 77 38 41 67 68 7a 4e 4e 74 45 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_SHWxKaDwoDowf6LK87H7CgandudCZDmQGZDfulHzF3+qa77WR6zSAOp2GnomDKEzaEbdPgFOG1Hw8AghzNNtEQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 7, 2024 15:48:50.629859924 CET	519	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNGU0M2UyNDYtODhmYS00ZjI4LWFlMDktM2E3YjIwZjllYzZlIiwicGFnZV90aW1lIjoxNzMwOTkwOT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	53566	18.143.155.63	80	5920	C:\depbjdo\ovkmkkgit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:48:55.935058117 CET	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: returnbottle.net
Nov 7, 2024 15:48:57.390021086 CET	387	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 14:48:57 GMT Content-Type: text/html Connection: close Set-Cookie: btst=91c43822a359a6a9b656f032c9daed0b\|173.254.250.79\|1730990937\|1730990937\|0\|1\|0; path=/; domain=.returnbottle.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.79; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	53567	54.244.188.177	80

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:49:32.623164892 CET	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: gentleanother.net
Nov 7, 2024 15:49:33.465475082 CET	388	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 14:49:33 GMT Content-Type: text/html Connection: close Set-Cookie: btst=81761b52e073c2b57c828f51e5b86568\|173.254.250.79\|1730990973\|1730990973\|0\|1\|0; path=/; domain=.gentleanother.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.79; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Target ID:	0
Start time:	09:45:24
Start date:	07/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:45:24
Start date:	07/11/2024
Path:	C:\Users\user\Desktop\nnzZhhVIqM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\nnzZhhVIqM.exe"
Imagebase:	0x5a0000
File size:	365'568 bytes
MD5 hash:	D32FB5A87134EE848EC6FC2C081C333E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:45:24
Start date:	07/11/2024
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7e76d0000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	09:45:24
Start date:	07/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	09:45:24
Start date:	07/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	09:45:25
Start date:	07/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	09:45:28
Start date:	07/11/2024
Path:	C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe
Wow64 process (32bit):	true
Commandline:	"C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe"
Imagebase:	0xd30000
File size:	365'568 bytes
MD5 hash:	D32FB5A87134EE848EC6FC2C081C333E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:45:29
Start date:	07/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	09:45:31
Start date:	07/11/2024
Path:	C:\depbjdo\ovkmkkgit.exe
Wow64 process (32bit):	true
Commandline:	C:\depbjdo\ovkmkkgit.exe
Imagebase:	0x3d0000
File size:	365'568 bytes
MD5 hash:	D32FB5A87134EE848EC6FC2C081C333E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:45:36
Start date:	07/11/2024
Path:	C:\depbjdo\ktwsjztevxgl.exe
Wow64 process (32bit):	true
Commandline:	n3eh13quo7ee "c:\depbjdo\ovkmkkgit.exe"
Imagebase:	0x460000
File size:	365'568 bytes
MD5 hash:	D32FB5A87134EE848EC6FC2C081C333E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:45:38
Start date:	07/11/2024
Path:	C:\depbjdo\ovkmkkgit.exe
Wow64 process (32bit):	true
Commandline:	"C:\depbjdo\ovkmkkgit.exe"
Imagebase:	0x3d0000
File size:	365'568 bytes
MD5 hash:	D32FB5A87134EE848EC6FC2C081C333E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:18:07
Start date:	07/11/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff62ac50000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:18:07
Start date:	07/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:18:51
Start date:	07/11/2024
Path:	C:\depbjdo\ovkmkkgit.exe
Wow64 process (32bit):	true
Commandline:	"c:\depbjdo\ovkmkkgit.exe"
Imagebase:	0x3d0000
File size:	365'568 bytes
MD5 hash:	D32FB5A87134EE848EC6FC2C081C333E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:18:55
Start date:	07/11/2024
Path:	C:\depbjdo\ktwsjztevxgl.exe
Wow64 process (32bit):	true
Commandline:	n3eh13quo7ee "c:\depbjdo\ovkmkkgit.exe"
Imagebase:	0x240000
File size:	365'568 bytes
MD5 hash:	D32FB5A87134EE848EC6FC2C081C333E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:20:20
Start date:	07/11/2024
Path:	C:\depbjdo\ovkmkkgit.exe
Wow64 process (32bit):	true
Commandline:	"c:\depbjdo\ovkmkkgit.exe"
Imagebase:	0x3d0000
File size:	365'568 bytes
MD5 hash:	D32FB5A87134EE848EC6FC2C081C333E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	11:20:24
Start date:	07/11/2024
Path:	C:\depbjdo\ktwsjztevxgl.exe
Wow64 process (32bit):	true
Commandline:	n3eh13quo7ee "c:\depbjdo\ovkmkkgit.exe"
Imagebase:	0x3b0000
File size:	365'568 bytes
MD5 hash:	D32FB5A87134EE848EC6FC2C081C333E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.5%
Total number of Nodes:	1185
Total number of Limit Nodes:	11

Executed Functions

Function 005CDB90 Relevance: 7.9, APIs: 5, Instructions: 366
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 005CDD32

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5c460e8600ac6d703e00b84869cc2be6b105eb02820b50207ed42f52b3a7d356
Instruction ID: 211d5ff11550b42faf7392b1b0a2bc269778520fbd7489390b2c4b7ad06c00eb
Opcode Fuzzy Hash: 5c460e8600ac6d703e00b84869cc2be6b105eb02820b50207ed42f52b3a7d356
Instruction Fuzzy Hash: A9E1D171920685DBDB0C8F60FDDA2A97BB5FBB9310B118599D4C16B2B4D73019ACFB40

Function 005CFB40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,NZ,?,005A4EE2,00000000), ref: 005CFB6E
RtlFreeHeap.NTDLL(00000000,?,005A4EE2,00000000), ref: 005CFB75

Strings

NZ, xrefs: 005CFB68, 005CFB6B

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: NZ
API String ID: 3859560861-24465149
Opcode ID: b056a07a0ff639aa1d496a5ce19708432578c7307c01b20cc5521fa11fd69399
Instruction ID: 5aeaf43243c4058c6f3caadfef7c6bd5ecf6bce699be49bc1a5f8028021ec0a8
Opcode Fuzzy Hash: b056a07a0ff639aa1d496a5ce19708432578c7307c01b20cc5521fa11fd69399
Instruction Fuzzy Hash: D1F0DA31120685CBFB4C8F51FCDE6553B38F7B9741B410589E1C95E0A8CB70846CE715

Function 005B0700 Relevance: 4.6, APIs: 3, Instructions: 143
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 005B07CC
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 005B0848
FreeSid.ADVAPI32(?), ref: 005B0937

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: e7591abf3ab369aa79b4a198b0414847901e8d994b53c3c1adc66d21f4918731
Instruction ID: 1a3ca0443f6e91f1c9da2fc71545da5e66a779a7c0a03a9c7d2ea4557e0f5320
Opcode Fuzzy Hash: e7591abf3ab369aa79b4a198b0414847901e8d994b53c3c1adc66d21f4918731
Instruction Fuzzy Hash: 54518F75821689EBD70C9F90FDCA5BA7F75FBB8300B118885D5C11A2A8DB3119ACFB44

Function 005C18D0 Relevance: 24.4, APIs: 11, Strings: 2, Instructions: 1699fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 005C1C01
DeleteFileA.KERNELBASE(00000000,?,?,?,?,?,00000000), ref: 005C1F0E
RemoveDirectoryA.KERNELBASE(00000000,?,?,?,?,?,00000000), ref: 005C1F61
CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,00000000), ref: 005C20AF
CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 005C21B9
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005C27C9

Strings

\, xrefs: 005C2BF6
C:\Users\user, xrefs: 005C251F, 005C266E

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: Directory$Create$DeleteFileRemove
String ID: C:\Users\user$\
API String ID: 274774477-564890177
Opcode ID: 67db7f83988a5460bff56bbda5ac6c6871a8d7d26e81629575fa8a1dd2a2b056
Instruction ID: bd3415a1ce0899f6ca5a59a50b33b96fbece6f167475241d662953ffa38e7ff8
Opcode Fuzzy Hash: 67db7f83988a5460bff56bbda5ac6c6871a8d7d26e81629575fa8a1dd2a2b056
Instruction Fuzzy Hash: 53F2D374920685DBDB0C9F60FDCB6A93B70FBB8310F118859D5C56A2A8E7310A9CFB45

Function 005DDD10 Relevance: 10.9, APIs: 7, Instructions: 362
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,000000FF), ref: 005DDE87
ReadFile.KERNELBASE(00000000,00000000,?,?,00000000,?,?,?,?,000000FF), ref: 005DDEEC
CloseHandle.KERNELBASE(00000000,?,?,?,?,000000FF), ref: 005DDF39
GetTickCount.KERNEL32 ref: 005DDF9E

Part of subcall function 005A5630: lstrlenA.KERNEL32(?,?,?,005A1050,?), ref: 005A56E7

Part of subcall function 005DDAC0: wvsprintfA.USER32(00000000,?,?), ref: 005DDBE2

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 005DE1C3
WriteFile.KERNELBASE(00000000,000000FF,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 005DE1FD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 005DE216

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWritelstrlenwvsprintf
String ID:
API String ID: 3963321075-0
Opcode ID: eede55b5a0e012ea9320b875fcd347101398a830e3f3f827bfbdab94f8e7ee9d
Instruction ID: bb7e7677ee768be7e080e7b7023946dc2977a242e75a6de0bb84cff00808ad6c
Opcode Fuzzy Hash: eede55b5a0e012ea9320b875fcd347101398a830e3f3f827bfbdab94f8e7ee9d
Instruction Fuzzy Hash: D2E1DB71920695DBD70C9F20FCCA6A93B79FBB8310F114856E9C45E2B8EB7105ACEB40

Function 005CC4C0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 385
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,?,?), ref: 005CC740
WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000), ref: 005CC99C
CloseHandle.KERNEL32(00000000), ref: 005CCACD

Strings

d*, xrefs: 005CC690

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: d*
API String ID: 1065093856-3078804402
Opcode ID: c883eae1fe6d440dd882d09672622e416b3c346d7f2ad0f789b108a6b4f08b00
Instruction ID: 696fe8e83a2e3f72dded58dc2cd54195c9d4dd78fdeeef45fd8c37d51f886941
Opcode Fuzzy Hash: c883eae1fe6d440dd882d09672622e416b3c346d7f2ad0f789b108a6b4f08b00
Instruction Fuzzy Hash: 67F1B075920685DBD70C9F60FDCB2A97B70FBB8310B21485AD8C56E2A8E73105ACEF44

Function 005C7110 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 238
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 005C7370
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 005C7419
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 005C742F

Strings

D, xrefs: 005C725E

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: c1c8a65f254b7523f091922284924918c576ba3585777732f8ce006ff9deeb52
Instruction ID: 9592732a6db00dc6c22e6b395b600189300677271bd09aaf4de09d9cd4feb68b
Opcode Fuzzy Hash: c1c8a65f254b7523f091922284924918c576ba3585777732f8ce006ff9deeb52
Instruction Fuzzy Hash: C8A1C374921698DBDB0CCF50FDCA2AC7B74FB78311F20484AD5C06A2A4E7740668FB44

Function 005DD780 Relevance: 3.0, APIs: 2, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?), ref: 005DD7C9
RtlAllocateHeap.NTDLL(00000000), ref: 005DD7D0

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: dc362c4c9229628aa2079c47ae41546b9b54013542a5c7d15a002ea86a762ed3
Instruction ID: fbe14189b869a0a2462693798871f3beb0e4c8a34079af59014250e48277221c
Opcode Fuzzy Hash: dc362c4c9229628aa2079c47ae41546b9b54013542a5c7d15a002ea86a762ed3
Instruction Fuzzy Hash: 07F01C38814688EBDB08AF60F98E5687B78FB68711F100484EDC98B228EB315968E750

Function 005AFD10 Relevance: 3.0, APIs: 2, Instructions: 23
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 005AFD24
CharLowerBuffA.USER32(?,00000000), ref: 005AFD2C

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: 3efcc32339bfa4fbab542eb7168c73ccfd56c4c0d9a056f64440be2c1f3060c2
Instruction ID: 728f5536293e71c3899fa600205ca50cf636838e99a86a9b9909744e1e69b5da
Opcode Fuzzy Hash: 3efcc32339bfa4fbab542eb7168c73ccfd56c4c0d9a056f64440be2c1f3060c2
Instruction Fuzzy Hash: 79E09231111294DBC70C9F84FCC94E83B78FB2C3003044444F9C88B210D730A64DEBA9

Function 005CBE20 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 005CBE96

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: e9d085af2744d4f3328ff8b4ae995ad409cc075fe982129a37d68507042aee77
Instruction ID: 3ed5f593521db3e76f3b457e93e5283172f003624a0baca6e62ac2b5e642bd1b
Opcode Fuzzy Hash: e9d085af2744d4f3328ff8b4ae995ad409cc075fe982129a37d68507042aee77
Instruction Fuzzy Hash: 7EF06730420A96CAEB0C9F64FCCA4793F75F7B8B527104406D1C54E2A8EB3094ACE744

Non-executed Functions

Function 005BCB50 Relevance: 22.3, APIs: 10, Strings: 2, Instructions: 1280
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000), ref: 005BCF48
GetProcAddress.KERNEL32(00000000,00000000), ref: 005BD03E
FreeLibrary.KERNEL32(?), ref: 005BD0BE
HeapAlloc.KERNEL32(?,00000000,00000288), ref: 005BD182
FreeLibrary.KERNEL32(?), ref: 005BD1F3
HeapFree.KERNEL32(?,00000000,00000000), ref: 005BD2B1
HeapAlloc.KERNEL32(?,00000000,00000288), ref: 005BD2FF
FreeLibrary.KERNEL32(?), ref: 005BD37B
HeapFree.KERNEL32(?,00000000,?), ref: 005BDFD9
FreeLibrary.KERNEL32(?), ref: 005BE04A

Strings

"1)s, xrefs: 005BDFEB
C$^ , xrefs: 005BE056

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: Free$Library$Heap$Alloc$AddressLoadProc
String ID: "1)s$C$^
API String ID: 929271168-1225272945
Opcode ID: 820802a8849bc06eb6ac95ef51f6a901c1a9533b1f120b6aabfa23bb80bb7ef4
Instruction ID: 7ba0d3999b74de48509f51248a7a73b5968ff405803740d84b5d9c7cd6c74676
Opcode Fuzzy Hash: 820802a8849bc06eb6ac95ef51f6a901c1a9533b1f120b6aabfa23bb80bb7ef4
Instruction Fuzzy Hash: E4C2AF74920696CBDB0C9F60FCCA1A93B71FBB8310B11885AD4C56E2B8E73514ADEF54

Function 005AD0F0 Relevance: 20.9, APIs: 10, Strings: 1, Instructions: 1611COMMON

Download Yara Rule

Strings

/, xrefs: 005AD4DD

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: lstrlen
String ID: /
API String ID: 1659193697-2043925204
Opcode ID: 950028a92d13033c299824d624826c288068baf5d7c07299b5c730d5b94fbb4d
Instruction ID: dea40b9332c11bbbeccf579ab74fcd770c7b0d3c620baa9784610f20878756d7
Opcode Fuzzy Hash: 950028a92d13033c299824d624826c288068baf5d7c07299b5c730d5b94fbb4d
Instruction Fuzzy Hash: 89E2C174920699DBDB0C9F60FDCA2AC7B74FBB9300B11485AD4C15A2B4EB3119ACEB51

Function 005D0FE0 Relevance: 12.3, APIs: 8, Instructions: 309serviceCOMMON

Download Yara Rule

APIs

CreateServiceA.ADVAPI32(00000000,0135FCE0,0135FCE0,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 005D11BF
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 005D121F
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 005D1259
CloseServiceHandle.ADVAPI32(00000000), ref: 005D1290
OpenServiceA.ADVAPI32(00000000,0135FCE0,00000010), ref: 005D12E0
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 005D133D
CloseServiceHandle.ADVAPI32(00000000), ref: 005D1368
CloseServiceHandle.ADVAPI32(00000000), ref: 005D1483

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: Service$CloseHandle$Start$ChangeConfig2CreateOpen
String ID:
API String ID: 229943926-0
Opcode ID: 977cbc3ac7264db5eef67a53838a4689852f5339164cfb268e85106dd6618430
Instruction ID: b5b457ba42a99c0e7860a38dbfcee5bdc2619e2af0058b02162c721aba10c2e1
Opcode Fuzzy Hash: 977cbc3ac7264db5eef67a53838a4689852f5339164cfb268e85106dd6618430
Instruction Fuzzy Hash: 29D16D74920689EBE70C9F64FCCA2A87B78F7B8310F114856D5C55E2A8EB7104ACEB44

Function 005BE380 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 575serviceCOMMON

Download Yara Rule

APIs

EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,00000000), ref: 005BE5D9
GetLastError.KERNEL32 ref: 005BE61F
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,00000000), ref: 005BE74C

Part of subcall function 005A5630: lstrlenA.KERNEL32(?,?,?,005A1050,?), ref: 005A56E7

Part of subcall function 005A5630: lstrlenA.KERNEL32(?,?,?,005A1050,?), ref: 005A5719

