Edit tour

Windows Analysis Report
ahmbf.ps1

Overview

General Information

Sample name:	ahmbf.ps1
Analysis ID:	1559592
MD5:	41aaa0283372e0a4c4e9231f766f68f3
SHA1:	65b5d719a4e8802b3ad44e02b7531a796e657050
SHA256:	6c8d9120fb409fe443c79fcda2a76303dd3dfd93b2608f5d8274b7e20f88569a
Infos:

Detection

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Connects to a pastebin service (likely for C&C)

Injects a PE file into a foreign processes

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Suspicious execution chain found

Uses dynamic DNS services

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 7548 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ahmbf.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7752 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.4166334815.00000000056C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.4161705360.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.4156977457.0000000002E51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: powershell.exe PID: 7548	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x3fa4f:$b2: ::FromBase64String( 0x1a2c50:$b2: ::FromBase64String( 0x411644:$b2: ::FromBase64String( 0x414930:$b2: ::FromBase64String( 0x1994c2:$s1: -join 0x19e33d:$s1: -join 0x14a3:$s3: reverse 0x1791:$s3: reverse 0x1eab:$s3: reverse 0x2664:$s3: reverse 0x974f:$s3: reverse 0x9b69:$s3: reverse 0xa6f1:$s3: reverse 0xb39e:$s3: reverse 0xa54da:$s3: reverse 0xb0d18:$s3: reverse 0x3ad1ec:$s3: Reverse 0x3afafe:$s3: Reverse 0x3b883c:$s3: Reverse 0x3d393c:$s3: reverse 0x3dd829:$s3: reverse
Process Memory Space: RegAsm.exe PID: 7752	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Unpacked PEs

Source	Rule	Description	Author
2.2.RegAsm.exe.56c0000.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
2.2.RegAsm.exe.408b788.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.powershell.exe.1c1933383d8.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ahmbf.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ahmbf.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ahmbf.ps1", ProcessId: 7548, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ahmbf.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ahmbf.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ahmbf.ps1", ProcessId: 7548, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Source: unknown

HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49730 version: TLS 1.2

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: RegAsm.exe, 00000002.00000002.4165950982.00000000055F0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: RegAsm.exe, 00000002.00000002.4165950982.00000000055F0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: Bclupty.pdb source: RegAsm.exe, 00000002.00000002.4165136202.0000000005520000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Networking

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Uses dynamic DNS services

Source: unknown

DNS query: name: xweb.ddns.net

Yara detected Generic Downloader

Source: Yara match

File source: 0.2.powershell.exe.1c1933383d8.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 31.13.224.69:7211

Source: global traffic

HTTP traffic detected: GET /raw/GF0ptUGb HTTP/1.1Host: pastebin.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24

Source: Joe Sandbox View

ASN Name: SARNICA-ASBG SARNICA-ASBG

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /raw/GF0ptUGb HTTP/1.1Host: pastebin.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: pastebin.com
Source: global traffic	DNS traffic detected: DNS query: xweb.ddns.net

Source: powershell.exe, 00000000.00000002.1739713631.000001C1934BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: powershell.exe, 00000000.00000002.1739713631.000001C193071000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.4156977457.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.4156977457.00000000030F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000000.00000002.1739713631.000001C193071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: RegAsm.exe, 00000002.00000002.4165950982.00000000055F0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: RegAsm.exe, 00000002.00000002.4165950982.00000000055F0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: RegAsm.exe, 00000002.00000002.4165950982.00000000055F0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: powershell.exe, 00000000.00000002.1739713631.000001C1932A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: powershell.exe, 00000000.00000002.1739713631.000001C1932A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/GF0ptUGb
Source: RegAsm.exe, 00000002.00000002.4165950982.00000000055F0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: RegAsm.exe, 00000002.00000002.4156977457.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.4165950982.00000000055F0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: RegAsm.exe, 00000002.00000002.4165950982.00000000055F0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49730 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 7548, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.powershell.exe.1c1a362e3e0.2.raw.unpack, Token.cs