CloseServiceHandle.ADVAPI32(00000000), ref: 005BEB72

Part of subcall function 005DDAC0: wvsprintfA.USER32(00000000,?,?), ref: 005DDBE2

Strings

Ntas, xrefs: 005BEABA

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: EnumServicesStatuslstrlen$CloseErrorHandleLastServicewvsprintf
String ID: Ntas
API String ID: 4050264455-3164424958
Opcode ID: d9d0442065f438da809be33932b7a7deafa835a33b300f4a71091905f63d1958
Instruction ID: 6291192fb62cdd1b883c70dab5c03eca6ae44dff9cf6a2b1a1af6e4a20dedc7f
Opcode Fuzzy Hash: d9d0442065f438da809be33932b7a7deafa835a33b300f4a71091905f63d1958
Instruction Fuzzy Hash: 5842AD74920685DBDB0C8F60FCCB1A93BB5FBB8310B15485AD4C56E2A8E77119ACFB41

Function 005C9460 Relevance: 7.9, APIs: 5, Instructions: 404processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 005C9600

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: 884b1bac008d518abfca098f7c90cc7d389137c6d1dd1f02cd5ed4c1577b9a25
Instruction ID: d73948bf019216c0bb81a730e766ca543272ca42267976cae7244cf1b1cd6393
Opcode Fuzzy Hash: 884b1bac008d518abfca098f7c90cc7d389137c6d1dd1f02cd5ed4c1577b9a25
Instruction Fuzzy Hash: 5102C074821699DBDB0C9F60FDCE2A97BB4FBB8311F11449AD4C56A2A4EB35059CFB00

Function 005AC3D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,?,?,?,005A5258), ref: 005AC482
SystemTimeToFileTime.KERNEL32(?,XRZ,?,?,?,?,005A5258), ref: 005AC4CD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005AC536

Strings

XRZ, xrefs: 005AC4C5, 005AC4C8

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: Time$System$FileUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: XRZ
API String ID: 1858273683-2665292070
Opcode ID: 1817e5c0265bf7d5dfa65dfb41796ae94c59c7bebff8a644987eec8baf9e112a
Instruction ID: 9f6ba47d84247e132345876ec0c2041316703ca0864596401a60662eb3a383f0
Opcode Fuzzy Hash: 1817e5c0265bf7d5dfa65dfb41796ae94c59c7bebff8a644987eec8baf9e112a
Instruction Fuzzy Hash: B8419D35920689DBDB0CCF50FECA5683B76FBB8310B218596C5C05A2A8E734496DEB05

Function 005E19A0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 005E19D3

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: 273c909155d064be5923fd5df25fd36f97631e14c9ba69e2099afecd3cdae4ec
Instruction ID: 1ea2ceef35210e4f2b5c54b133b091208bf82b44ca6bbb1abb595a9ec936b5a7
Opcode Fuzzy Hash: 273c909155d064be5923fd5df25fd36f97631e14c9ba69e2099afecd3cdae4ec
Instruction Fuzzy Hash: 65E09274C10348C7DB08DFA4FC8D0A97BB4F768310B000995D8C59B250EB30112CDB50

Function 005C5760 Relevance: .6, Instructions: 602COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 061079980c75ccf6554950b239fd957acf8be153181a9d0a19e69f44d484cd56
Instruction ID: f32a1ef45ccece6c7137ca165ae310f1fee7c5d911d708b8df0e5b5567ae06a6
Opcode Fuzzy Hash: 061079980c75ccf6554950b239fd957acf8be153181a9d0a19e69f44d484cd56
Instruction Fuzzy Hash: 8A42C475D20689DBDB0CDF50FDCA1987F70FBA8310B218459D8C5AB2A8E73159ACEB44

Function 005BFFA0 Relevance: 12.3, APIs: 8, Instructions: 331registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(0135FCE0,005C9E30), ref: 005C0120
SetServiceStatus.ADVAPI32(00000000,005EE98C), ref: 005C01D1
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 005C01FE
SetServiceStatus.ADVAPI32(00000000,005EE98C), ref: 005C0283
WaitForSingleObject.KERNEL32(00000000,00001388), ref: 005C02F7
SetServiceStatus.ADVAPI32(00000000,005EE98C), ref: 005C0462
CloseHandle.KERNEL32(00000000), ref: 005C0481
SetServiceStatus.ADVAPI32(00000000,005EE98C), ref: 005C0537

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: 5b406cb065c4630e36527494a0b7a9d17d7e38c9d7eb1f247265eb3ae6fd0ca8
Instruction ID: db4be37be9704ffa081426138a79ab593e81102eb0007f99f705e7cd9b916550
Opcode Fuzzy Hash: 5b406cb065c4630e36527494a0b7a9d17d7e38c9d7eb1f247265eb3ae6fd0ca8
Instruction Fuzzy Hash: B4F17C75921699DBDB0C9F60FDCB1A83BB4F7B8300B11494AD4C5AA2B8E731066CFB05

Function 005CB2B0 Relevance: 9.3, APIs: 6, Instructions: 295filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 005CB3EF
GetFileTime.KERNEL32(00000000,?,?,?), ref: 005CB485
CloseHandle.KERNEL32(00000000), ref: 005CB4C7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005CB5BA
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 005CB60F
CloseHandle.KERNEL32(00000000), ref: 005CB681

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: e6f134a70ebd24a3ef50b4f06e1cb63594b2b773e61405b080a271c84f7cb84b
Instruction ID: 3d740d3b4ba371aec3393a1e66d823e9dbe6756ccc74a70314f1122ed0cc9d59
Opcode Fuzzy Hash: e6f134a70ebd24a3ef50b4f06e1cb63594b2b773e61405b080a271c84f7cb84b
Instruction Fuzzy Hash: E4C1D174A21285DBD70C9F50FDCB6A87BB0FBA8710B21484AD4C45A2B8E73119ACEF45

Function 005C8A40 Relevance: 7.6, APIs: 5, Instructions: 85synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000001,005B1B96), ref: 005C8AAF
CreateThread.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 005C8AE5
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005C8B16
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 005C8B33
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005C8B70

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 370c349fa2f10487f448084261e71b17b5ce118d6c38829f3096b65bebf53257
Instruction ID: 53c236f349961b01d349e378fb56014fd88de7ae14a1a7f2ec1f573a28cd8e9f
Opcode Fuzzy Hash: 370c349fa2f10487f448084261e71b17b5ce118d6c38829f3096b65bebf53257
Instruction Fuzzy Hash: D3315A751203A4DBD70C8F15ECCBB793BE4FB28711F00842AE9C58E6A4E374A459EB15

Function 005BFD20 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,?,?,005CFC72), ref: 005BFD5F
GetStdHandle.KERNEL32(000000F5,00000000,?,?,005CFC72), ref: 005BFDD0
GetStdHandle.KERNEL32(000000F4,00000000,?,?,005CFC72), ref: 005BFE09

Strings

^, xrefs: 005BFE0C
^, xrefs: 005BFD62

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: Handle
String ID: ^$^
API String ID: 2519475695-2639860436
Opcode ID: 58f4cf27332b61745fe4ef2066c24723616b10f3ece0932f58f66b0288775a9b
Instruction ID: a4cb619bea4f21fdb562b3f7b357bc1a03fd156b528b78e456d1a27481f9edef
Opcode Fuzzy Hash: 58f4cf27332b61745fe4ef2066c24723616b10f3ece0932f58f66b0288775a9b
Instruction Fuzzy Hash: 6E314874924294EBCB089F66FCCB0683FB4FBB83217218556E4C59B2B4DA30096CEB55

Function 005CB860 Relevance: 6.3, APIs: 4, Instructions: 327fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005CB986
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 005CBAA4
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 005CBC19
CloseHandle.KERNEL32(00000000,?,00000000), ref: 005CBD24

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: CloseFileHandle$CreateRead
String ID:
API String ID: 2564258376-0
Opcode ID: 8379d6f967020b32e3ba8c63ad68380b7edd82ab1b7c3aa3997a2e02f5066d76
Instruction ID: ba8e0bc81b0a3851b29a09538164549be090778759a5b6a6fd4b8fc238348b3c
Opcode Fuzzy Hash: 8379d6f967020b32e3ba8c63ad68380b7edd82ab1b7c3aa3997a2e02f5066d76
Instruction Fuzzy Hash: 1CD1DD74820685DBEB0C9F50FECA6A93BB9FBA8311F11444AD5C05E2A8E771099CFB41

Function 005DFC20 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 469sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 005DABB0: CloseHandle.KERNEL32(00000000,00000000,00000001,00000000), ref: 005DABFF

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 005E0099
Sleep.KERNEL32(00015F90), ref: 005E031A

Strings

Hbu, xrefs: 005DFEB4

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: CloseFileHandleModuleNameSleep
String ID: Hbu
API String ID: 420089116-125748917
Opcode ID: f824786fdd462896a7505ee707e1fff27de3b706689b7d02507060bcb8d50548
Instruction ID: 25a9294c2588ce252c4502bb7e3ae5102e434eb7a4573e0312e761c56d3061a2
Opcode Fuzzy Hash: f824786fdd462896a7505ee707e1fff27de3b706689b7d02507060bcb8d50548
Instruction Fuzzy Hash: 8212BB75921685DBD70C9F60FCCB6A93BB5FBB8310B11449AD8C19E2A4E73009ACFB44

Function 005BC930 Relevance: 5.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,?), ref: 005BC9A4
HeapReAlloc.KERNEL32(00000000), ref: 005BC9AB
GetProcessHeap.KERNEL32(00000000,?,00000000,?), ref: 005BC9C5
HeapAlloc.KERNEL32(00000000), ref: 005BC9CC

Memory Dump Source

Source File: 00000001.00000002.1372838922.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000001.00000002.1372822189.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372869278.00000000005E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372886308.00000000005EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1372900783.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a0000_nnzZhhVIqM.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: cf9098e5e55e0486499ebe3581da353148c70e4fd2c945dc89211b7837556692
Instruction ID: 6438f0100abd755d460c45ec15db46846505d2288bd8a6f32d8e1f8eb3cb099a
Opcode Fuzzy Hash: cf9098e5e55e0486499ebe3581da353148c70e4fd2c945dc89211b7837556692
Instruction Fuzzy Hash: 93113074915288EBDB08DFA1E98D5AD7BB8FF68311F008059FD898B260D6314A48EB52

Analysis Process: jbmx3cphxnwpllpjrowiz.exePID: 1264, Parent PID: 2940COMMON

Execution Graph

Execution Coverage:	13.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	1211
Total number of Limit Nodes:	12

Executed Functions

Function 00D4CB50 Relevance: 27.5, APIs: 12, Strings: 3, Instructions: 1280
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(00000000), ref: 00D4CF48
GetProcAddress.KERNEL32(00000000,00000000), ref: 00D4D03E
FreeLibrary.KERNEL32(?), ref: 00D4D0BE
HeapAlloc.KERNEL32(?,00000000,00000288), ref: 00D4D182
FreeLibrary.KERNEL32(?), ref: 00D4D1F3
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 00D4D242
HeapFree.KERNEL32(?,00000000,00000000), ref: 00D4D2B1
HeapAlloc.KERNEL32(?,00000000,00000288), ref: 00D4D2FF
FreeLibrary.KERNEL32(?), ref: 00D4D37B
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 00D4D426
HeapFree.KERNEL32(?,00000000,?), ref: 00D4DFD9
FreeLibrary.KERNEL32(?), ref: 00D4E04A

Strings

Mks?, xrefs: 00D4CCF6, 00D4CD01, 00D4D718, 00D4DEC4
"1)s, xrefs: 00D4DFEB
C$^ , xrefs: 00D4E056

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: Free$Library$Heap$AdaptersAllocInfo$AddressLoadProc
String ID: "1)s$C$^ $Mks?
API String ID: 2823868357-3323750774
Opcode ID: 01b3a785ca7affb4f4c3bf82de0b2f3f695f3725bfeb569416f1a939811497b0
Instruction ID: 1640ac1c3c58ad24b9d8d2af7271986c5baf507eb9ba91c0f98499f30a73a67a
Opcode Fuzzy Hash: 01b3a785ca7affb4f4c3bf82de0b2f3f695f3725bfeb569416f1a939811497b0
Instruction Fuzzy Hash: E2C2B97090071ACBD7049F60FC892A93BB1FB9C319B51859AD88DE63A5FB3544E4CBB4

Function 00D60FE0 Relevance: 13.8, APIs: 9, Instructions: 309
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.SECHOST(00000000,00000000,00000002), ref: 00D6113E
CreateServiceA.ADVAPI32(00000000,00EA03E0,00EA03E0,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00D611BF
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00D6121F
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00D61259
CloseServiceHandle.SECHOST(00000000), ref: 00D61290
OpenServiceA.ADVAPI32(00000000,00EA03E0,00000010), ref: 00D612E0
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00D6133D
CloseServiceHandle.ADVAPI32(00000000), ref: 00D61368
CloseServiceHandle.ADVAPI32(00000000), ref: 00D61483

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID:
API String ID: 3525021261-0
Opcode ID: 20c3614ad64ece4c487c95c428451e3bf4bc6a0d9cf0dbdce0523f457d4728b7
Instruction ID: 46bb74b3933e7207f009d728fd0688e2423b80ac3a146f4ef973d929353663b2
Opcode Fuzzy Hash: 20c3614ad64ece4c487c95c428451e3bf4bc6a0d9cf0dbdce0523f457d4728b7
Instruction Fuzzy Hash: 70D14574900718EBE7049F60EC892A87B74FB8C319F2589DAD589E63A4FB7044E0CB74

Function 00D518D0 Relevance: 26.2, APIs: 11, Strings: 3, Instructions: 1699fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00D51C01
DeleteFileA.KERNELBASE(00000000,?,?,?,?,?,00000000), ref: 00D51F0E
RemoveDirectoryA.KERNELBASE(00000000,?,?,?,?,?,00000000), ref: 00D51F61
CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,00000000), ref: 00D520AF
CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00D521B9
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D527C9

Strings

C:\Users\user, xrefs: 00D5251F, 00D5266E
Mks?, xrefs: 00D51AC0
\, xrefs: 00D52BF6

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: Directory$Create$DeleteFileRemove
String ID: C:\Users\user$Mks?$\
API String ID: 274774477-2600972573
Opcode ID: dab98cc99ace8a09f9bc32633fd0dcf6e8c02e4198938562112925a9aa7e84a2
Instruction ID: c1fa7ed90bd896314eeb7ef64d61e528a1c894b70f0e8eb68a78a408a68f17ea
Opcode Fuzzy Hash: dab98cc99ace8a09f9bc32633fd0dcf6e8c02e4198938562112925a9aa7e84a2
Instruction Fuzzy Hash: C2F2AB70900709DBDB049F60FD592A87B70FB8D319B1188D9D889E63A5FB3149E8CB75

Function 00D707E0 Relevance: 11.4, APIs: 1, Strings: 5, Instructions: 933
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameA.KERNEL32(?,00000010), ref: 00D70A89

Strings

@, xrefs: 00D70A14, 00D70A1B, 00D71656
h., xrefs: 00D71246
X9, xrefs: 00D7100B
Mks?, xrefs: 00D7127F, 00D71296, 00D7163D, 00D71650
h?, xrefs: 00D70F42

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: ComputerName
String ID: @$Mks?$X9$h?$h.
API String ID: 3545744682-3398469575
Opcode ID: fca5918259baa9f7f93e44a25db01607480ef3db5007595dde899a0e6d5393d1
Instruction ID: 6a1eb06fc2ac3152cd48dd9bf6b3cf326a069ee5caf469febdec35c5394bcf4f
Opcode Fuzzy Hash: fca5918259baa9f7f93e44a25db01607480ef3db5007595dde899a0e6d5393d1
Instruction Fuzzy Hash: 17928774900709DBEB049F60FD8A5A83B70FB8C319B618499D889E63B5FB3045E4CB71

Function 00D5C4C0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 385
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,?,?), ref: 00D5C740
WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000), ref: 00D5C99C
CloseHandle.KERNELBASE(00000000), ref: 00D5CACD

Strings

d*, xrefs: 00D5C690

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: d*
API String ID: 1065093856-3078804402
Opcode ID: 9f4a3eeb95e78c01cd6934f5da376a427b1006c25bdd5b5c6072800633441ce1
Instruction ID: 1903da96916b99c40306762aa01c95bbc29fc530d101f4cca994a483573dc8f0
Opcode Fuzzy Hash: 9f4a3eeb95e78c01cd6934f5da376a427b1006c25bdd5b5c6072800633441ce1
Instruction Fuzzy Hash: 30F19B70900718DBE7049F60FD892A97BB0FB9C316B6185DAD888E63A4F73145E4CBB5

Function 00D57110 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 238
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00D57370
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00D57419
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 00D5742F

Strings

D, xrefs: 00D5725E

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 4040128dee0a45ec317109f25c5696acde378802e197d5cb739124741c12a4d0
Instruction ID: ade17a5ef7937c2085f4c64818d9acc00981d9d14929ad4059d3ef8cf306b86e
Opcode Fuzzy Hash: 4040128dee0a45ec317109f25c5696acde378802e197d5cb739124741c12a4d0
Instruction Fuzzy Hash: AEA17A70905718EBDB008F51FA492A87B74FB8C716F2145CAD888E63A5FB7446E0DB78

Function 00D5B860 Relevance: 6.3, APIs: 4, Instructions: 327
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D5B986
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 00D5BAA4
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00D5BC19
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00D5BD24

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: CloseFileHandle$CreateRead
String ID:
API String ID: 2564258376-0
Opcode ID: 5ef980c692d77e47ead63a98b3a9113e9e9adf6bef039c23a9ee3672e4d248fd
Instruction ID: 27ad5a7a09a374cc37590ea0e9f767380ef8e74541e41ff2567a7849743c7bc2
Opcode Fuzzy Hash: 5ef980c692d77e47ead63a98b3a9113e9e9adf6bef039c23a9ee3672e4d248fd
Instruction Fuzzy Hash: 24D1BA71901708DBEB009F60FE492A87BB4FB8C316B1145D6E988DA3A4FB7049E0DB75

Function 00D40700 Relevance: 4.6, APIs: 3, Instructions: 143
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00D407CC
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 00D40848
FreeSid.ADVAPI32(?), ref: 00D40937

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 98aefa0d05e577b150e57cdb46c198f7db7e18dec0906e1ec5daf5f023843435
Instruction ID: f889bf6e9bdb161b83b27a048f8cc68baabd0099e9259928078d4560879e464c
Opcode Fuzzy Hash: 98aefa0d05e577b150e57cdb46c198f7db7e18dec0906e1ec5daf5f023843435
Instruction Fuzzy Hash: 29514670804709EBD7009FA0FD495A97B78FB9C309B5188DAD988E6365FB3049E4CBB4

Function 00D31470 Relevance: 3.4, APIs: 2, Instructions: 407
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76850000,00000000), ref: 00D31703
GetProcAddress.KERNEL32(76850000,00000000), ref: 00D317E5

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: cf64781c77db6a31264183baf9347835e04e1f06d82d5b1ac244277add5deb93
Instruction ID: 86094f550fb26b033f18b4ce3aef210ad8c247d6358c2d0f1d237c1e761e4795
Opcode Fuzzy Hash: cf64781c77db6a31264183baf9347835e04e1f06d82d5b1ac244277add5deb93
Instruction Fuzzy Hash: B60246B4900719DBE7009F60FC892A87BB4FB8C715F658596D889D63A4FB3044E1CB75

Function 00D5FB40 Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00D34EE2,?,00D34EE2,00000000), ref: 00D5FB6E
RtlFreeHeap.NTDLL(00000000,?,00D34EE2,00000000), ref: 00D5FB75

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 6ad948529b6c2167829b314f7279925b430936831a8620290cc4ef06e381ad6d
Instruction ID: 42e6e23015188f4bba69bcd131b5197b546429ee25fe3580467fd7364f3535bd
Opcode Fuzzy Hash: 6ad948529b6c2167829b314f7279925b430936831a8620290cc4ef06e381ad6d
Instruction Fuzzy Hash: D6F0AA31100729CBE7008FA1FC1D6693B28FB9C709B420589E58CDA2A5FB7080E8D735

Function 00D6D780 Relevance: 3.0, APIs: 2, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?), ref: 00D6D7C9
RtlAllocateHeap.NTDLL(00000000), ref: 00D6D7D0

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 0645dcb35ae6f8a0435b23c60d421700427f611c290e936a33e6125a761ad65f
Instruction ID: ee734465974864962a95954cc65c1221089e78354ac4b6946791dfc50aa0a9ab
Opcode Fuzzy Hash: 0645dcb35ae6f8a0435b23c60d421700427f611c290e936a33e6125a761ad65f
Instruction Fuzzy Hash: D2F0DF38904718EBDB00AF61E9095A8BB78FB58716F500894EC89C2328FB314AE0C764

Function 00D3FD10 Relevance: 3.0, APIs: 2, Instructions: 23
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00D3FD24
CharLowerBuffA.USER32(?,00000000), ref: 00D3FD2C

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: c5f2cdac559c433ae9c5914e24d41193c672b9eebbb72f3d66c84c2a1b6542bd
Instruction ID: f57a3ce99021f120cbd10abd62312496d09bc4bd2a3959a0066e23aeba04fac2
Opcode Fuzzy Hash: c5f2cdac559c433ae9c5914e24d41193c672b9eebbb72f3d66c84c2a1b6542bd
Instruction Fuzzy Hash: B6E0CA31205328EB8B00AF95FC4A9A93B68FB0C6063444895F94CC6720F630AA908BB9

Function 00D5CB20 Relevance: 1.7, APIs: 1, Instructions: 204
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00D5CCF4

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3e037e23bf04bb35364fccbda928ff58430d4128bc0bb614b535c28867ec3d4d
Instruction ID: 2166a4f76edcecc99d218d70d10e3efadfae3ec1bae0ddbba0a0603c75e4c155
Opcode Fuzzy Hash: 3e037e23bf04bb35364fccbda928ff58430d4128bc0bb614b535c28867ec3d4d
Instruction Fuzzy Hash: A2819470900719DBEB009F20FE4A2A47B74FB9C706F614996D988EA3A5FB3044E4DB75

Function 00D5BE20 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00D5BE96

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 8530bd832e672cd18ceb2dd6bf66414b9100221f35c9508ed0f31181555a7838
Instruction ID: 8f3e1d7d472f0be4f3511e032f993a71bda3576b46e02d89edc47fc840f9d66a
Opcode Fuzzy Hash: 8530bd832e672cd18ceb2dd6bf66414b9100221f35c9508ed0f31181555a7838
Instruction Fuzzy Hash: B0F01234000B19CADB08AF75FC890753BA0F79C72A3544895E98DCA3A1FB3084E8CB78

Non-executed Functions

Function 00D5DB90 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 366sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00D5DD32

Strings

Mks?, xrefs: 00D5DBA7, 00D5DE6D, 00D5DE95

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: Sleep
String ID: Mks?
API String ID: 3472027048-3201072181
Opcode ID: 862edcc04e1e64a73612ac4c9cbaa74daac0d6f9f3bce2c510e929dc20eea898
Instruction ID: f91da68e1a3d71bf2232c06d4bf002e225953c03b7264d06e1787b870492c7aa
Opcode Fuzzy Hash: 862edcc04e1e64a73612ac4c9cbaa74daac0d6f9f3bce2c510e929dc20eea898
Instruction Fuzzy Hash: 5CE1B930900719DBEB048F20FD591A8BBB5FB9D325B5185D9D889E63A4FB3049E4CB74

Function 00D5B2B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 295filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00D5B3EF
GetFileTime.KERNEL32(00000000,?,?,?), ref: 00D5B485
CloseHandle.KERNEL32(00000000), ref: 00D5B4C7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D5B5BA
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 00D5B60F
CloseHandle.KERNEL32(00000000), ref: 00D5B681

Strings

Mks?, xrefs: 00D5B2B9

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: Mks?
API String ID: 3236713533-3201072181
Opcode ID: 29d74d91b97bb50aaf59fed6c3256ac1d321f7203c23e03276400dfda74d8391
Instruction ID: 511e8e81a750f74f617bd328c778a1343a3e1dc59bd90585effac2f23728ec9a
Opcode Fuzzy Hash: 29d74d91b97bb50aaf59fed6c3256ac1d321f7203c23e03276400dfda74d8391
Instruction Fuzzy Hash: F0C18A70A01709DBD7049F60FD892A87BB0FB8C715B6149DAD888E63A4F73145E4CBB5

Function 00D4FFA0 Relevance: 12.3, APIs: 8, Instructions: 331registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(00EA03E0,00D59E30), ref: 00D50120
SetServiceStatus.ADVAPI32(00000000,00D7E98C), ref: 00D501D1
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D501FE
SetServiceStatus.ADVAPI32(00000000,00D7E98C), ref: 00D50283
WaitForSingleObject.KERNEL32(00000000,00001388), ref: 00D502F7
SetServiceStatus.ADVAPI32(00000000,00D7E98C), ref: 00D50462
CloseHandle.KERNEL32(00000000), ref: 00D50481
SetServiceStatus.ADVAPI32(00000000,00D7E98C), ref: 00D50537

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: 2dc7da6d39147b493d902f89a0bf4a8607c3450f77e5cf113140f1e62eebc034
Instruction ID: 6451ccacb499d9800f8fc7b39d9a215ce2626fdea8126fa4bb5c30c6ce2d54ce
Opcode Fuzzy Hash: 2dc7da6d39147b493d902f89a0bf4a8607c3450f77e5cf113140f1e62eebc034
Instruction Fuzzy Hash: 67F11F75901718DBD7449F60E9891A87BB4FB9C309B2189DAD88CE63B4FB3046E0DB35

Function 00D6DD10 Relevance: 10.9, APIs: 7, Instructions: 362fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,000000FF), ref: 00D6DE87
ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,?,000000FF), ref: 00D6DEEC
CloseHandle.KERNEL32(00000000,?,?,?,?,000000FF), ref: 00D6DF39
GetTickCount.KERNEL32 ref: 00D6DF9E

Part of subcall function 00D35630: lstrlenA.KERNEL32(?,?,?,00D31050,?), ref: 00D356E7

Part of subcall function 00D6DAC0: wvsprintfA.USER32(00000000,?,?), ref: 00D6DBE2

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00D6E1C3
WriteFile.KERNEL32(00000000,000000FF,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00D6E1FD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00D6E216

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWritelstrlenwvsprintf
String ID:
API String ID: 3963321075-0
Opcode ID: 8553e403d5a73daec1ad3a5a8ea986f797a2d5b08bf0f10010980877ef67d24e
Instruction ID: aa2fb3e69e4e64982daf76429763562cce03ece72846177a51e3e7bc66f65165
Opcode Fuzzy Hash: 8553e403d5a73daec1ad3a5a8ea986f797a2d5b08bf0f10010980877ef67d24e
Instruction Fuzzy Hash: DAE19671A00718EBE7009F20FC896A97B79FB9C318F658495E888D63A4FB7145E0CB74

Function 00D6FC20 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 469sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00D6ABB0: CloseHandle.KERNEL32(00000000,00000000,00000001,00000000), ref: 00D6ABFF

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00D70099
Sleep.KERNEL32(00015F90), ref: 00D7031A

Strings

Mks?, xrefs: 00D6FF1F, 00D6FF36
Hbu, xrefs: 00D6FEB4
h?, xrefs: 00D70108

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: CloseFileHandleModuleNameSleep
String ID: Hbu$Mks?$h?
API String ID: 420089116-345594337
Opcode ID: 2976b9b031cf022396c1378582944990f6406c272c893fd77f682d07b4da5e3c
Instruction ID: 92120c934b26e558b87a129b906b945cf979def2e4117b7349651920f97b9dc4
Opcode Fuzzy Hash: 2976b9b031cf022396c1378582944990f6406c272c893fd77f682d07b4da5e3c
Instruction Fuzzy Hash: B9129671901718DBE7009F20FD966A97BB4FB9C315B5184DAE888D63A1FB3049E0CB75

Function 00D59460 Relevance: 7.9, APIs: 5, Instructions: 404processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00D59600

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: fdc61cf52b487e0a8d659992670251f7e5da97eb13c616626bb351ace2d57bf2
Instruction ID: 9d41c7282bedbce07e7c093140ada49478f4391a219775d9ff23de02576b29e5
Opcode Fuzzy Hash: fdc61cf52b487e0a8d659992670251f7e5da97eb13c616626bb351ace2d57bf2
Instruction Fuzzy Hash: B702CA70801719EBDB009F60FD592A87BB4FB9C316B6184DAD888E6364FB3145E8DB74

Function 00D58A40 Relevance: 7.6, APIs: 5, Instructions: 85synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000001,00D41B96), ref: 00D58AAF
CreateThread.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 00D58AE5
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D58B16
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00D58B33
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D58B70

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 794707ef6e3e9e6f4017cf3cd28b70755707c242523f3f1f9594803928d05c46
Instruction ID: cb8c69d9f08c397de34518c0dc35999f0aed2c9494cf5be561c1d15c0dacbd71
Opcode Fuzzy Hash: 794707ef6e3e9e6f4017cf3cd28b70755707c242523f3f1f9594803928d05c46
Instruction Fuzzy Hash: DA312675100724EBD7048F25EC89A793BE4FB0C726F5085AAE999CA3A0F27494D1CB65

Function 00D5D110 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 224registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000002,00000000,?), ref: 00D5D319
RegSetValueExA.ADVAPI32(?,00EA3958,00000000,00000001,?,00000000), ref: 00D5D3FB
RegCloseKey.ADVAPI32(?), ref: 00D5D475

Strings

X9, xrefs: 00D5D3F0

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: CloseOpenValue
String ID: X9
API String ID: 779948276-928067303
Opcode ID: 69b5954a9bd44de12bd3b308e21600a8e16912fdc73e21ea28675f1200502be3
Instruction ID: c2029eb7204510e9314c3e09ffd6ddee03b055ba76e212a190aff95a8331115f
Opcode Fuzzy Hash: 69b5954a9bd44de12bd3b308e21600a8e16912fdc73e21ea28675f1200502be3
Instruction Fuzzy Hash: 4BA16774800728EBDB049F60FD891A87B74FB9D322B21859AE84DD6364FB3045E4CB79

Function 00D4C930 Relevance: 5.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,?), ref: 00D4C9A4
HeapReAlloc.KERNEL32(00000000), ref: 00D4C9AB
GetProcessHeap.KERNEL32(00000000,?,00000000,?), ref: 00D4C9C5
HeapAlloc.KERNEL32(00000000), ref: 00D4C9CC

Memory Dump Source

Source File: 00000007.00000002.1402691011.0000000000D31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000007.00000002.1402676150.0000000000D30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402719292.0000000000D73000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402735649.0000000000D7E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.1402752169.0000000000D80000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d30000_jbmx3cphxnwpllpjrowiz.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 0356cfd3bbf8a3c5054be5cdb27559b5edbec4a24fff8b334a76d75f935199b4
Instruction ID: fb4fb17736c139793b2c02fa1e96ad7bf6b4a6af6de1e97a996244b51cd576b6
Opcode Fuzzy Hash: 0356cfd3bbf8a3c5054be5cdb27559b5edbec4a24fff8b334a76d75f935199b4
Instruction Fuzzy Hash: 4D112A74905308EBDB009FA1E9496A97BB8FB4C311F008099ED4DC7360F6318A80DBA1

Analysis Process: ovkmkkgit.exePID: 5932, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	18.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1201
Total number of Limit Nodes:	12

Executed Functions

Function 003ECB50 Relevance: 27.5, APIs: 12, Strings: 3, Instructions: 1280
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(00000000), ref: 003ECF48
GetProcAddress.KERNEL32(00000000,00000000), ref: 003ED03E
FreeLibrary.KERNEL32(?), ref: 003ED0BE
RtlAllocateHeap.NTDLL(?,00000000,00000288), ref: 003ED182
FreeLibrary.KERNEL32(?), ref: 003ED1F3
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 003ED242
HeapFree.KERNEL32(?,00000000,00000000), ref: 003ED2B1
HeapAlloc.KERNEL32(?,00000000,00000288), ref: 003ED2FF
FreeLibrary.KERNEL32(?), ref: 003ED37B
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 003ED426
HeapFree.KERNEL32(?,00000000,?), ref: 003EDFD9
FreeLibrary.KERNEL32(?), ref: 003EE04A

Strings

COd*, xrefs: 003EDAC3, 003EDECD, 003EDEE5
C$^ , xrefs: 003EE056
"1)s, xrefs: 003EDFEB

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: Free$Library$Heap$AdaptersInfo$AddressAllocAllocateLoadProc
String ID: "1)s$C$^ $COd*
API String ID: 2641544653-1910083588
Opcode ID: f90f04daf7177f59e001c26971f67fd6ea149a736ca7c17ef28fc47efed7866f
Instruction ID: e9c93c0b00af12f9d225ca2ea533171fe325f3528a0ff75abb85a2162c04fa8e
Opcode Fuzzy Hash: f90f04daf7177f59e001c26971f67fd6ea149a736ca7c17ef28fc47efed7866f
Instruction Fuzzy Hash: 18C2CC7C90062ADBD7049F63FD982E9BBB1FB98310B12C579DC85A22B4EB354465CB4C

Function 003FDB90 Relevance: 7.9, APIs: 5, Instructions: 366
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8,?), ref: 003FDD32

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 9896f0692c7a945c184695a23b077eef898f135603a4be54323b7e50144a039c
Instruction ID: ef3897f708e636742861b568f62c02cf6c91d2ad11465bde9c9286ab05bf31f5
Opcode Fuzzy Hash: 9896f0692c7a945c184695a23b077eef898f135603a4be54323b7e50144a039c
Instruction Fuzzy Hash: F4E1D338901619EBE7048F63FD581E9BBB5FB98320B52C5B9DC91632B4DB7109A5CB0C

Function 004119A0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 004119D3

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: f0c8e90a7812ec26543ebb0d6f202b69d8a23d66ad860b7dc14d74dd22591ddf
Instruction ID: da266b5b061ca0a6892f2c01b89f9d94fed97059e7085986a7ed3845270a8eb1
Opcode Fuzzy Hash: f0c8e90a7812ec26543ebb0d6f202b69d8a23d66ad860b7dc14d74dd22591ddf
Instruction Fuzzy Hash: 09E0ED7880460DDBA700DFA5FC484E9BFB4F748310B4185A9DC9593250EB301168CB58