Large array initialization: GetRef: array initializer size 585920

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02C84D18	2_2_02C84D18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02C81BF0	2_2_02C81BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02C81618	2_2_02C81618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02C81628	2_2_02C81628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02C81CCD	2_2_02C81CCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02C81CE3	2_2_02C81CE3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02C81CFE	2_2_02C81CFE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02C81C83	2_2_02C81C83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02C81C98	2_2_02C81C98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02C81CB0	2_2_02C81CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02C81C4C	2_2_02C81C4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02C81C6D	2_2_02C81C6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02C81C2C	2_2_02C81C2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02C83D84	2_2_02C83D84
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02C84D0F	2_2_02C84D0F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C1043	2_2_053C1043
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_056493F8	2_2_056493F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_05649510	2_2_05649510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_056484E8	2_2_056484E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_056484D7	2_2_056484D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0564962D	2_2_0564962D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_056493E8	2_2_056493E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_05720C00	2_2_05720C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_05721CA8	2_2_05721CA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_05720F37	2_2_05720F37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0573B903	2_2_0573B903
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_057381B0	2_2_057381B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_05732C36	2_2_05732C36
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0573C010	2_2_0573C010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_05730F18	2_2_05730F18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_05736268	2_2_05736268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_05735650	2_2_05735650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_05737650	2_2_05737650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_05739AF8	2_2_05739AF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0573792B	2_2_0573792B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_05735998	2_2_05735998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0573BC7F	2_2_0573BC7F

Source: Process Memory Space: powershell.exe PID: 7548, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 0.2.powershell.exe.1c1a362e3e0.2.raw.unpack, MethodOrderException.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.powershell.exe.1c1a362e3e0.2.raw.unpack, MethodOrderException.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.powershell.exe.1c1a362e3e0.2.raw.unpack, Token.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, NuZmITLFqQu1WuWA3dj.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, NuZmITLFqQu1WuWA3dj.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, NuZmITLFqQu1WuWA3dj.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, NuZmITLFqQu1WuWA3dj.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, HE3r3mLvex6HsnUNTTu.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, zyVVkIvwMWMEFUVZ5tB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, NmZmeuMLAX3WYGPinR.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, NmZmeuMLAX3WYGPinR.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, oIWxokvQhGHS8muoQ3v.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal96.troj.expl.evad.winPS1@4/5@5/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7556:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\P@55w0rd!

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xa2kn2jv.ef2.ps1

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ahmbf.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: ahmbf.ps1

Static file information: File size 1916592 > 1048576

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: RegAsm.exe, 00000002.00000002.4165950982.00000000055F0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: RegAsm.exe, 00000002.00000002.4165950982.00000000055F0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: Bclupty.pdb source: RegAsm.exe, 00000002.00000002.4165136202.0000000005520000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.powershell.exe.1c1a362e3e0.2.raw.unpack, MethodOrderException.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, NuZmITLFqQu1WuWA3dj.cs	.Net Code: Type.GetTypeFromHandle(Wex5GZY6TWNikhqTK5m.FqVwCfyODE(16777307)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(Wex5GZY6TWNikhqTK5m.FqVwCfyODE(16777250)),Type.GetTypeFromHandle(Wex5GZY6TWNikhqTK5m.FqVwCfyODE(16777305))})

.NET source code contains potential unpacker

Source: 0.2.powershell.exe.1c1ab3d0000.3.raw.unpack, -.cs	.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
Source: 0.2.powershell.exe.1c193d6b478.0.raw.unpack, -.cs	.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
Source: 0.2.powershell.exe.1c1933383d8.1.raw.unpack, -.cs	.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
Source: 2.2.RegAsm.exe.55f0000.3.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 2.2.RegAsm.exe.55f0000.3.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 2.2.RegAsm.exe.55f0000.3.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 2.2.RegAsm.exe.55f0000.3.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 2.2.RegAsm.exe.55f0000.3.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, AssemblyLoader.cs	.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])

Yara detected Costura Assembly Loader

Source: Yara match	File source: 2.2.RegAsm.exe.56c0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.408b788.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4166334815.00000000056C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4161705360.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4156977457.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7752, type: MEMORYSTR

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9BAA338C push ss; retf	0_2_00007FFD9BAA33AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C953B push eax; ret	2_2_053C9543
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C4541 push eax; ret	2_2_053C454E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C45F4 push eax; ret	2_2_053C45FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C7C30 push eax; ret	2_2_053C7C41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C6C28 push eax; ret	2_2_053C6C29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C3C1C push eax; ret	2_2_053C3C24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C5C1D push eax; ret	2_2_053C5C25
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C445F push eax; ret	2_2_053C4467
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C64B9 push eax; ret	2_2_053C64C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C74A5 push eax; ret	2_2_053C74AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C5C91 push eax; ret	2_2_053C5C99
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C8C83 push eax; ret	2_2_053C8C8B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C44CD push eax; ret	2_2_053C44D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C7CC2 push eax; ret	2_2_053C7CCE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C777D push eax; ret	2_2_053C7785
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C8740 push eax; ret	2_2_053C8748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C8FF9 push eax; ret	2_2_053C9005
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C563E push eax; ret	2_2_053C5646
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C8628 push eax; ret	2_2_053C8629
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C660F push eax; ret	2_2_053C6617
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C5ED4 push eax; ret	2_2_053C5EDC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C46C9 push eax; ret	2_2_053C46D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C86C6 push eax; ret	2_2_053C86CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C9123 push eax; ret	2_2_053C912B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C5101 push eax; ret	2_2_053C511F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C6949 push eax; ret	2_2_053C6956
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C41AE push eax; ret	2_2_053C41B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C51AA push eax; ret	2_2_053C51B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C819B push eax; ret	2_2_053C81A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_053C5033 push eax; ret	2_2_053C503B

Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, G9lxg8Y0ssxgIGYjpaq.cs	High entropy of concatenated method names: 'Ids3iNqSKU', 'ryv33xTCFd', 'k3S32oSQdq', 'gbJ3P2TrLq', 'YEI3fm7eXj', 'mBi36wE0hO', 'cSY3bbMXDd', 'vcaRoZkJFh', 'ndb3NJjops', 'FOU3nr66cn'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, AssemblyLoader.cs	High entropy of concatenated method names: 'CultureToString', 'ReadExistingAssembly', 'CopyTo', 'LoadStream', 'LoadStream', 'ReadStream', 'ReadFromEmbeddedResources', 'ResolveAssembly', 'Attach', 'XsxbgmMR49Wyp590qm6'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, NuZmITLFqQu1WuWA3dj.cs	High entropy of concatenated method names: 'qb3VwIGCfPu3ipdM2NH', 'zG1HHfGUhU4hy37CUQq', 'VNxQcPSYmk', 'xNZj4qhOeP2iuwDXZNu', 'RaJnHShZiWtfQBHEc7w', 'qWw9w8hvQB6QyeBw2jy', 'lHWnK7hdnSIdA2VnIaR', 'Fe1dRHh7SCIAHJxgndN', 'g6HFFhhJY4xHfOPGAiH', 'xTsCawhLE7RvWlAmNmh'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, bWfTrIL6ymh7NUPK5JX.cs	High entropy of concatenated method names: 'bUiwEm6315', 'aUaTeEG0eJbNtfxZgVA', 'UYccmWGVj0w2Ksk57ui', 'TYSWEGG1ZR10NLlC4Rq', 'tmK3JlG5YEloXmkBY7Y', 'W5We8FGDv5NGeUxNdNa', 'oIAR0SGlLCJkCo2mnux', 'oISNBdGIhrhFWjDtcBb', 'edZMBiGrAKhlZeBq6ih', 'pNYG8CGqKAOPGx0WsHh'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, iiCNlk8qWLqE3psd6U.cs	High entropy of concatenated method names: 'zEk3tSv6s', 'aZ32VxCds', 'F2afY42QS', 'Jre6hsyS1', 'pEQN0Q3Xq', 'wekngsmMb', 'v8hie6PvX', 'TIlxI2fLQwdtfbODpfh', 'vlQSUGfQL00jQr9GiV2', 'AdoOxefYqEsqN9CtqgC'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, rxidPq1fnONU28JRjC.cs	High entropy of concatenated method names: 'altIwCiW3', 'GknryDV4f', 'O31q3218A', 'IFtaT1iVZ', 'LbdE6VjHZ', 'waRAJhynG', 'jHTuOYBV5', 'pfiC1U5nQ', 'HJhvER61M1i2D2Ytl7Z', 'i9D7hW65eoDKQWgDOhw'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, HE3r3mLvex6HsnUNTTu.cs	High entropy of concatenated method names: 'vIPL799XJp', 'laVLJpFPar', 'dxVLL4Esoc', 'aLTLQmu5r7', 'UPw95EBlArtmFROYbcQ', 'pXIlLLB0BLGWtjIEG5A', 'W3R8nbBVtYASN47dic5', 'fiVVf9BgvJYo2t4S23f', 'wFVUnIBDbrrnS1Z28Jj', 'EWDIO4B1jT6mvbZKua0'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, zyVVkIvwMWMEFUVZ5tB.cs	High entropy of concatenated method names: 'qrovWmEylg', 'rYlBE7tmjqGt5jt9NbG', 'UhZxN1tyT9DXTcpa7tN', 'tcwoBytTUyqUdgqFUKK', 'yB8kx2twe14GImnP5A7', 'vVZ4ebtxbJu21gvk6Ar', 'PsuPuHtWHhvMgNgtbTV', 'fBPr5btgBCAuF5p8nE1', 'irDtbJtDAkJgfLfGUyD', 'jftFXqtlGCPvVN64JoJ'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, tc2vhGvjJ2ufG2uDuJp.cs	High entropy of concatenated method names: 'XQMv438pyq', 'ql01aFte6oR27QMXACi', 'eJxQEOthg7KTnCFfwCO', 'SOqlbrtH90EtUjmVyOF', 'CaHuwntsULlVhmDcALl', 'HGovBsI8Rb', 'egxvGDXDJ1', 'YKVvh9brK2', 'V9N9jhkuxCuntZnB9A6', 'kf6OZekCpDnSTWLmmf7'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, NmZmeuMLAX3WYGPinR.cs	High entropy of concatenated method names: 'xC2loeuvP', 'C0wa7H6wHDRu0nUh6OB', 'wOY0cC6xrA9JRxEHdII', 'QZZkGR6yBl2jd2dW3cV', 'Db20vm6TpWYHry69P6O', 'v6nMrl6WG9AM9DpL9DK', 'Y7uTOw6gRAQKOtEcsUk', 'edQMV66DELgI8EkuPPN', 'yuDGf74Vu', 'SxEhX7bxW'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, bLVETvvgJVkTpFX7uyl.cs	High entropy of concatenated method names: 'XTOvVYDnpC', 't8qqDBjqDmIMBday0LF', 'tRoxVVjIdoh0IYfnlC3', 'OG9Qa6jrHC1c0WegdKi', 'rHLMUFjadJb8EJUktkx', 'r3AxUojEXQsxUOky6pr', 'SQxOGKjA3nelm78Y9Mv', 'vmAUJfjutgcsBe4Nt7h', 'M6OMW3jC1sZtfYEFuPS', 'wtUAdBjUbNi36NlV8ig'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, EXaeS0vXgZXkZbkFMTr.cs	High entropy of concatenated method names: 'K2Av3Og5wR', 'tVhv2m4dhg', 's9mvPWl1WG', 'T6pvf1ITcG', 'mNwv6Upc5k', 'W2dvbKBCT6', 'NR4vNhphCx', 'MU4l8SkLbUdW22gwYox', 'QCLXHykQiLWLVqqGSGy', 'E9Vj4bkYlmkFk0YmoQd'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, z5gBfMZ9ngpuOGS55iY.cs	High entropy of concatenated method names: 'frjZIhSAL3', 'UjcXTYNWm0PNT8GxwdO', 'PvuesqNwEZqKy7pvsGT', 'KxbWr7NxHtAI9750Qgh', 'KwaawhNgBWkZHisZfhp', 'jLtZlTrkXi', 'pAJZ0i5DwJ', 'v1QZm3lQRM', 'v2fZyxnVfQ', 'Un8ZT36HFH'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, n7MNbKZqEop7seKZCRk.cs	High entropy of concatenated method names: 'LyaZEKcKXe', 'jDOCQyNVY7kEZ8UmAN2', 'fb6CsbN1RBNRtbe17K0', 'U6mgYsN599GyLKPj12q', 'dK9rW9NIRBqCYDwE8vy', 'zVV49pNrJjam95QxGYj', 'GTjE5WNqVFBDy7esK1s', 'quiRAWNaoyFueQivFCr', 'P05AYvNEhUavFkHCSCJ', 'ngZk14NA2FGMVjtDelq'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, oIWxokvQhGHS8muoQ3v.cs	High entropy of concatenated method names: 'UCxvRYKCK9', 'ou4vo4co8d', 'hCOvSELdqG', 'RYSv8OoDxl', 'y8XrxsnajpUBm2CYbcB', 'gPlgM4nEwrRnXoMZy5N', 'jB3qlKnAwer4Guvs7y2', 'ETAJevnubGuvmXLYKvM', 'mWlBTsnCiH8Xwq5sdKZ', 'clDVDfnUy63aCxl5iEl'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, gU63J3L38mmhwsjE0sA.cs	High entropy of concatenated method names: 'MsdLPFKOWI', 'WSpLfuSRat', 'MEnp7XGNKl16ugpyrRC', 'Y72Z3UGnDNNHoYLXY4r', 'U9PmUJGFee4j3ls7URX', 'jHeYQ0Gk6dweDad7vaL', 'NG8dvPGtN7PeLmHu5xi', 'SOiMJRGj3D45ha5qLeg', 'pyIbiSG6cAPcuioSgmU', 'o8lLKTGbK4HH9Apwtfq'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, YO9a6bLSrtJ3I5TZbEI.cs	High entropy of concatenated method names: 'tkALXqaupB', 'RYpLipaLNE', 'aRm8rIG8xmDNnI8J6KP', 'o57fbhGXXZ92yy0hyWd', 'QA89MWGimhCGvfTg7aN', 'jT2EYNGou5lkj4DVPKx', 'cXhXYPGSPiO6vucmcS3', 'g7m7rVG3iFj4vk9tMpQ', 'EtI1kgG2OxeVLIOF0oE', 'LJPgOXGP4ViBDJLigyZ'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, En84GkZzI8miidSaMxQ.cs	High entropy of concatenated method names: 'bs6vOMylqL', 'uOIvZb39t6', 'YGevvTevBG', 'F0wvd2QHYk', 'mEHv7R5pqu', 'sa6vJLvFIa', 'kZe7WUn3ADd442rQRNb', 'BrhTUfnXFtnAuIjbhQi', 'jH2CGYni4P9B3k0rVYv', 'C1QZgBn29RqWW3i0cKk'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, JhtiLKYk60xC9pcHOos.cs	High entropy of concatenated method names: 'It2Y4xSNVM', 'QUYYm4spfl', 'zJBYyLgLIV', 'XDIYTYex8n', 'rEMYwSvanT', 'atFYxgsW7W', 'eSuYWIHPhb', 'ckmYgiAOOE', 'stcYD7yeGj', 'NYGYlWeEXm'
Source: 2.2.RegAsm.exe.5520000.2.raw.unpack, T5OUAQZAoGhbJKnCyI5.cs	High entropy of concatenated method names: 'qp6ZCl43kW', 'rrnZUdV9ap', 't2WcOFnvEaqg2I1KRpG', 'PQ2xcpndn9ZSBF3TPiM', 'qGWhjhn7Mpe9jqxINSA', 'rIKwW1nJ5nRWUaHJHif', 'UoFrFonLLWUmpfNOkpo', 'rkjvUanOkND9Osv8tDL', 'fgPfWAnZoAT9h6JultH', 'm86ccbnQ6B7XmofUwuT'