Function 003F18D0 Relevance: 26.2, APIs: 11, Strings: 3, Instructions: 1699fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 003F1C01
DeleteFileA.KERNELBASE(00000000,?,?,?,?,?,00000000), ref: 003F1F0E
RemoveDirectoryA.KERNELBASE(00000000,?,?,?,?,?,00000000), ref: 003F1F61
CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,00000000), ref: 003F20AF
CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 003F21B9
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 003F27C9

Strings

COd*, xrefs: 003F2D8F, 003F2DA4
C:\Windows\system32\config\systemprofile, xrefs: 003F251F, 003F266E
\, xrefs: 003F2BF6

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: Directory$Create$DeleteFileRemove
String ID: C:\Windows\system32\config\systemprofile$COd*$\
API String ID: 274774477-1063264351
Opcode ID: 927c266b6a5c9ba0aaf110add2fd3b9cb9b54757e5b58e8191254adfefbeace1
Instruction ID: ffe79ea9e97b16b704754109523dcde391f4fedf401a4448eaf9a0ae35e0d2ad
Opcode Fuzzy Hash: 927c266b6a5c9ba0aaf110add2fd3b9cb9b54757e5b58e8191254adfefbeace1
Instruction Fuzzy Hash: 5AF2D078900619EBD7089F62FD582E97BB1FB98310F11C5B9DD85A32B4EB310A64CB4D

Function 003DD0F0 Relevance: 20.9, APIs: 10, Strings: 1, Instructions: 1611
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/, xrefs: 003DD4DD

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: lstrlen
String ID: /
API String ID: 1659193697-2043925204
Opcode ID: f38a64794ace25e03c8e4b8c895b361df83942284b032ecdc440dc0a69c9a12a
Instruction ID: 716217635e545887406ff83f2e50c88cf5e03939a884c95a06f7a35c59937bf1
Opcode Fuzzy Hash: f38a64794ace25e03c8e4b8c895b361df83942284b032ecdc440dc0a69c9a12a
Instruction Fuzzy Hash: 78E2AE7D901619EBD7049F62FD582E8BBB5FB98310B11C4BADC85632B4EB310A64CB4D

Function 003EFFA0 Relevance: 12.3, APIs: 8, Instructions: 331
registrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(00A0E3B8,003F9E30), ref: 003F0120
SetServiceStatus.SECHOST(00A19DB8,0041E98C), ref: 003F01D1
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 003F01FE
SetServiceStatus.ADVAPI32(00A19DB8,0041E98C), ref: 003F0283
WaitForSingleObject.KERNEL32(00000224,00001388), ref: 003F02F7
SetServiceStatus.ADVAPI32(00A19DB8,0041E98C), ref: 003F0462
CloseHandle.KERNEL32(00000224), ref: 003F0481
SetServiceStatus.ADVAPI32(00A19DB8,0041E98C), ref: 003F0537

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: 147e6961fe1ec16cd8b010bf14868d6a1331aef2b424348a5d0e73b3a56cf032
Instruction ID: b960990c3450b6245b9fd1e2d8b7ae9988250b95b26c5e7d507c230919af6e95
Opcode Fuzzy Hash: 147e6961fe1ec16cd8b010bf14868d6a1331aef2b424348a5d0e73b3a56cf032
Instruction Fuzzy Hash: FAF157BC905619EBD7089F63FD586E8BBB5FB98300B61C5BADD84522B4E7310660DB0C

Function 004107E0 Relevance: 7.9, APIs: 1, Strings: 3, Instructions: 933
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameA.KERNEL32(?,00000010), ref: 00410A89

Strings

COd*, xrefs: 004109D9, 004109F9, 00410EBE, 00410ECE
r?T, xrefs: 00410D0C
h., xrefs: 00411246

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: ComputerName
String ID: COd*$h.$r?T
API String ID: 3545744682-1249623848
Opcode ID: 9efe43bda2a5cadaee41345ecdca758d678cd1783dc93a6398278472ebb8df32
Instruction ID: 85bc8bab857204b219bdff140f97fc877f798f2de1382d2b4c24a2bf86b4f88d
Opcode Fuzzy Hash: 9efe43bda2a5cadaee41345ecdca758d678cd1783dc93a6398278472ebb8df32
Instruction Fuzzy Hash: F692CC7C901619EBE704DFA2FD946E9BB71FB88310B11C47ADC81622B4EB3406A5CB4D

Function 003FC4C0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 385
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,-0000004B,00000009,?), ref: 003FC740
WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000), ref: 003FC99C
CloseHandle.KERNELBASE(00000000), ref: 003FCACD

Strings

d*, xrefs: 003FC690

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: d*
API String ID: 1065093856-3078804402
Opcode ID: ca1c955cac7cbbfac289d0c4d6d8b56bd53b05a99561beff5355a9dbd912a87c
Instruction ID: 37098da4d66c89d496774767b6bfd8a4001cca80723d5e0375c8f7ca906c456a
Opcode Fuzzy Hash: ca1c955cac7cbbfac289d0c4d6d8b56bd53b05a99561beff5355a9dbd912a87c
Instruction Fuzzy Hash: 46F1AF7C900618EBE7049F63FD986E9BB74FB98311B21C5BADD80A32A4E7354560CB4D

Function 003F7110 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 238
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,0040BCA5,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,?), ref: 003F7370
CloseHandle.KERNEL32(?,?,?,?,?,?,?), ref: 003F7419
CloseHandle.KERNEL32(?,?,?,?,?,?,?), ref: 003F742F

Strings

D, xrefs: 003F725E

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 54e38e654c9c2d2f307d8bbb9bd9ede20e1ca56a8ca8e058ec10787e0cf206eb
Instruction ID: 5165e93e2f5ffe8fd55fb3a93b8bddd7bbcfd1dcbf1c911afe3e8ea09d88c651
Opcode Fuzzy Hash: 54e38e654c9c2d2f307d8bbb9bd9ede20e1ca56a8ca8e058ec10787e0cf206eb
Instruction Fuzzy Hash: 19A1AD78905618EBD704CF93FE542E8BBB5FB88711F21C5BADC80A22A4E7744660DB4C

Function 0040AD30 Relevance: 6.9, APIs: 1, Strings: 3, Instructions: 923
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000008AE), ref: 0040BB17

Strings

C:\depbjdo\ktwsjztevxgl.exe, xrefs: 0040BC9B
COd*, xrefs: 0040ADF7, 0040AE09
n3eh13quo7ee "c:\depbjdo\ovkmkkgit.exe", xrefs: 0040BC96

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: Sleep
String ID: C:\depbjdo\ktwsjztevxgl.exe$COd*$n3eh13quo7ee "c:\depbjdo\ovkmkkgit.exe"
API String ID: 3472027048-572241780
Opcode ID: 2da718b192668afe7ebaa34c2337bd7227b9ef42cbc66debbd9af5872461cf95
Instruction ID: a37e85cc4ae38573d5a257b6061c633d6c038f464b643ebf0eb51fab504cec8f
Opcode Fuzzy Hash: 2da718b192668afe7ebaa34c2337bd7227b9ef42cbc66debbd9af5872461cf95
Instruction Fuzzy Hash: A392A17C900619EBD704DF62FE546E9BBB1FB98310B11C5BADC81632A4EB340A65CB4D

Function 003F6890 Relevance: 6.4, APIs: 4, Instructions: 356
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?), ref: 003F69A2
Process32First.KERNEL32(00000000,00000128), ref: 003F6AD3

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID:
API String ID: 2353314856-0
Opcode ID: b8dc6f780a0c4721f501fa7c382d97a630ef0a25dc28a617ce380edfbc654701
Instruction ID: af20c1945c6f0e5776ac979b17fd68ef939f41d3c438eb9a823dceb05a09fa1a
Opcode Fuzzy Hash: b8dc6f780a0c4721f501fa7c382d97a630ef0a25dc28a617ce380edfbc654701
Instruction Fuzzy Hash: A1F18D7C901619EBD7049F63FE582E8BB75FB98310B62C4B9CC8492274EB3109A4CB4D

Function 003D1470 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 407
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76850000,00000000), ref: 003D1703
GetProcAddress.KERNEL32(76850000,00000000), ref: 003D17E5

Strings

r?T, xrefs: 003D16C2, 003D16C8

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: AddressProc
String ID: r?T
API String ID: 190572456-1223819929
Opcode ID: 40aac54498769b5ffcda292c67f3261869c431e8ebf947143fea97160d4e5cfb
Instruction ID: baf578e863d09daee6e66b2954ceded87a31a949d4751f3c1514643339da1b68
Opcode Fuzzy Hash: 40aac54498769b5ffcda292c67f3261869c431e8ebf947143fea97160d4e5cfb
Instruction Fuzzy Hash: 11029EBC900615EBE7049FA3FD982E8BB75FB88311B21C57ADC84522B4EB3445A5CB4D

Function 003E0700 Relevance: 4.6, APIs: 3, Instructions: 143
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 003E07CC
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 003E0848
FreeSid.ADVAPI32(?), ref: 003E0937

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: ece6d7ecb2233398ab9aa9aee4d302ccb50f7df18c11845b5ea1f43959ddf859
Instruction ID: 1f64048903ef8ccac3bae999c67de49f5f2ab37aeeed1ecb76619d91ef6bf4ab
Opcode Fuzzy Hash: ece6d7ecb2233398ab9aa9aee4d302ccb50f7df18c11845b5ea1f43959ddf859
Instruction Fuzzy Hash: 15519E7C90061AEBD7049FA3FD886E9BF75FB98300B11C5B5DD84122A5DB700964CB4D

Function 003F9000 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 252
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000000,?,?,00000708), ref: 003F91D1

Strings

COd*, xrefs: 003F9155, 003F916D

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: CreateFile
String ID: COd*
API String ID: 823142352-151618887
Opcode ID: 5a8bb2d80443bfe1b0ca2e8a670a0103fc5389534d2c95f7c1f24576f65ec13a
Instruction ID: 8bb8a35c50db41b3162903370f44a0862d74190a396c0072688e29b90b6e69cd
Opcode Fuzzy Hash: 5a8bb2d80443bfe1b0ca2e8a670a0103fc5389534d2c95f7c1f24576f65ec13a
Instruction Fuzzy Hash: 78B1A37C901619EBE7049F66FE483E87BB5FB98310F21C47ADD85922A4EB314A50DB4C

Function 003FCB20 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 204
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 003FCCF4

Strings

r?T, xrefs: 003FCE2F

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: CreateFile
String ID: r?T
API String ID: 823142352-1223819929
Opcode ID: 3f56088dd70015e851d67e9168462d5a0da752ab7634829de87a059fcd28e8da
Instruction ID: b0c68f4ba8055cbb26db7f7946463c401c978ca16f097a00bf024639191ca5f3
Opcode Fuzzy Hash: 3f56088dd70015e851d67e9168462d5a0da752ab7634829de87a059fcd28e8da
Instruction Fuzzy Hash: 6181DF78900619EBE7009F62FE486F47B75FB98700F62C979DD84962B4EB3144A0DB4D

Function 003FFB40 Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,-00000002,?,003FE22C,00000000,00000000,00000000,-00000002,00000000,00000002,00000000), ref: 003FFB6E
RtlFreeHeap.NTDLL(00000000,?,003FE22C,00000000,00000000,00000000,-00000002,00000000,00000002,00000000), ref: 003FFB75

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 04e87a8b827f9a05ea94e5c9fde927cc46f5b29d0ef8dd3631d750de9c720d7c
Instruction ID: e064e7dc26dacb57e38c9bd836f3a0f2f9eab2a51a57266b6a700936a762fe2e
Opcode Fuzzy Hash: 04e87a8b827f9a05ea94e5c9fde927cc46f5b29d0ef8dd3631d750de9c720d7c
Instruction Fuzzy Hash: 87F0DA79540615DBF7048F53FC1D6D47B78F79C701B41C5A5E98856064CB748064CB1D

Function 0040D780 Relevance: 3.0, APIs: 2, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?), ref: 0040D7C9
RtlAllocateHeap.NTDLL(00000000), ref: 0040D7D0

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 8ea158ac31dc71c76512cc306025badfb7f314a1103df8977fc020d24fdd442b
Instruction ID: a3c0d1663d1e49b693f9ee38f62706c32a18d0b654aab87b36ba42718c281dd6
Opcode Fuzzy Hash: 8ea158ac31dc71c76512cc306025badfb7f314a1103df8977fc020d24fdd442b
Instruction Fuzzy Hash: EDF0303C844608EBDB00AF62FD095E87BB8FB58712F5084A4EC8992724DB314560C758

Function 003DFD10 Relevance: 3.0, APIs: 2, Instructions: 23stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(003F6BD7,00000000,?,003F6BD7,?), ref: 003DFD24
CharLowerBuffA.USER32(003F6BD7,00000000,?,003F6BD7,?), ref: 003DFD2C

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: f650a99c8eefa70f491800af0234c404bfd3955660fda7f9f8505899938d3ffd
Instruction ID: 4739de9c69afde699e1ca66e9bc67cad26f4068bba34e8e54a1a9a2adc76762f
Opcode Fuzzy Hash: f650a99c8eefa70f491800af0234c404bfd3955660fda7f9f8505899938d3ffd
Instruction Fuzzy Hash: A1E01A39205118FBCB009F96FC485E97B78FB09701304C465FD4893320D7309A50CBAD

Function 003F8320 Relevance: 1.5, APIs: 1, Instructions: 275sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8,?,?,?,00000000,00000000,?,?,00000708), ref: 003F8540

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 19df7cef35a912628939b40af980284bbf21c074d3d78a07c460a9dc0f0559e5
Instruction ID: d1643328034e4f92901f6653359acaa354fdc6dc3e6c50396406ea3f1d454965
Opcode Fuzzy Hash: 19df7cef35a912628939b40af980284bbf21c074d3d78a07c460a9dc0f0559e5
Instruction Fuzzy Hash: D2C1F17C801629EBD7049F53FE582E97B75FB98320B22C5B5DD80922B0EB700960CB4D

Non-executed Functions

Function 00400FE0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 309serviceCOMMON

Download Yara Rule

APIs

CreateServiceA.ADVAPI32(00000000,00A0E3B8,00A0E3B8,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 004011BF
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 0040121F
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00401259
CloseServiceHandle.ADVAPI32(00000000), ref: 00401290
OpenServiceA.ADVAPI32(00000000,00A0E3B8,00000010), ref: 004012E0
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0040133D
CloseServiceHandle.ADVAPI32(00000000), ref: 00401368
CloseServiceHandle.ADVAPI32(00000000), ref: 00401483

Strings

r?T, xrefs: 00401477

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: Service$CloseHandle$Start$ChangeConfig2CreateOpen
String ID: r?T
API String ID: 229943926-1223819929
Opcode ID: 74bad6f15d04a5b905f04dd396c1f4412d60ab6277cb870ad4515fa7417d06b7
Instruction ID: 3c71279001341f36a3be2065d72eb557e8dad288ee2700e41d5861d43efd8751
Opcode Fuzzy Hash: 74bad6f15d04a5b905f04dd396c1f4412d60ab6277cb870ad4515fa7417d06b7
Instruction Fuzzy Hash: 8ED18A7C904619EBE7049FA2FC586E8BB75FB88310F11C8B6DD80622B4EB7544A1CB4D

Function 003FB2B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 295filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 003FB3EF
GetFileTime.KERNEL32(00000000,?,?,?), ref: 003FB485
CloseHandle.KERNEL32(00000000), ref: 003FB4C7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003FB5BA
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 003FB60F
CloseHandle.KERNEL32(00000000), ref: 003FB681

Strings

r?T, xrefs: 003FB4A9, 003FB71C

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: r?T
API String ID: 3236713533-1223819929
Opcode ID: 6e3c0f1ec1893db9b47797af928db45904a26cd8622d9bda309dac34016b76da
Instruction ID: d1bdf6cb40552385031a0df56148131d0bd6f12dd3b5579af57d7d6c2981fc9f
Opcode Fuzzy Hash: 6e3c0f1ec1893db9b47797af928db45904a26cd8622d9bda309dac34016b76da
Instruction Fuzzy Hash: 78C1A07CA01219EBD7049F93FD846E8BBB5FB88710B61C579EC84932A4E7314560CB4D

Function 003F9460 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 404processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000001), ref: 003F9600

Strings

COd*, xrefs: 003F9745

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID: COd*
API String ID: 3332741929-151618887
Opcode ID: 6d9ab9d16c1c778bb0dd7514c7ac878ce6911f804cdd499cee15ef046d1a6164
Instruction ID: 259d54be099c282003bc1190f0f4c00af25d6c00958754d167e0195c28b98401
Opcode Fuzzy Hash: 6d9ab9d16c1c778bb0dd7514c7ac878ce6911f804cdd499cee15ef046d1a6164
Instruction Fuzzy Hash: 9302E07C901619EBD7049F63FD582E9BBB5FB98311B22C4BADC8092264EB3505A5DF0C

Function 0040DD10 Relevance: 10.9, APIs: 7, Instructions: 362fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,000000FF), ref: 0040DE87
ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,?,000000FF), ref: 0040DEEC
CloseHandle.KERNEL32(00000000,?,?,?,?,000000FF), ref: 0040DF39
GetTickCount.KERNEL32 ref: 0040DF9E

Part of subcall function 003D5630: lstrlenA.KERNEL32(?,?,?,003FDD04,?,00000104,?,?), ref: 003D56E7

Part of subcall function 0040DAC0: wvsprintfA.USER32(00000000,?,?), ref: 0040DBE2

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040E1C3
WriteFile.KERNEL32(00000000,000000FF,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E1FD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 0040E216

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWritelstrlenwvsprintf
String ID:
API String ID: 3963321075-0
Opcode ID: 40e1ba707a9be924c0c6b5532a98d06e53885909a2cdaf7692d25a4767b80175
Instruction ID: 23087c5483cc1d5e68388928fc50d1eb64d312527865b772875278846f92cee4
Opcode Fuzzy Hash: 40e1ba707a9be924c0c6b5532a98d06e53885909a2cdaf7692d25a4767b80175
Instruction Fuzzy Hash: A2E11178900619EBD7049F62FC586E97B76FB98310F11C4B9EC80A32B4EB754565CB0C

Function 003F8A40 Relevance: 7.6, APIs: 5, Instructions: 85synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000001,003E1B96), ref: 003F8AAF
CreateThread.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 003F8AE5
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003F8B16
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 003F8B33
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003F8B70

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: ec53932e0a8d167114e39193d2e6bba90106cbf9f07a90a55eb876bcc7b39cba
Instruction ID: 17062e74d411ee0afa83a202dc7a30707a0a7d03638814058ac793feb59daae3
Opcode Fuzzy Hash: ec53932e0a8d167114e39193d2e6bba90106cbf9f07a90a55eb876bcc7b39cba
Instruction Fuzzy Hash: 9D31377C140628EBD7048F16EC99BF97BB4FB08711F00C53AED95862A0E3789551CB5C

Function 003EFD20 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,?,?,003FFC72), ref: 003EFD5F
GetStdHandle.KERNEL32(000000F5,00000000,?,?,003FFC72), ref: 003EFDD0
GetStdHandle.KERNEL32(000000F4,00000000,?,?,003FFC72), ref: 003EFE09

Strings

A, xrefs: 003EFE0C
A, xrefs: 003EFD62

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: Handle
String ID: A$A
API String ID: 2519475695-1663603329
Opcode ID: d86defc27ad0ce4da8248281ac4c7ee0b8d3178397316058814c7bd9d77d1e82
Instruction ID: 21854833fb25b452543deb7cb33ecc0819d546a4ddbb2867f0e9f7f6c072e9a2
Opcode Fuzzy Hash: d86defc27ad0ce4da8248281ac4c7ee0b8d3178397316058814c7bd9d77d1e82
Instruction Fuzzy Hash: 2C314279A04214EBC7089FA7FC490E87FB4FB98321751C676EC85922B4EB310660CB9D

Function 003DC3D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,?,?,?,?,003FC131,?,?,?,?,0040AFDF), ref: 003DC482
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,003FC131,?,?,?,?,0040AFDF), ref: 003DC4CD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003DC536

Strings

r?T, xrefs: 003DC407

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: Time$System$FileUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: r?T
API String ID: 1858273683-1223819929
Opcode ID: 70faaf4beff39c68e25ae05a3f58d7488f7859bd196984a8d22d15324bbd9f77
Instruction ID: 120e6db249e7bb258452bfd3cf91ee5abf2d4fb84f3433f26beceb91e15e94f5
Opcode Fuzzy Hash: 70faaf4beff39c68e25ae05a3f58d7488f7859bd196984a8d22d15324bbd9f77
Instruction Fuzzy Hash: C9416D3D900609EBE704CFA6FD486E97B76FB88310B12C5B6DD84922A8EB344561CB4D

Function 003FB860 Relevance: 6.3, APIs: 4, Instructions: 327fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003FB986
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 003FBAA4
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 003FBC19
CloseHandle.KERNEL32(00000000,?,00000000), ref: 003FBD24

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: CloseFileHandle$CreateRead
String ID:
API String ID: 2564258376-0
Opcode ID: 1e3bbbd6905a61b817a30940afc20e7879edbdfd99c3585bc249a6d0f4c08aeb
Instruction ID: 1fe3d823bccffd241060f65967a3c04f596718842aa1c9553b8c0435fba72144
Opcode Fuzzy Hash: 1e3bbbd6905a61b817a30940afc20e7879edbdfd99c3585bc249a6d0f4c08aeb
Instruction Fuzzy Hash: F1D1CD78900618EBE704DFA2FE586E9BBB5FB88311F11C4B5ED80522A4E77549A0CB4D

Function 0040FC20 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 469sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0040ABB0: CloseHandle.KERNEL32(00000000,00000000,00000001,00000000,?,?,?,00000000,00000000,?,?,00000708), ref: 0040ABFF

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00410099
Sleep.KERNEL32(00015F90), ref: 0041031A

Strings

Hbu, xrefs: 0040FEB4

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: CloseFileHandleModuleNameSleep
String ID: Hbu
API String ID: 420089116-125748917
Opcode ID: 9dc02b21ad9b089a1154064c63524bf42d1331675a795a7a580a680fc3dd3a15
Instruction ID: 701dbca3782476e5d1d137188411c420bb4b70f19707d156627e66eded92f7ba
Opcode Fuzzy Hash: 9dc02b21ad9b089a1154064c63524bf42d1331675a795a7a580a680fc3dd3a15
Instruction Fuzzy Hash: 4912DB7C901619EBD3049F63FD946E97BB1FB88310B11C5BAEC81A72A0E73449A5CB4D

Function 003EC930 Relevance: 5.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,?), ref: 003EC9A4
HeapReAlloc.KERNEL32(00000000), ref: 003EC9AB
GetProcessHeap.KERNEL32(00000000,?,00000000,?), ref: 003EC9C5
HeapAlloc.KERNEL32(00000000), ref: 003EC9CC

Memory Dump Source

Source File: 00000009.00000002.2297567096.00000000003D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000009.00000002.2297533017.00000000003D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297612551.0000000000413000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297633381.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2297651191.0000000000420000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3d0000_ovkmkkgit.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 20066dc88ea100e1bc63d664b10495c310862c5806e00b5c6eeb6863156f37d9
Instruction ID: 09901fa8d0eacaefb24ce411e2edc149445f8403185b3459855e1845133ec5c5
Opcode Fuzzy Hash: 20066dc88ea100e1bc63d664b10495c310862c5806e00b5c6eeb6863156f37d9
Instruction Fuzzy Hash: 18115278905208FBDB00DFA2EA586ED7BB8FF48312F00C0A5FD4997260D7314A40DB59

Analysis Process: ktwsjztevxgl.exePID: 4908, Parent PID: 5932COMMON

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1229
Total number of Limit Nodes:	10

Executed Functions

Function 004818D0 Relevance: 26.2, APIs: 11, Strings: 3, Instructions: 1699fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00481C01
DeleteFileA.KERNELBASE(00000000,?,?,?,?,?,00000000), ref: 00481F0E
RemoveDirectoryA.KERNELBASE(00000000,?,?,?,?,?,00000000), ref: 00481F61
CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,00000000), ref: 004820AF
CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004821B9
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004827C9

Strings

\, xrefs: 00482BF6
C:\Windows\system32\config\systemprofile, xrefs: 0048251F, 0048266E
vZA, xrefs: 004824DF, 004824EC, 004833DA, 004833ED

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: Directory$Create$DeleteFileRemove
String ID: C:\Windows\system32\config\systemprofile$\$vZA
API String ID: 274774477-2277223301
Opcode ID: da7818899a8527ba518f635a6dfb7bedc295ede4f403b71d3740c710bb809a34
Instruction ID: a029acfe22534889d6759b6572c8b8e7a54c2868593a2558e105eb03e22a6183
Opcode Fuzzy Hash: da7818899a8527ba518f635a6dfb7bedc295ede4f403b71d3740c710bb809a34
Instruction Fuzzy Hash: 84F23570904615DBDB049F63FD682A93FB4FB9B300F1188BAD9A1A32B4E7350965CB4D

Function 00489460 Relevance: 9.4, APIs: 6, Instructions: 404
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00489600

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: b3e42d4ef5f08d30b4f370fbd18d813adcc3a34c6a9bf0b2c15df493661fd197
Instruction ID: b628e2f8510f809be7848d7ab5964d2bbcd186a7c40b206564f5da646d363523
Opcode Fuzzy Hash: b3e42d4ef5f08d30b4f370fbd18d813adcc3a34c6a9bf0b2c15df493661fd197
Instruction Fuzzy Hash: FF021574C01A25EBEB049F63FD582A97F74FB9B311F1588BAD8A052264E73509A5CF0C

Function 0048B2B0 Relevance: 9.3, APIs: 6, Instructions: 295
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 0048B3EF
GetFileTime.KERNEL32(00000000,?,?,?), ref: 0048B485
CloseHandle.KERNEL32(00000000), ref: 0048B4C7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0048B5BA
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 0048B60F
CloseHandle.KERNEL32(00000000), ref: 0048B681

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: 17e90dfb52afbad5146c95cf158cdb717b228b184a6cc6b15a0e34f0814720c0
Instruction ID: 43660ad020f64ce3e4a9b151fc2fd7983e1a684f4e719ecc0466217d8c5753b1
Opcode Fuzzy Hash: 17e90dfb52afbad5146c95cf158cdb717b228b184a6cc6b15a0e34f0814720c0
Instruction Fuzzy Hash: F1C1D070A05215EFDB049F93FD982A97FB4FB8B710B61497AD8A0533A4E7310961CB8D

Function 00486890 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 356
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004869A2
Process32First.KERNEL32(00000000,00000128), ref: 00486AD3

Strings

vZA, xrefs: 00486AAC, 00486AC6

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID: vZA
API String ID: 2353314856-254142502
Opcode ID: 2656f132ab4154e2d873c4955b084a2d4fc76f56eade6d11a6ed0a1345347eea
Instruction ID: f191aeabc38b28c8cfc7227129741e37b13ddc6589a980b5e42fc0a716b8ed97
Opcode Fuzzy Hash: 2656f132ab4154e2d873c4955b084a2d4fc76f56eade6d11a6ed0a1345347eea
Instruction Fuzzy Hash: 81F1F770D05615EBE7049F63FE582A93FB4FB9B300B6248BAC4A1522B4E73505A5CB4D

Function 00487110 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 238
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00487370
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00487419
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 0048742F

Strings

D, xrefs: 0048725E
vZA, xrefs: 0048718A

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D$vZA
API String ID: 2922976086-1306543988
Opcode ID: fade9cf17f1e2f617325a4b1bc866b09e7e6380ec4f644aef161b1095523e01d
Instruction ID: 6433617080d3c23da77976dcbee57ef60f4096859473d800e8e059d5ce494791
Opcode Fuzzy Hash: fade9cf17f1e2f617325a4b1bc866b09e7e6380ec4f644aef161b1095523e01d
Instruction Fuzzy Hash: A5A1D371D05614EBD700DF93FE543A97FB4FB96711F2048BAD8A0A22A4E7744660DB4C

Function 0048C4C0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 385
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,?,?), ref: 0048C740
WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000), ref: 0048C99C
CloseHandle.KERNELBASE(00000000), ref: 0048CACD

Strings

d*, xrefs: 0048C690

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: d*
API String ID: 1065093856-3078804402
Opcode ID: 9dea1e94f6c2cb9dabab7f50f18b259eb42820628af6f1356a2ce9eba51f0488
Instruction ID: af4a34fc5b67998bcbb0db3de536f908acee2bb9be1daa5a9f0958614b67d159
Opcode Fuzzy Hash: 9dea1e94f6c2cb9dabab7f50f18b259eb42820628af6f1356a2ce9eba51f0488
Instruction Fuzzy Hash: F1F10471D00614EBEB04AF63FD982A97F74FB9A310B21847AD8A1632B4E73545A0CF4D

Function 0048FB40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,NF,?,00464EE2,00000000), ref: 0048FB6E
RtlFreeHeap.NTDLL(00000000,?,00464EE2,00000000), ref: 0048FB75

Strings

NF, xrefs: 0048FB68, 0048FB6B

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: NF
API String ID: 3859560861-359928498
Opcode ID: 8706a30c71572e8dc7dc06c5ababfbe17b22a7cc92ed929e3f2ba05f6d3bba96
Instruction ID: 278ffcfe20dc1583953ee121b84843e8b3ced400d41a1785d20d3ca5e6ad27b6
Opcode Fuzzy Hash: 8706a30c71572e8dc7dc06c5ababfbe17b22a7cc92ed929e3f2ba05f6d3bba96
Instruction Fuzzy Hash: 5EF0D431104615CBE7008FA3FD2D6553F28F79F701B420565E1A8960A8DB749069CB2D

Function 00470700 Relevance: 4.6, APIs: 3, Instructions: 143
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 004707CC
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 00470848
FreeSid.ADVAPI32(?), ref: 00470937

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: cbff33b7c0298cf8db5295c56b8ad462a1981fcf3a092ada677b0f85e52d6511
Instruction ID: b6a82a5b20fd6b6e5cb836824fdc0f356e7cc1ca9586c26acae0c53a8e4a63fa
Opcode Fuzzy Hash: cbff33b7c0298cf8db5295c56b8ad462a1981fcf3a092ada677b0f85e52d6511
Instruction Fuzzy Hash: 7F51F6B1905619EBDB009F93FC985BA7F74FB9B300B1184B6D9A022270EB300969CF5D

Function 0049D780 Relevance: 3.0, APIs: 2, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?), ref: 0049D7C9
RtlAllocateHeap.NTDLL(00000000), ref: 0049D7D0

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 7ed4d92abc9f0367845265d5ea8cde91e5eeaed48d692cf255ca92bf8e44b5ff
Instruction ID: 18e7043c781c082fea279f878b37a69fcee35ddefb52b0e785bb35b17d56df13
Opcode Fuzzy Hash: 7ed4d92abc9f0367845265d5ea8cde91e5eeaed48d692cf255ca92bf8e44b5ff
Instruction Fuzzy Hash: B5F03079804608EFDB00AF62FD196A87FB8FB5A712F9008A4EC9583324EB314560C758

Function 0046FD10 Relevance: 3.0, APIs: 2, Instructions: 23
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 0046FD24
CharLowerBuffA.USER32(?,00000000), ref: 0046FD2C

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: 3668e4aa126bfb583afa5cdf228d7a148e0b16f0842d02b4885f6c40ff158140
Instruction ID: 7b64c4981cad901b21bbfc79adbd01305e1f97173d0e231e052fd1ec621a1ecc
Opcode Fuzzy Hash: 3668e4aa126bfb583afa5cdf228d7a148e0b16f0842d02b4885f6c40ff158140
Instruction Fuzzy Hash: 2FE01A31605124EBCB009F96FC585E93FB8FB4E7013054464F95883320E7309A50CBAD

Function 0048BE20 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 0048BE96

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a4721151896ea3ec58b59bc230624cb35b30cd4201b1bd426e32843cd4c83705
Instruction ID: 0a98e5a2822eaed39bcb56214f6c9905ac523203ddc982fe510333261c98397e
Opcode Fuzzy Hash: a4721151896ea3ec58b59bc230624cb35b30cd4201b1bd426e32843cd4c83705
Instruction Fuzzy Hash: 6CF0B434404616DBDB08AF73FCA80BA3F74F75A7163514475E5A5421B0EB3444A4C74C

Non-executed Functions

Function 00490FE0 Relevance: 12.3, APIs: 8, Instructions: 309serviceCOMMON

Download Yara Rule

APIs

CreateServiceA.ADVAPI32(00000000,0135E6A0,0135E6A0,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 004911BF
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 0049121F
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00491259
CloseServiceHandle.ADVAPI32(00000000), ref: 00491290
OpenServiceA.ADVAPI32(00000000,0135E6A0,00000010), ref: 004912E0
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0049133D
CloseServiceHandle.ADVAPI32(00000000), ref: 00491368
CloseServiceHandle.ADVAPI32(00000000), ref: 00491483

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: Service$CloseHandle$Start$ChangeConfig2CreateOpen
String ID:
API String ID: 229943926-0
Opcode ID: e95610d9c1097b66038267ecd1155812df2c8ee24a7497a276f4fd4c5811ed14
Instruction ID: 31d16515a3186421520800ea4dec1dcab25682014473a56f3084d95e9750a0ce
Opcode Fuzzy Hash: e95610d9c1097b66038267ecd1155812df2c8ee24a7497a276f4fd4c5811ed14
Instruction Fuzzy Hash: E4D1B371904615EBE7049FA3FCA83A97F78FB8B310F1188B6D5A0522B4EB7144A1CB4D

Function 0048DB90 Relevance: 6.4, APIs: 4, Instructions: 366sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 0048DD32

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 3a4dccaca48699064962c09b69cff13725133fee239789894ab8aff9cee3ec7d
Instruction ID: 626fef1cf2e5dcfa991bb3135ab5c8af7e9680d5d825400d45d2181fcdaaa644
Opcode Fuzzy Hash: 3a4dccaca48699064962c09b69cff13725133fee239789894ab8aff9cee3ec7d
Instruction Fuzzy Hash: 2FE12370D01625DBEB049F63FD582A97FB4FB9B310B5185BAD8A1632B4EB310961CB0C