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2E50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4E50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 548000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 409000	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2511	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1032	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 8060	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1775	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7604	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7664	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -119750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7804	Thread sleep count: 8060 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7804	Thread sleep count: 1775 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59438s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59313s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -57985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -57860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7756	Thread sleep time: -548000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59516s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59405s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59188s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59063s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58938s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58825s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58236s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -57891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -57766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7756	Thread sleep time: -409000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59763s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -59109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58999s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7800	Thread sleep time: -58781s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 57985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 57860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 548000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59405	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58825	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58236	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 57891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 57766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 409000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59763	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58781	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: powershell.exe, 00000000.00000002.1739713631.000001C193931000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PQeMucju
Source: powershell.exe, 00000000.00000002.1739713631.000001C193931000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: DkqeMU
Source: powershell.exe, 00000000.00000002.1744473672.000001C1A3133000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1744473672.000001C1A3376000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1739713631.000001C193562000.00000004.00000800.00020000.00000000.sdmp, ahmbf.ps1	Binary or memory string: !sg0ZVvqKZS/xEknJ2UT2o32FiRKLc0E+Spi0PQeMucju93VC2KepzPjIyu8Bt1LyO4pY9u41/z8fcNhwS76
Source: ahmbf.ps1	Binary or memory string: !dpxvMciRBr
Source: powershell.exe, 00000000.00000002.1739713631.000001C193931000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dpxvMciRBr
Source: powershell.exe, 00000000.00000002.1744473672.000001C1A3133000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1744473672.000001C1A3376000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1739713631.000001C193562000.00000004.00000800.00020000.00000000.sdmp, ahmbf.ps1	Binary or memory string: !BPKCSFDFJHrZfLx2GSNnwxjVh8QsngWnsh2UXRbv0DkqeMU6U3FEatDGCz1fVz3whbQuIMhJ+er+hl4sjjejbUyK10w4sm/sJmc2Zz8T/aPHTjtx
Source: powershell.exe, 00000000.00000002.1749975533.000001C1AB460000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.4167021848.00000000059B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_05733052 LdrInitializeThunk,