Function 0049DD10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 362fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,000000FF), ref: 0049DE87
ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,?,000000FF), ref: 0049DEEC
CloseHandle.KERNEL32(00000000,?,?,?,?,000000FF), ref: 0049DF39
GetTickCount.KERNEL32 ref: 0049DF9E

Part of subcall function 00465630: lstrlenA.KERNEL32(?,?,?,00461050,?), ref: 004656E7

Part of subcall function 0049DAC0: wvsprintfA.USER32(00000000,?,?), ref: 0049DBE2

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0049E1C3
WriteFile.KERNEL32(00000000,000000FF,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0049E1FD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 0049E216

Strings

vZA, xrefs: 0049E096

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWritelstrlenwvsprintf
String ID: vZA
API String ID: 3963321075-254142502
Opcode ID: 276064bd342fa6f5784393624169ce39cdbb861313ea903296fd5f1f6940c173
Instruction ID: e7e93532a3b064d3328c7cc752cc96523e5741439adb906b20c0fdf1df2b69b2
Opcode Fuzzy Hash: 276064bd342fa6f5784393624169ce39cdbb861313ea903296fd5f1f6940c173
Instruction Fuzzy Hash: A8E1F271900615EBDB009F63FC982AA3F79FB9B300F5584B9E9A0932B4EB750560CB4D

Function 0047FFA0 Relevance: 12.3, APIs: 8, Instructions: 331registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(0135E6A0,00489E30), ref: 00480120
SetServiceStatus.ADVAPI32(00000000,004AE98C), ref: 004801D1
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004801FE
SetServiceStatus.ADVAPI32(00000000,004AE98C), ref: 00480283
WaitForSingleObject.KERNEL32(00000000,00001388), ref: 004802F7
SetServiceStatus.ADVAPI32(00000000,004AE98C), ref: 00480462
CloseHandle.KERNEL32(00000000), ref: 00480481
SetServiceStatus.ADVAPI32(00000000,004AE98C), ref: 00480537

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: 088aa194743073e83bfcb65b40b26a0984a77f3f657a17556a21935b7bab11b4
Instruction ID: 0da4ad67293723a6a6b286d61e93a10765d27b2dc270c8ed232ae040f5cec507
Opcode Fuzzy Hash: 088aa194743073e83bfcb65b40b26a0984a77f3f657a17556a21935b7bab11b4
Instruction Fuzzy Hash: 3BF1ABB5905614EBD744DFA3FD681A93FB8F79B300B2188BAD8A1532B4E7310560DB1D

Function 00488A40 Relevance: 7.6, APIs: 5, Instructions: 85synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000001,00471B96), ref: 00488AAF
CreateThread.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 00488AE5
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00488B16
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00488B33
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00488B70

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: c04427641266bb861186a68f53bd08df2557b05412a8c3f3ad892fa66d4a11fd
Instruction ID: 5c3e8b50a8760ac8ca422ce322da4a14964078d545fd8f6d704deecfe202964b
Opcode Fuzzy Hash: c04427641266bb861186a68f53bd08df2557b05412a8c3f3ad892fa66d4a11fd
Instruction Fuzzy Hash: 74313875104624EBE7048F26EC99BB93FE8FB1A711F00C53AE9A5872A0E2789451CB1C

Function 0047FD20 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,?,?,0048FC72), ref: 0047FD5F
GetStdHandle.KERNEL32(000000F5,00000000,?,?,0048FC72), ref: 0047FDD0
GetStdHandle.KERNEL32(000000F4,00000000,?,?,0048FC72), ref: 0047FE09

Strings

J, xrefs: 0047FD62
J, xrefs: 0047FE0C

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: Handle
String ID: J$J
API String ID: 2519475695-1991235028
Opcode ID: 5315f0b5c70aafd7f01dd78ad972a638d8d5084c54852532f5750dd5748a1564
Instruction ID: 4230252d5083434702704b508c2403546a48df143ebca40bd70952ba4a76fea6
Opcode Fuzzy Hash: 5315f0b5c70aafd7f01dd78ad972a638d8d5084c54852532f5750dd5748a1564
Instruction Fuzzy Hash: BA31DC71905214EBCB009F67FD090293FB8FB9B3207118976E8A1932B4EB350564CB5D

Function 0049FC20 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 469sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0049ABB0: CloseHandle.KERNEL32(00000000,00000000,00000001,00000000), ref: 0049ABFF

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004A0099
Sleep.KERNEL32(00015F90), ref: 004A031A

Strings

Hbu, xrefs: 0049FEB4
vZA, xrefs: 0049FED9

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: CloseFileHandleModuleNameSleep
String ID: Hbu$vZA
API String ID: 420089116-1991274701
Opcode ID: 5acee7c8f52d0fdeb4608d61be4976e7fcea090b8f560273670032d69e1be11f
Instruction ID: c8ecd10727b17eff99650dd077f34eafe526a68443b77a15e16e4d4d7a0f42c7
Opcode Fuzzy Hash: 5acee7c8f52d0fdeb4608d61be4976e7fcea090b8f560273670032d69e1be11f
Instruction Fuzzy Hash: F7122F71901614EBDB04DF63FD982AA3FB4FB9B310B1184BAD8A1972B0E7350961CB4D

Function 0046C3D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,?,?,?,00465258), ref: 0046C482
SystemTimeToFileTime.KERNEL32(?,XRF,?,?,?,?,00465258), ref: 0046C4CD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0046C536

Strings

XRF, xrefs: 0046C4C5, 0046C4C8

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: Time$System$FileUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: XRF
API String ID: 1858273683-2329705833
Opcode ID: 55edf03aa740087175c108b9cb4da27e60eed2df86afaa51363988ad7df4df9c
Instruction ID: 92c339633944c7fea968191217fcebf6b1e44a8683fe437b787d707973a12ef2
Opcode Fuzzy Hash: 55edf03aa740087175c108b9cb4da27e60eed2df86afaa51363988ad7df4df9c
Instruction Fuzzy Hash: A041BF70904618EFE700CF92FD986A83FB5FB8B310B1185B6D5B0522A8EB384522CB0D

Function 0048B860 Relevance: 6.3, APIs: 4, Instructions: 327fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0048B986
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 0048BAA4
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 0048BC19
CloseHandle.KERNEL32(00000000,?,00000000), ref: 0048BD24

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: CloseFileHandle$CreateRead
String ID:
API String ID: 2564258376-0
Opcode ID: 5732217bd0d579b6ba3b3e1f01a5d4a9014859865face14904f73ea29d2eb0c5
Instruction ID: 526bd93345dc8e76ea4f17d994daad954b641daa5c956bcf32ad258e0cc0f9d2
Opcode Fuzzy Hash: 5732217bd0d579b6ba3b3e1f01a5d4a9014859865face14904f73ea29d2eb0c5
Instruction Fuzzy Hash: 9BD11471900614EBEB04EFA3FE582A93FB8FB8B311F1184B6D5A0522B4E7754960DB4D

Function 0047C930 Relevance: 5.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,?), ref: 0047C9A4
HeapReAlloc.KERNEL32(00000000), ref: 0047C9AB
GetProcessHeap.KERNEL32(00000000,?,00000000,?), ref: 0047C9C5
HeapAlloc.KERNEL32(00000000), ref: 0047C9CC

Memory Dump Source

Source File: 0000000A.00000002.2322442539.0000000000461000.00000020.00000001.01000000.00000009.sdmp, Offset: 00460000, based on PE: true

Associated: 0000000A.00000002.2322417982.0000000000460000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322480537.00000000004A3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2322501188.00000000004AE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2324141256.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_ktwsjztevxgl.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 3f2de8e1dec3ca1cfa6d9b0b8e344bcad11cc3b387bef887278a79ebf652c926
Instruction ID: c22a36831d8cc8ef05515d9dfd3a20d260798c9a8bca82067e73941bdc01a055
Opcode Fuzzy Hash: 3f2de8e1dec3ca1cfa6d9b0b8e344bcad11cc3b387bef887278a79ebf652c926
Instruction Fuzzy Hash: D6113075909218FBDB00DFA2E9486AD7FB8FF4A312F00C069FD5987260E6354A40DB99

Analysis Process: ktwsjztevxgl.exePID: 6492, Parent PID: 5580COMMON

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1145
Total number of Limit Nodes:	12

Executed Functions

Function 002618D0 Relevance: 26.2, APIs: 11, Strings: 3, Instructions: 1699fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00261C01
DeleteFileA.KERNELBASE(00000000,?,?,?,?,?,00000000), ref: 00261F0E
RemoveDirectoryA.KERNELBASE(00000000,?,?,?,?,?,00000000), ref: 00261F61
CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,00000000), ref: 002620AF
CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 002621B9
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 002627C9

Strings

vZA, xrefs: 002624DF, 002624EC, 002633DA, 002633ED
\, xrefs: 00262BF6
C:\Windows\system32\config\systemprofile, xrefs: 0026251F, 0026266E

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: Directory$Create$DeleteFileRemove
String ID: C:\Windows\system32\config\systemprofile$\$vZA
API String ID: 274774477-2277223301
Opcode ID: 64946e54259b621aa9a50c0fd4c534b7b04fc523563657f0f9536eeab3a7102b
Instruction ID: 72ed374077d8eef12d937121dda673909ccb54946ba6470a70ec566cec1bea45
Opcode Fuzzy Hash: 64946e54259b621aa9a50c0fd4c534b7b04fc523563657f0f9536eeab3a7102b
Instruction Fuzzy Hash: 4FF2E27C913615DBEF049F60FD5C2A93BB0FB99310F238899D885A32B4EB3509A4DB45

Function 002627E7 Relevance: 12.9, APIs: 5, Strings: 2, Instructions: 670
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 002628CE

Strings

vZA, xrefs: 002633DA, 002633ED
\, xrefs: 00262BF6

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: CreateDirectory
String ID: \$vZA
API String ID: 4241100979-3804130794
Opcode ID: 9ea69e273d78cdc9982b1ba5cdbd753300a2dfa76c2d35bdcaf23552b2915bb5
Instruction ID: c9a3becc9ebc06afae8d41332f02e0dc553215890e56a9048628eaa5f2316515
Opcode Fuzzy Hash: 9ea69e273d78cdc9982b1ba5cdbd753300a2dfa76c2d35bdcaf23552b2915bb5
Instruction Fuzzy Hash: 5C52E17C913605EBDF04DF60FD9D2A83BB0FB95310F278899D885632A4EB710AA4DB45

Function 00269460 Relevance: 9.4, APIs: 6, Instructions: 404
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00269600

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: 1d49f71f3490e6880e920994e95d7cbc17255a9a56ab89a2afe279d70befc96f
Instruction ID: 88d6862bddba52fb68f568de4f03b417e3714da429e9ceb8a1d0576b62cfa028
Opcode Fuzzy Hash: 1d49f71f3490e6880e920994e95d7cbc17255a9a56ab89a2afe279d70befc96f
Instruction Fuzzy Hash: 1F02D47C803619EBEF009F60FD5C2A97BB8FB99311F638499D88562274EB3509A4DF40

Function 0026B2B0 Relevance: 9.3, APIs: 6, Instructions: 295
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 0026B3EF
GetFileTime.KERNEL32(00000000,?,?,?), ref: 0026B485
CloseHandle.KERNEL32(00000000), ref: 0026B4C7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0026B5BA
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 0026B60F
CloseHandle.KERNEL32(00000000), ref: 0026B681

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: 1b87f0a6c2454c59250028b269871c036265cd1353b200974f4c09d9c6f6bfa2
Instruction ID: 933a3c22b221b04a6ad95bbddbeb7188f0d34233f8e39026aae1a3070005dd12
Opcode Fuzzy Hash: 1b87f0a6c2454c59250028b269871c036265cd1353b200974f4c09d9c6f6bfa2
Instruction Fuzzy Hash: 25C18D7CA03205EBDF049F50FD8C6B87BB4FB85711B634999E885A23B4E73549A0CB45

Function 00266890 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 356
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 002669A2
Process32First.KERNEL32(00000000,00000128), ref: 00266AD3

Strings

vZA, xrefs: 00266AAC, 00266AC6

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID: vZA
API String ID: 2353314856-254142502
Opcode ID: 8e463dd7798071e398927771e0047db772ea95f210decea2538c471abd3bdf89
Instruction ID: a5e7167689d2f04ab77e979eddfec9680cf1706b807f06794ea471347e3c99aa
Opcode Fuzzy Hash: 8e463dd7798071e398927771e0047db772ea95f210decea2538c471abd3bdf89
Instruction Fuzzy Hash: 0CF1A27C913615EBEF049F60FE8C2A83B74FB95311F638986C884622B4EB3509B4DB45

Function 00267110 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 238
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00267370
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00267419
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 0026742F

Strings

vZA, xrefs: 0026718A
D, xrefs: 0026725E

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D$vZA
API String ID: 2922976086-1306543988
Opcode ID: be5812a11f7dbd129e64a7026649f2e8e05ea1bf4391060b6f209691266dc47f
Instruction ID: 50cd5e0eaec52cac900909d11da867a93656c97dd48f89f658ba3a8cc6738949
Opcode Fuzzy Hash: be5812a11f7dbd129e64a7026649f2e8e05ea1bf4391060b6f209691266dc47f
Instruction Fuzzy Hash: 00A1D378907618EBDF00DF51FE5C2B87B74FB95715F638846D884A22B8E7740A60DB44

Function 00269698 Relevance: 7.8, APIs: 5, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00269851
TerminateProcess.KERNELBASE(00000000), ref: 002698DB
CloseHandle.KERNEL32(00000000), ref: 002698FA
Process32Next.KERNEL32(00000000,00000128), ref: 002699E4

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: Process$CloseHandleNextOpenProcess32Terminate
String ID:
API String ID: 2908628566-0
Opcode ID: 98b1692031bc526eaa510a80aff0033aca3694eeb8c9f6ae8797cdedea229e86
Instruction ID: 6531dd71cef9f155ae61bbc2dfb1529edd3ecd2f5b86c47c4bae60dd83b61df4
Opcode Fuzzy Hash: 98b1692031bc526eaa510a80aff0033aca3694eeb8c9f6ae8797cdedea229e86
Instruction Fuzzy Hash: 8EC1A27C907629DBDF00DF50FD8C1A97BB8FB99311F238499D88562264EB3509A4DF40

Function 0026C4C0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 385
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,?,?), ref: 0026C740
WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000), ref: 0026C99C
CloseHandle.KERNELBASE(00000000), ref: 0026CACD

Strings

d*, xrefs: 0026C690

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: d*
API String ID: 1065093856-3078804402
Opcode ID: 30f8bffd02463e69196ad61b68254461a30ae0e8e2cf4b96ae2c7db3581a9ef2
Instruction ID: a992ac254185e4d4443947001803dc807769d89e89d35aaaa15c7e706fafa281
Opcode Fuzzy Hash: 30f8bffd02463e69196ad61b68254461a30ae0e8e2cf4b96ae2c7db3581a9ef2
Instruction Fuzzy Hash: E9F1BFBC903618EBEF04AF60FD8C1A97BB4FB95311B238895D884632B4E73509A0CF41

Function 0026FB40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,N$,?,00244EE2,00000000), ref: 0026FB6E
RtlFreeHeap.NTDLL(00000000,?,00244EE2,00000000), ref: 0026FB75

Strings

N$, xrefs: 0026FB68, 0026FB6B

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: N$
API String ID: 3859560861-3066565318
Opcode ID: b668a5a20be7deee6d2b6d2815facdcc32d8bd27d10dac9f7c3584db7d9b428a
Instruction ID: fae6d090ec319adaa70a7a3474d278740c92c52e9ba252a2e0d457cf86f13914
Opcode Fuzzy Hash: b668a5a20be7deee6d2b6d2815facdcc32d8bd27d10dac9f7c3584db7d9b428a
Instruction Fuzzy Hash: 25F0DF79112629DBFF408FA1FD1D6643B28FB9AB01B430549E59C960B9EB7080A8C726

Function 00278450 Relevance: 4.7, APIs: 2, Strings: 1, Instructions: 184
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000D05), ref: 00278478
Sleep.KERNELBASE(000003E8,?,?,?,?,?,00000000), ref: 002786A5

Strings

Xo|;, xrefs: 002785C2

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: Sleep
String ID: Xo|;
API String ID: 3472027048-1593289618
Opcode ID: 83ef4a515934da2dd898a6d6fea0916f4adcb9d2f44a47d4ef2148ba7e4c1aa1
Instruction ID: 0ecbdde5834a6c105b34927e9125599b46d7c333e349deb1aa9d322e4154881d
Opcode Fuzzy Hash: 83ef4a515934da2dd898a6d6fea0916f4adcb9d2f44a47d4ef2148ba7e4c1aa1
Instruction Fuzzy Hash: 33819D7D913609EBDF009F60FE8C1AC7BB4FB98710B678459D889A2269EB700974DF01

Function 00250700 Relevance: 4.6, APIs: 3, Instructions: 143
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 002507CC
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00250848
FreeSid.ADVAPI32(?), ref: 00250937

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: bd41810fdf852c059183ed3916c372927cc5b1197b9bab6e5b98eef1fc81aaa9
Instruction ID: f090b1dcdb8d85b85071268abcaefeba368c2883013ce32edd650e402a4ec972
Opcode Fuzzy Hash: bd41810fdf852c059183ed3916c372927cc5b1197b9bab6e5b98eef1fc81aaa9
Instruction Fuzzy Hash: EC51BF7C907609EBEF009FA0FC8C9B97F74FB99306B538885D88422278DB305968CB55

Function 0027822A Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xo|;, xrefs: 002785C2

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID:
String ID: Xo|;
API String ID: 0-1593289618
Opcode ID: 3a2d734ff206988b634e0fd91932fcf45c14c43141ff5aaf1601cdc49cdb4f64
Instruction ID: 71dc68a8ef933e2a0c0087d7e722d1359ea97aed8583d9c107c165d520ce218f
Opcode Fuzzy Hash: 3a2d734ff206988b634e0fd91932fcf45c14c43141ff5aaf1601cdc49cdb4f64
Instruction Fuzzy Hash: 09919D7C917609EBDF049F60FD4C1AC7BB4FB95320B63885AC88562278EB710A64DF45

Function 00266B56 Relevance: 3.2, APIs: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Process32Next.KERNEL32(00000000,00000128), ref: 00266CDA

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: ede02009f29fd5116f88dfde193f99434ef3bdb6927aca7c73fcfd3c7cfa9116
Instruction ID: aa54deb649d33e029c1a76c55d2427f6e820b7b8c6a4ea5eedf31c8be48ecda2
Opcode Fuzzy Hash: ede02009f29fd5116f88dfde193f99434ef3bdb6927aca7c73fcfd3c7cfa9116
Instruction Fuzzy Hash: FD71AFBC903619DBDF009F20FD9C6A87B74FB95304F67888AD88463265E73609A4DB51

Function 00266B76 Relevance: 3.2, APIs: 2, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Process32Next.KERNEL32(00000000,00000128), ref: 00266CDA

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: f2399679700da8a5da5001c129f27b6cae5e8a2e3e82d5bd0f563f81b4abcaa3
Instruction ID: 26e7b51dc0e50d06ba80bedf8a6cadc2ce98ab3bc11f022a11d1a6408db8f0e4
Opcode Fuzzy Hash: f2399679700da8a5da5001c129f27b6cae5e8a2e3e82d5bd0f563f81b4abcaa3
Instruction Fuzzy Hash: 32619EBC90361AEBDF009F20FD9C6E87B74FB95304F63488AD88463265E73609A4DB51

Function 0027D780 Relevance: 3.0, APIs: 2, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?), ref: 0027D7C9
RtlAllocateHeap.NTDLL(00000000), ref: 0027D7D0

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 4771e5f3b7145e4dc3936a2f66fbb9b2c14166300dda38a79b897fe9e05d898e
Instruction ID: eb8f1fc7f547db96f9d5bad01b007670b90cf05c8a14d103ccca14b9509facc8
Opcode Fuzzy Hash: 4771e5f3b7145e4dc3936a2f66fbb9b2c14166300dda38a79b897fe9e05d898e
Instruction Fuzzy Hash: AEF0393C806608EBEF00AF60FD4D568BB7CFB59B12F124594EC8982728EB314AA0C751

Function 0024FD10 Relevance: 3.0, APIs: 2, Instructions: 23
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 0024FD24
CharLowerBuffA.USER32(?,00000000), ref: 0024FD2C

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: 968a7fc80bd051c89ff07637c15b6d5867c2a54b85cb878bbf998e4f2c719e7a
Instruction ID: d3972dc5ed6a85d3478dfa82166be3729474da3f445fe2ddc366e1db63599893
Opcode Fuzzy Hash: 968a7fc80bd051c89ff07637c15b6d5867c2a54b85cb878bbf998e4f2c719e7a
Instruction Fuzzy Hash: F4E01A39207114EBCF009F95FC4C5E93B78FB09B013164444F94C83620D7349A50CBAA

Function 0026FC02 Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 0025FD20: GetStdHandle.KERNEL32(000000F6,?,?,0026FC72), ref: 0025FD5F
Part of subcall function 0025FD20: GetStdHandle.KERNEL32(000000F5,00000000,?,?,0026FC72), ref: 0025FDD0
Part of subcall function 0025FD20: GetStdHandle.KERNEL32(000000F4,00000000,?,?,0026FC72), ref: 0025FE09

ExitProcess.KERNEL32 ref: 0026FD96

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: Handle$ExitProcess
String ID:
API String ID: 256993070-0
Opcode ID: aae42179a79c85f1a6255f5398fe1150e82a7582710400e61b5d0abc7a64545b
Instruction ID: 3c01525c5d6bcd847162418104f8178f389a0f5765a4993e5197b074b8a12cd9
Opcode Fuzzy Hash: aae42179a79c85f1a6255f5398fe1150e82a7582710400e61b5d0abc7a64545b
Instruction Fuzzy Hash: 0B31817C813626E7CF04AF61FD4D0A87B70FB99711B238496D88162674EB350670DB45

Function 0026BE20 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 0026BE96

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: ee6432118d91a613566073c7faf9cb97c9829f5cb7998ac3ac609736723fe7fb
Instruction ID: f1944a814d2e25f8695974b02d4d54169fa8213b6e2b048c7140870546329e87
Opcode Fuzzy Hash: ee6432118d91a613566073c7faf9cb97c9829f5cb7998ac3ac609736723fe7fb
Instruction Fuzzy Hash: BBF05E3C013A15D6DF04AF35FC8C0753B74F7A9B163A64055E589821B4EB3494F4C744

Non-executed Functions

Function 00270FE0 Relevance: 12.3, APIs: 8, Instructions: 309serviceCOMMON

Download Yara Rule

APIs

CreateServiceA.ADVAPI32(00000000,00892F90,00892F90,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 002711BF
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 0027121F
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00271259
CloseServiceHandle.ADVAPI32(00000000), ref: 00271290
OpenServiceA.ADVAPI32(00000000,00892F90,00000010), ref: 002712E0
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0027133D
CloseServiceHandle.ADVAPI32(00000000), ref: 00271368
CloseServiceHandle.ADVAPI32(00000000), ref: 00271483

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: Service$CloseHandle$Start$ChangeConfig2CreateOpen
String ID:
API String ID: 229943926-0
Opcode ID: 86d9cff3694ca04ac8fc768e29a516ac63e71717b366b80e73e4977a66bde2a2
Instruction ID: 63323b672264318b48fb2e7e82e6f19e2bea579cfc3e4bee4f2eb4d25e5a0829
Opcode Fuzzy Hash: 86d9cff3694ca04ac8fc768e29a516ac63e71717b366b80e73e4977a66bde2a2
Instruction Fuzzy Hash: BBD1E37C903619EBEF049F64FC8D6A87B74FB95711F638856D884622B8EB7444B0CB41

Function 0026DB90 Relevance: 6.4, APIs: 4, Instructions: 366sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 0026DD32

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 9019acfebbe696e9165fe3a28b83b5e9e7c94286a334a58a9104aaf34c6e9c14
Instruction ID: dfbfdb938c5f88d57f4f32d7a2f617399b8e9b07de105529c6ce41ce142f1f4c
Opcode Fuzzy Hash: 9019acfebbe696e9165fe3a28b83b5e9e7c94286a334a58a9104aaf34c6e9c14
Instruction Fuzzy Hash: D4E1EF3CA0361ADBEF049F60FD5C1B97BB5FB99320B178599D885632B4EB3109A4CB40

Function 0027DD10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 362fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,000000FF), ref: 0027DE87
ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,?,000000FF), ref: 0027DEEC
CloseHandle.KERNEL32(00000000,?,?,?,?,000000FF), ref: 0027DF39
GetTickCount.KERNEL32 ref: 0027DF9E

Part of subcall function 00245630: lstrlenA.KERNEL32(?,?,?,00241050,?), ref: 002456E7

Part of subcall function 0027DAC0: wvsprintfA.USER32(00000000,?,?), ref: 0027DBE2

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0027E1C3
WriteFile.KERNEL32(00000000,000000FF,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0027E1FD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 0027E216

Strings

vZA, xrefs: 0027E096

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWritelstrlenwvsprintf
String ID: vZA
API String ID: 3963321075-254142502
Opcode ID: 77bb6c89d7c2bab8ff6e98e3de2745190b2b74430db7376ae344570296621b44
Instruction ID: c3c0f6c724695a6a1468025f36dbc505dc5d118942287e586118936d4f822acd
Opcode Fuzzy Hash: 77bb6c89d7c2bab8ff6e98e3de2745190b2b74430db7376ae344570296621b44
Instruction Fuzzy Hash: C7E1037C903615EBEF009F20FC8D6A93B79FB99310F978495E888632B4EB750964CB41

Function 0025FFA0 Relevance: 12.3, APIs: 8, Instructions: 331registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(00892F90,00269E30), ref: 00260120
SetServiceStatus.ADVAPI32(00000000,0028E98C), ref: 002601D1
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 002601FE
SetServiceStatus.ADVAPI32(00000000,0028E98C), ref: 00260283
WaitForSingleObject.KERNEL32(00000000,00001388), ref: 002602F7
SetServiceStatus.ADVAPI32(00000000,0028E98C), ref: 00260462
CloseHandle.KERNEL32(00000000), ref: 00260481
SetServiceStatus.ADVAPI32(00000000,0028E98C), ref: 00260537

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: ec31585b032455c2a32059a62698755063a00ac817bc70ec364ddd8528e24598
Instruction ID: 4e094b0781b18dfd640179963823e198fdc944a5f7864bd3b955a9b7ace697ac
Opcode Fuzzy Hash: ec31585b032455c2a32059a62698755063a00ac817bc70ec364ddd8528e24598
Instruction Fuzzy Hash: 2BF1B07C907614EBDF44DF60FD8D1A83BB4FB99305B23899AD884632B4E7714960DB01

Function 00279E58 Relevance: 9.4, APIs: 6, Instructions: 435sleepfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00266890: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 002669A2

Sleep.KERNEL32(000007D0,?,?,?,?,?,00000000), ref: 00279F15
SetFileAttributesA.KERNEL32(0028E820,00000080,?,?,?,?,00000000), ref: 00279FA9
CopyFileA.KERNEL32(?,0028E820,00000000), ref: 0027A051
SetFileAttributesA.KERNEL32(0028E820,00000002,?,?,?,?,00000000), ref: 0027A072

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: File$Attributes$CopyCreateSleepSnapshotToolhelp32
String ID:
API String ID: 443146253-0
Opcode ID: 1b7bf71363e6f10e27493f3e65abf033c50797c5328f749172b4bb01a9dcf0c5
Instruction ID: bc55bf0a07860c6b3d3454d531232e295fac769442cf793cb3c74fe37e90a71e
Opcode Fuzzy Hash: 1b7bf71363e6f10e27493f3e65abf033c50797c5328f749172b4bb01a9dcf0c5
Instruction Fuzzy Hash: 4302E07C903615EBEF049F60FD4D6A93B74FB99711F238889E884A32B4E77509A0DB41

Function 00268A40 Relevance: 7.6, APIs: 5, Instructions: 85synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000001,00251B96), ref: 00268AAF
CreateThread.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 00268AE5
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00268B16
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00268B33
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00268B70

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 3474b3ed9f8b0ce453db3ce8726faa20525d87b0fd9a7d1d3f4f862bb1b7403e
Instruction ID: ccc72af6a2e9aa82d6e4c4edd7c22e3de9a2db49bd483c79fd42208be1299afe
Opcode Fuzzy Hash: 3474b3ed9f8b0ce453db3ce8726faa20525d87b0fd9a7d1d3f4f862bb1b7403e
Instruction Fuzzy Hash: A1317C7C102324EBDB048F25FC8DB793BF4FB48721F02852AE995966A4E3789851CB15

Function 0025FD20 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,?,?,0026FC72), ref: 0025FD5F
GetStdHandle.KERNEL32(000000F5,00000000,?,?,0026FC72), ref: 0025FDD0
GetStdHandle.KERNEL32(000000F4,00000000,?,?,0026FC72), ref: 0025FE09

Strings

(, xrefs: 0025FD62
(, xrefs: 0025FE0C

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: Handle
String ID: ($(
API String ID: 2519475695-2810608770
Opcode ID: fb2742ac33611d96f96f843175c9292819aeeb3e5097e502da1d1c8a6463d237
Instruction ID: 089160a964dce4b1dabbd10f388137603e18d725954922fb066bc6c795344f95
Opcode Fuzzy Hash: fb2742ac33611d96f96f843175c9292819aeeb3e5097e502da1d1c8a6463d237
Instruction Fuzzy Hash: DE317A7C907224EBCF00AF66FD4D0687FB8FB993217238556E894922B4EB300960CB55

Function 0027FC20 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 469sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0027ABB0: CloseHandle.KERNEL32(00000000,00000000,00000001,00000000), ref: 0027ABFF

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00280099
Sleep.KERNEL32(00015F90), ref: 0028031A

Strings

vZA, xrefs: 0027FED9
Hbu, xrefs: 0027FEB4

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: CloseFileHandleModuleNameSleep
String ID: Hbu$vZA
API String ID: 420089116-1991274701
Opcode ID: b15c3bf1ba726317845e3c2783789f9253eedd1fa5ac2475883d208f5fcfa483
Instruction ID: f8e24394957b31665f58c0384b77feaf5833a0e92860913f8e24c235b29d160d
Opcode Fuzzy Hash: b15c3bf1ba726317845e3c2783789f9253eedd1fa5ac2475883d208f5fcfa483
Instruction Fuzzy Hash: 5612DE7C903615EBDF009F20FD9D6B93BB4FB99310B538499E885A32B4EB3409A4DB41

Function 0024C3D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,?,?,?,00245258), ref: 0024C482
SystemTimeToFileTime.KERNEL32(?,XR$,?,?,?,?,00245258), ref: 0024C4CD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0024C536

Strings

XR$, xrefs: 0024C4C5, 0024C4C8

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: Time$System$FileUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: XR$
API String ID: 1858273683-694189341
Opcode ID: 1e1d1f889208bafd746d75026d4d9eb25b0daded123cbb4a19d8d3a34e3c7a08
Instruction ID: dfbaa9cc3a681f2e0239911d72bce531effe23ae4f742c3fde1208994ec94740
Opcode Fuzzy Hash: 1e1d1f889208bafd746d75026d4d9eb25b0daded123cbb4a19d8d3a34e3c7a08
Instruction Fuzzy Hash: 9041C07C903609DBEF04DF64FE8C5687B75FB89710B638996C554A22B8EB388921CB01

Function 0026B860 Relevance: 6.3, APIs: 4, Instructions: 327fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0026B986
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 0026BAA4
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 0026BC19
CloseHandle.KERNEL32(00000000,?,00000000), ref: 0026BD24

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: CloseFileHandle$CreateRead
String ID:
API String ID: 2564258376-0
Opcode ID: b2f14930124270b5693afcca8adae13f0aa6986f94bdd10dd82d03259331bbad
Instruction ID: eed3947651c3c9f430ce8cec8cd74bd36cb78857e520a5db8ab51d8c796fec85
Opcode Fuzzy Hash: b2f14930124270b5693afcca8adae13f0aa6986f94bdd10dd82d03259331bbad
Instruction Fuzzy Hash: 50D1027C913615EBEF00EF60FD4C6A93BB4FB89711F178496D984A22B4EB7509A0CB41

Function 0025C930 Relevance: 5.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,?), ref: 0025C9A4
HeapReAlloc.KERNEL32(00000000), ref: 0025C9AB
GetProcessHeap.KERNEL32(00000000,?,00000000,?), ref: 0025C9C5
HeapAlloc.KERNEL32(00000000), ref: 0025C9CC

Memory Dump Source

Source File: 00000010.00000002.3212611770.0000000000241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00240000, based on PE: true

Associated: 00000010.00000002.3212582619.0000000000240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212644846.0000000000283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212665626.000000000028E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3212683449.0000000000290000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_240000_ktwsjztevxgl.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 11a0daa4a8b1fdea86e31a0563aa76ec430329f15a08cbc8867c37520ea82553
Instruction ID: 610e57e371c0fa493641a9cd77ff36490c94e9d1982417646e0ce4e7c5bda0f6
Opcode Fuzzy Hash: 11a0daa4a8b1fdea86e31a0563aa76ec430329f15a08cbc8867c37520ea82553
Instruction Fuzzy Hash: 59112778906208FBDF00DFA1FA4C6A9BBB8FF48712F118059ED4997264D6318A50DB92

Analysis Process: ktwsjztevxgl.exePID: 2796, Parent PID: 5920COMMON

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	859
Total number of Limit Nodes:	13

Executed Functions

Function 003D18D0 Relevance: 24.4, APIs: 11, Strings: 2, Instructions: 1699fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 003D1C01
DeleteFileA.KERNELBASE(00000000,?,?,?,?,?,00000000), ref: 003D1F0E
RemoveDirectoryA.KERNELBASE(00000000,?,?,?,?,?,00000000), ref: 003D1F61
CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,00000000), ref: 003D20AF
CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 003D21B9
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 003D27C9

Strings

\, xrefs: 003D2BF6
C:\Windows\system32\config\systemprofile, xrefs: 003D251F, 003D266E