2_2_05733052

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 4A0000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 4A2000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: D66008	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	121 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	Boot or Logon Initialization Scripts	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	211 Process Injection	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	123 System Information Discovery	VNC	GUI Input Capture	13 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Antivirus Detection	Reputation
xweb.ddns.net	31.13.224.69	true	true		unknown
pastebin.com	172.67.19.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw/GF0ptUGb	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://github.com/mgravell/protobuf-net	RegAsm.exe, 00000002.00000002.4165950982.00000000055F0000.00000004.08000000.00040000.00000000.sdmp	false	high
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.1739713631.000001C193071000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-neti	RegAsm.exe, 00000002.00000002.4165950982.00000000055F0000.00000004.08000000.00040000.00000000.sdmp	false	high
https://stackoverflow.com/q/14436606/23354	RegAsm.exe, 00000002.00000002.4156977457.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.4165950982.00000000055F0000.00000004.08000000.00040000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-netJ	RegAsm.exe, 00000002.00000002.4165950982.00000000055F0000.00000004.08000000.00040000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.1739713631.000001C193071000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.4156977457.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.4156977457.00000000030F0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pastebin.com	powershell.exe, 00000000.00000002.1739713631.000001C1934BC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://pastebin.com	powershell.exe, 00000000.00000002.1739713631.000001C1932A2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/11564914/23354;	RegAsm.exe, 00000002.00000002.4165950982.00000000055F0000.00000004.08000000.00040000.00000000.sdmp	false	high
https://stackoverflow.com/q/2152978/23354	RegAsm.exe, 00000002.00000002.4165950982.00000000055F0000.00000004.08000000.00040000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
31.13.224.69	xweb.ddns.net	Bulgaria		48584	SARNICA-ASBG	true
172.67.19.24	pastebin.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559592
Start date and time:	2024-11-20 17:45:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ahmbf.ps1
Detection:	MAL
Classification:	mal96.troj.expl.evad.winPS1@4/5@5/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 167 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .ps1 Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: ahmbf.ps1

Simulations

Behavior and APIs

Time	Type	Description
11:46:55	API Interceptor	1x Sleep call for process: powershell.exe modified
11:46:56	API Interceptor	10364703x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.19.24	sys_upd.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_menu..ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm2.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_phshop..ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	VvPrGsGGWH.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	pastebin.com/raw/sA04Mwk2
	HQsitBLlOv.dll	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	xK44OOt7vD.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	pastebin.com/raw/sA04Mwk2
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pastebin.com	file.exe	Get hash	malicious	JasonRAT	Browse	104.20.3.235
	DEVIS_VALIDE.js	Get hash	malicious	XWorm	Browse	104.20.3.235
	download.exe	Get hash	malicious	Remcos, XWorm	Browse	172.67.19.24
	Setup.exe	Get hash	malicious	LummaC	Browse	104.20.4.235
	n7ZKbApaa3.dll	Get hash	malicious	LummaC, Xmrig	Browse	172.67.19.24
	SecurityHealthService.exe	Get hash	malicious	AsyncRAT, DarkTortilla, XWorm	Browse	104.20.3.235
	AYoF5MX6wK.exe	Get hash	malicious	STRRAT	Browse	104.20.3.235
	PqSIlYOaIF.exe	Get hash	malicious	LummaC, Xmrig	Browse	172.67.19.24
	ERxqzVIPur.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	ERxqzVIPur.exe	Get hash	malicious	Unknown	Browse	104.20.3.235

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SPECIAL PARTY INVITATION FROM DON & LINDA HUFFMAN.msg	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	https://app.scalenut.com/creator/991c897c-dcc2-43e6-ba55-339c0f6812c2/kj8jd9r9do	Get hash	malicious	Unknown	Browse	104.16.123.96
	LxvS6uMf0g.exe	Get hash	malicious	Acrid Stealer	Browse	104.21.68.220
	https://vendor.ziphq.com/magic-link/b47e3e5c-c77a-4377-b922-4ceee97070f7	Get hash	malicious	Unknown	Browse	172.66.43.192
	http://grastoonm3vides.com	Get hash	malicious	Unknown	Browse	104.21.57.169
	DOC_114542366.vbe	Get hash	malicious	FormBook	Browse	172.67.220.36
	NEW PURCHASE ORDER DRAWINGSSPECS 5655-2024.vbe	Get hash	malicious	FormBook	Browse	104.21.40.167
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	PO 2725724312_pdf.vbs	Get hash	malicious	Unknown	Browse	172.67.187.200
SARNICA-ASBG	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	93.123.109.168
	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	93.123.109.168
	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	93.123.109.168
	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	93.123.109.168
	mitradesignworkgoodforeveryoneforgiftedmbestthings.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	31.13.224.230
	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	93.123.109.168
	09_deb64ed.exe	Get hash	malicious	Remcos	Browse	31.13.224.230
	2024-HRDCL-0000796.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	31.13.224.230
	Order&picture sample8398398392838PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	93.123.109.168
	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader	Browse	93.123.109.167

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	seethebestthignswhichgivingbestopportunities.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	172.67.19.24
	LSMU CITATA LT 20-11-2024#U00b7pdf.vbe	Get hash	malicious	Remcos, GuLoader	Browse	172.67.19.24
	PO 2725724312_pdf.vbs	Get hash	malicious	Unknown	Browse	172.67.19.24
	file.exe	Get hash	malicious	LummaC	Browse	172.67.19.24
	prepper-wu.ps1	Get hash	malicious	Unknown	Browse	172.67.19.24
	SnapshotPc.ps1	Get hash	malicious	Unknown	Browse	172.67.19.24
	Isabella County Emergency Management-protected.pdf	Get hash	malicious	HTMLPhisher	Browse	172.67.19.24
	cYDCUkIGVB.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	cYDCUkIGVB.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	KRcLFIz5PCQunB7.exe	Get hash	malicious	Quasar	Browse	172.67.19.24

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.773832331134527
Encrypted:	false
SSDEEP:	3:Nlllulp/t:NllU
MD5:	7C703A35F8A735F31CA6D4CECBED0C8F
SHA1:	16377B0DA14AE2FE22A969A929D1BF87DBDC27AF
SHA-256:	72A0BE888E0278022A62F8516C35240D1D7F15BC4182DD8EFB860AD49347D70A
SHA-512:	FB33BC273D756C0D019EE2FBA1BC592816D7128C215BC15ED264F3FDEA6D0FB0D70A377A98F2756CA10661EA8EEF6EF27049FFE1405EEBCA0F36777FF41D8F4F
Malicious:	false
Reputation:	low
Preview:	@...e.................................(.4.......................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mt2k4kbw.o2u.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xa2kn2jv.ef2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7320610583357903
Encrypted:	false
SSDEEP:	48:JtI0F0pJLPr3C4U28Lj8ukvhkvklCywTmdCYkSmlCNSogZoOiYkSmlCNSogZoK1:D6733CxHLhkvhkvCCt0kSmJHfkSmJHh
MD5:	8BC15BCFEABEE0525B77543F256F7487
SHA1:	46163AF9024B7C4EB2C57420B14A24A076DC880F
SHA-256:	71EE2A576B50CA24A18873739639B45D0BDD5C6A91EC26195799B4D1CB02FD54
SHA-512:	AB3EF669D6B0A88E1A29CB63B3C6C083723FF854BD0E142E844C85BE7AF256C14243FB87463249F7320CAFCA69CA810444BB5BC33636C2F2B00D458E60660E6F
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....BL..k;..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....u...k;......k;......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^tY............................%..A.p.p.D.a.t.a...B.V.1.....tY...Roaming.@......CW.^tY...............................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^tY...........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWQ`..Windows.@......CW.^DWQ`..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^tY.....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FMBUXXLAKACDDLXFEV6C.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7320610583357903
Encrypted:	false
SSDEEP:	48:JtI0F0pJLPr3C4U28Lj8ukvhkvklCywTmdCYkSmlCNSogZoOiYkSmlCNSogZoK1:D6733CxHLhkvhkvCCt0kSmJHfkSmJHh
MD5:	8BC15BCFEABEE0525B77543F256F7487
SHA1:	46163AF9024B7C4EB2C57420B14A24A076DC880F
SHA-256:	71EE2A576B50CA24A18873739639B45D0BDD5C6A91EC26195799B4D1CB02FD54
SHA-512:	AB3EF669D6B0A88E1A29CB63B3C6C083723FF854BD0E142E844C85BE7AF256C14243FB87463249F7320CAFCA69CA810444BB5BC33636C2F2B00D458E60660E6F
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....BL..k;..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....u...k;......k;......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^tY............................%..A.p.p.D.a.t.a...B.V.1.....tY...Roaming.@......CW.^tY...............................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^tY...........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWQ`..Windows.@......CW.^DWQ`..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^tY.....Q...........

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with very long lines (29340)
Entropy (8bit):	4.151689189289376
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	ahmbf.ps1
File size:	1'916'592 bytes
MD5:	41aaa0283372e0a4c4e9231f766f68f3
SHA1:	65b5d719a4e8802b3ad44e02b7531a796e657050
SHA256:	6c8d9120fb409fe443c79fcda2a76303dd3dfd93b2608f5d8274b7e20f88569a
SHA512:	8e4a929bc90b8db5cc5616dc16801f246020e7d9bf4885d812b44eba09c4f4c074a63594292bff84e8f84a2044cb0239dfcf6def657f8a44e6435ec29aa10e7f
SSDEEP:	12288:dAM/QP1u8r/9xCVccogaoJXyIgU3KgL+HZAma2y4QQxRl7mt2+de8uN4xzk4r4wq:UAi48IY2xZ2bUY+gjgsLhArkZJFrcBt4
TLSH:	9E9538242BAA101A71F3EE4B5AE47CAE895EB723E6C6247B1059034B4713D40FF917F9
File Content Preview:	....$.X.o.h.s.K. .=. .'.R.e.g.A.s.m...e.x.e.'...$.G.T.w.R.E. .=. .'.N.h.q.I.M.C.:.\.U.s.e.r.s.\.f.a.n.n.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.L.o.w.\.D.a.f.t. .S.y.t.e.m.\.P.r.o.g.r.a.m. .R.u.l.e.s. .N.V.I.D.E.O.\.P.r.o.g.r.a.m. .R.u.l.e.s. .N.V.I.D.E.O.\.P.r.o.g

File Icon


Icon Hash:	3270d6baae77db44

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 17:46:54.359286070 CET	49730	443	192.168.2.4	172.67.19.24
Nov 20, 2024 17:46:54.359345913 CET	443	49730	172.67.19.24	192.168.2.4
Nov 20, 2024 17:46:54.359416962 CET	49730	443	192.168.2.4	172.67.19.24
Nov 20, 2024 17:46:54.369009018 CET	49730	443	192.168.2.4	172.67.19.24
Nov 20, 2024 17:46:54.369040012 CET	443	49730	172.67.19.24	192.168.2.4
Nov 20, 2024 17:46:55.695111036 CET	443	49730	172.67.19.24	192.168.2.4
Nov 20, 2024 17:46:55.695203066 CET	49730	443	192.168.2.4	172.67.19.24
Nov 20, 2024 17:46:55.697505951 CET	49730	443	192.168.2.4	172.67.19.24
Nov 20, 2024 17:46:55.697521925 CET	443	49730	172.67.19.24	192.168.2.4
Nov 20, 2024 17:46:55.697768927 CET	443	49730	172.67.19.24	192.168.2.4
Nov 20, 2024 17:46:55.709253073 CET	49730	443	192.168.2.4	172.67.19.24
Nov 20, 2024 17:46:55.755323887 CET	443	49730	172.67.19.24	192.168.2.4
Nov 20, 2024 17:46:56.164190054 CET	443	49730	172.67.19.24	192.168.2.4
Nov 20, 2024 17:46:56.164290905 CET	443	49730	172.67.19.24	192.168.2.4
Nov 20, 2024 17:46:56.164382935 CET	49730	443	192.168.2.4	172.67.19.24
Nov 20, 2024 17:46:56.172030926 CET	49730	443	192.168.2.4	172.67.19.24
Nov 20, 2024 17