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: Directory$Create$DeleteFileRemove
String ID: C:\Windows\system32\config\systemprofile$\
API String ID: 274774477-3206176487
Opcode ID: c1911588349595549dcbd8b55d616f34615a73d36f1c4867e3d5102cb1895f43
Instruction ID: 906f2bb626ddc648c5e1c0b91a1cb8202a3b1827ce0852f45fc5a7e926b848ff
Opcode Fuzzy Hash: c1911588349595549dcbd8b55d616f34615a73d36f1c4867e3d5102cb1895f43
Instruction Fuzzy Hash: E3F2157590060ADBD707DF62FD586B93BBDFB98310F11885AD885A33B4EB310A64CB45

Function 003DB2B0 Relevance: 9.3, APIs: 6, Instructions: 295
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 003DB3EF
GetFileTime.KERNEL32(00000000,?,?,?), ref: 003DB485
CloseHandle.KERNEL32(00000000), ref: 003DB4C7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003DB5BA
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 003DB60F
CloseHandle.KERNEL32(00000000), ref: 003DB681

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: 04170d315460994d676c0ab45941f4e477cec68d5093336f1c3651a3cd9fdd96
Instruction ID: 480ab4c79dc353895870b3d452ccaffe6f2abf9ef4b25c7ea914438374975878
Opcode Fuzzy Hash: 04170d315460994d676c0ab45941f4e477cec68d5093336f1c3651a3cd9fdd96
Instruction Fuzzy Hash: 19C1F179A01206DBD703DF52FD886B87BBDFB85710F21485AE884933B4EB314960CB45

Function 003DC4C0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 385
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,?,?), ref: 003DC740
WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000), ref: 003DC99C
CloseHandle.KERNELBASE(00000000), ref: 003DCACD

Strings

d*, xrefs: 003DC690

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: d*
API String ID: 1065093856-3078804402
Opcode ID: c4fa5496220778846a14df4956109b399314a6d7becb6b27e043e3f26c9f8e8e
Instruction ID: d727c21aebe0659c184f32a7aa276dff1e096786fbb86a1eb8f9eef2c3bf8c33
Opcode Fuzzy Hash: c4fa5496220778846a14df4956109b399314a6d7becb6b27e043e3f26c9f8e8e
Instruction Fuzzy Hash: 09F1F375900609EBD707AF62FD885B97BBDFB98311F21885AD980A33B4EB3545A0CF41

Function 003D6890 Relevance: 6.4, APIs: 4, Instructions: 356
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 003D69A2
Process32First.KERNEL32(00000000,00000128), ref: 003D6AD3

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID:
API String ID: 2353314856-0
Opcode ID: 3b1b19d66e5ed09971bb331034e329feb1b7b4ed76549e05a92660ecbd8a5737
Instruction ID: 06cf99e3cd4f62664d4f4cfd0fdda53593c9d0be7a5f6090a0238345459cde9a
Opcode Fuzzy Hash: 3b1b19d66e5ed09971bb331034e329feb1b7b4ed76549e05a92660ecbd8a5737
Instruction Fuzzy Hash: 26F1057490160AEBDB079F22FE482B83B7DFB95311F62444AC4C4923B4EB3546A8DF45

Function 003DFB40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,N;,?,003B4EE2,00000000), ref: 003DFB6E
RtlFreeHeap.NTDLL(00000000,?,003B4EE2,00000000), ref: 003DFB75

Strings

N;, xrefs: 003DFB68, 003DFB6B

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: N;
API String ID: 3859560861-1002446643
Opcode ID: a5356dbb1a1504d4f18c6a4b8b766ed8ffe5c466ddb60d460f8c8141da09b722
Instruction ID: fab5122ad5e40cf718e70d9c458fcb12ce70dbca5c6a910eab008cd98ed6f49c
Opcode Fuzzy Hash: a5356dbb1a1504d4f18c6a4b8b766ed8ffe5c466ddb60d460f8c8141da09b722
Instruction Fuzzy Hash: 5AF0153210061ADBF7029FA6FE5DA747B3DFB98701F41054AE189960B4DB7081A8C726

Function 003C0700 Relevance: 4.6, APIs: 3, Instructions: 143
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 003C07CC
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 003C0848
FreeSid.ADVAPI32(?), ref: 003C0937

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 6b5979ee44a815db19a746fc0f69f2ab7e5110b80a424de6c0a91de175598a27
Instruction ID: 140fd835525abac9d756c0ccad090252f11f2080df11afb3818f06a71e45354a
Opcode Fuzzy Hash: 6b5979ee44a815db19a746fc0f69f2ab7e5110b80a424de6c0a91de175598a27
Instruction Fuzzy Hash: EF51C27580460AEBE7039FA1FD4C9BD7F7EFB98300F51889AE48062274EB304968CB55

Function 003ED780 Relevance: 3.0, APIs: 2, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?), ref: 003ED7C9
RtlAllocateHeap.NTDLL(00000000), ref: 003ED7D0

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 265ac6ed33cffa48449b03abdb0ce8222c48708cc568075641db2544574fc8ea
Instruction ID: 2a8302585ce6b61cf41be721c5aebb069ce538caeaf7319ca90f6a95639d97ef
Opcode Fuzzy Hash: 265ac6ed33cffa48449b03abdb0ce8222c48708cc568075641db2544574fc8ea
Instruction Fuzzy Hash: 06F01538804609EBDB02AF60F909978BB7CFB58B11F100885EC8582334EB314AA4C751

Function 003BFD10 Relevance: 3.0, APIs: 2, Instructions: 23
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 003BFD24
CharLowerBuffA.USER32(?,00000000), ref: 003BFD2C

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: e36b35463e16ed59857a258e7a19dbf791408fb9044d391aadcd8db99f10d61a
Instruction ID: 80231fe3bc507c161c2d4558bf385f8c41089a3ef4987fb3f6d28b9f07ec3294
Opcode Fuzzy Hash: e36b35463e16ed59857a258e7a19dbf791408fb9044d391aadcd8db99f10d61a
Instruction Fuzzy Hash: F4E01A35205224EBCB02AF95FC485F93B7DFB08701B044445F94983330D7309A54CBA9

Non-executed Functions

Function 003E0FE0 Relevance: 12.3, APIs: 8, Instructions: 309
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateServiceA.ADVAPI32(00000000,00C64358,00C64358,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 003E11BF
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 003E121F
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 003E1259
CloseServiceHandle.ADVAPI32(00000000), ref: 003E1290
OpenServiceA.ADVAPI32(00000000,00C64358,00000010), ref: 003E12E0
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 003E133D
CloseServiceHandle.ADVAPI32(00000000), ref: 003E1368
CloseServiceHandle.ADVAPI32(00000000), ref: 003E1483

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: Service$CloseHandle$Start$ChangeConfig2CreateOpen
String ID:
API String ID: 229943926-0
Opcode ID: d2f5415a9d335726d6215ea8645640edc0f4aeca148c0abf1925ebb54c11c6d9
Instruction ID: d7c95d9bf3fa6f7033ac8054f19017812cac70220bafb2a484b569c36ba869f3
Opcode Fuzzy Hash: d2f5415a9d335726d6215ea8645640edc0f4aeca148c0abf1925ebb54c11c6d9
Instruction Fuzzy Hash: CCD1057590460AEBE7079F62FD886B87FBDFB88711F11895AD580A23B4EB7044A0CB45

Function 003DDB90 Relevance: 6.4, APIs: 4, Instructions: 366sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 003DDD32

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: ea83c09ac6abbb72d1e303400d5a549a2f4ddb5f24d2a6592302f0d6e277b7af
Instruction ID: d8e2edbec75d0c2177a4a146d13a68a94a2e767603e3188380abbcaff15c3a71
Opcode Fuzzy Hash: ea83c09ac6abbb72d1e303400d5a549a2f4ddb5f24d2a6592302f0d6e277b7af
Instruction Fuzzy Hash: B8E1253590061ADBDB079F66FD586B87BBDFB99310F12859AD881A33B4EB310964CF01

Function 003CFFA0 Relevance: 12.3, APIs: 8, Instructions: 331
registrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(00C64358,003D9E30), ref: 003D0120
SetServiceStatus.ADVAPI32(00000000,003FE98C), ref: 003D01D1
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 003D01FE
SetServiceStatus.ADVAPI32(00000000,003FE98C), ref: 003D0283
WaitForSingleObject.KERNEL32(00000000,00001388), ref: 003D02F7
SetServiceStatus.ADVAPI32(00000000,003FE98C), ref: 003D0462
CloseHandle.KERNEL32(00000000), ref: 003D0481
SetServiceStatus.ADVAPI32(00000000,003FE98C), ref: 003D0537

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: 7bc6cc4d99c283a3c5da513452b2b3f290e02b875747c64eaf8e57511c639753
Instruction ID: 78ceb6048a6559afbcc0b11739ee94d0202dfe45a28ed032826f71e717c86fe8
Opcode Fuzzy Hash: 7bc6cc4d99c283a3c5da513452b2b3f290e02b875747c64eaf8e57511c639753
Instruction Fuzzy Hash: 47F1BC79905219EBD7079F61FE485B93FBDFB99700F21884AD880933B4EB744A60DB11

Function 003EDD10 Relevance: 10.9, APIs: 7, Instructions: 362fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,000000FF), ref: 003EDE87
ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,?,000000FF), ref: 003EDEEC
CloseHandle.KERNEL32(00000000,?,?,?,?,000000FF), ref: 003EDF39
GetTickCount.KERNEL32 ref: 003EDF9E

Part of subcall function 003B5630: lstrlenA.KERNEL32(?,?,?,003B1050,?), ref: 003B56E7

Part of subcall function 003EDAC0: wvsprintfA.USER32(00000000,?,?), ref: 003EDBE2

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 003EE1C3
WriteFile.KERNEL32(00000000,000000FF,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 003EE1FD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 003EE216

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWritelstrlenwvsprintf
String ID:
API String ID: 3963321075-0
Opcode ID: 817e811b0f97e01f26c0ac9f6cfb33471772a64bd0c1cf41c5e895d73c93471b
Instruction ID: 0795d93eef3c21960334d4d2d89db9911c3efb7cbc0c43aba52ccf38633e7d21
Opcode Fuzzy Hash: 817e811b0f97e01f26c0ac9f6cfb33471772a64bd0c1cf41c5e895d73c93471b
Instruction Fuzzy Hash: 72E17775900619EBD707AF22FC487B93B7EFB99300F124956E884973B4EB7549A4CB01

Function 003D9460 Relevance: 7.9, APIs: 5, Instructions: 404processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 003D9600

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: 940315c70c4fe5c4117d1fcab46c9f75461551ae98882f38084c6d173f506e79
Instruction ID: 83157c26e08486925ad3b57274eb7a6e8f5be0da93aa81acb9c0f87179a50945
Opcode Fuzzy Hash: 940315c70c4fe5c4117d1fcab46c9f75461551ae98882f38084c6d173f506e79
Instruction Fuzzy Hash: 3C02257580161AEBD7079F62FE4C2B87B7DFB99311F22449AD880A2374EB3545A4CF01

Function 003D8A40 Relevance: 7.6, APIs: 5, Instructions: 85synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000001,003C1B96), ref: 003D8AAF
CreateThread.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 003D8AE5
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003D8B16
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 003D8B33
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003D8B70

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: da6a6c076c6833dd85111a2e6ce51ec1a4196229f9800048cb4e2d48b280b038
Instruction ID: 9e199aa7143d7a8d45e6e1b90deb1b495a7a52f87c72ddaf6600c7c5ece375bf
Opcode Fuzzy Hash: da6a6c076c6833dd85111a2e6ce51ec1a4196229f9800048cb4e2d48b280b038
Instruction Fuzzy Hash: 7D318C78100324EBD3069F16ED89B793BFDFB08B12F00842AE995863B0E7789551CB15

Function 003CFD20 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,?,?,003DFC72), ref: 003CFD5F
GetStdHandle.KERNEL32(000000F5,00000000,?,?,003DFC72), ref: 003CFDD0
GetStdHandle.KERNEL32(000000F4,00000000,?,?,003DFC72), ref: 003CFE09

Strings

?, xrefs: 003CFD62
?, xrefs: 003CFE0C

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: Handle
String ID: ?$?
API String ID: 2519475695-3975468797
Opcode ID: 2e333517e8bcbc22da5361b14f84cc0aa97e113167153600f218acd9cb621d02
Instruction ID: 43db672736c4be25dff43d3cdbc0982b8dba5da940bca5165b18d0df03dfa164
Opcode Fuzzy Hash: 2e333517e8bcbc22da5361b14f84cc0aa97e113167153600f218acd9cb621d02
Instruction Fuzzy Hash: AD319E75904218EBC703AF66FD494783FBDFB98321F118556E984D32B4EB340964CB56

Function 003D7110 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 238processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 003D7370
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 003D7419
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 003D742F

Strings

D, xrefs: 003D725E

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: cf7df73a01416576ff788ac4e5f4f35b8480837faec9a4634988ec912c1387e1
Instruction ID: f4e63781fda07d791e8e1cbaa6909242f36018e2528db441440dea51804a0fb2
Opcode Fuzzy Hash: cf7df73a01416576ff788ac4e5f4f35b8480837faec9a4634988ec912c1387e1
Instruction Fuzzy Hash: 2EA10070900619EBDB07DF92FE486BC7B7DFB84311F21885AD880A22B4FB744A64DB45

Function 003BC3D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,?,?,?,003B5258), ref: 003BC482
SystemTimeToFileTime.KERNEL32(?,XR;,?,?,?,?,003B5258), ref: 003BC4CD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003BC536

Strings

XR;, xrefs: 003BC4C5, 003BC4C8

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: Time$System$FileUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: XR;
API String ID: 1858273683-2758308072
Opcode ID: c3c880231a166dd64a7ab68daa61325d76a1788e722be5508914c3a131de1b65
Instruction ID: a113d3e06f7d494a2aba33062ab07b72e7f9c3273a63b1d8c1b916a215fd7ebf
Opcode Fuzzy Hash: c3c880231a166dd64a7ab68daa61325d76a1788e722be5508914c3a131de1b65
Instruction Fuzzy Hash: A141B23590060ADFE703DFA6FE485B93B7EFB84714F11859AD585923B8EB348921CB05

Function 003DB860 Relevance: 6.3, APIs: 4, Instructions: 327fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003DB986
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 003DBAA4
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 003DBC19
CloseHandle.KERNEL32(00000000,?,00000000), ref: 003DBD24

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: CloseFileHandle$CreateRead
String ID:
API String ID: 2564258376-0
Opcode ID: a5a6d9e5ed6788f93c8b4fd85fa1bbef4450a691c3717a008409d2db5ef0247b
Instruction ID: 98428ed06516a5cb90c39fbccd5b71567e601f45ac13ce849801c2e9fe991239
Opcode Fuzzy Hash: a5a6d9e5ed6788f93c8b4fd85fa1bbef4450a691c3717a008409d2db5ef0247b
Instruction Fuzzy Hash: E7D11175900615EBE707EF62FE487B97BBDFB88311F114856D580923B4EB744AA0CB41

Function 003EFC20 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 469sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 003EABB0: CloseHandle.KERNEL32(00000000,00000000,00000001,00000000), ref: 003EABFF

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 003F0099
Sleep.KERNEL32(00015F90), ref: 003F031A

Strings

Hbu, xrefs: 003EFEB4

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: CloseFileHandleModuleNameSleep
String ID: Hbu
API String ID: 420089116-125748917
Opcode ID: b500e4a62a017ef7ad37e3cac7053d0d58bf9630b6fcfb7ce7b138d54a59d19a
Instruction ID: a4d3f8b91b41a6995fd7ed2de3a26fc99160d26b72bcb4ab03a7099899060ac5
Opcode Fuzzy Hash: b500e4a62a017ef7ad37e3cac7053d0d58bf9630b6fcfb7ce7b138d54a59d19a
Instruction Fuzzy Hash: F3127675900615EBD307DF22FD896B93BBDFB98710F12855AE880972B0EB744A60CF42

Function 003CC930 Relevance: 5.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,?), ref: 003CC9A4
HeapReAlloc.KERNEL32(00000000), ref: 003CC9AB
GetProcessHeap.KERNEL32(00000000,?,00000000,?), ref: 003CC9C5
HeapAlloc.KERNEL32(00000000), ref: 003CC9CC

Memory Dump Source

Source File: 00000014.00000002.3731589209.00000000003B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000014.00000002.3731448935.00000000003B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731745311.00000000003F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731812100.00000000003FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.3731887678.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3b0000_ktwsjztevxgl.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 2d3e7afa7110197d3020e1cfa07278bb73b22004e92ba2a23f2afa6e458bce43
Instruction ID: 95c1e2445a93a991486ccab3aef7cd2b42be8d94ab6286f80986b8346c1c8959
Opcode Fuzzy Hash: 2d3e7afa7110197d3020e1cfa07278bb73b22004e92ba2a23f2afa6e458bce43
Instruction Fuzzy Hash: F5112A74905209FBDB01DFA2EA486BD7BBCFF48312F00845AED4987370EA318A50DB52

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nnzZhhVIqM.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

C:\Windows\depbjdo\ihbjigr37cyf

C:\depbjdo\ihbjigr37cyf

C:\depbjdo\jbmx3cphxnwpllpjrowiz.exe

C:\depbjdo\ktwsjztevxgl.exe

C:\depbjdo\ovkmkkgit.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
nnzZhhVIqM.exe

Function 005CDB90 Relevance: 7.9, APIs: 5, Instructions: 366
sleepCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre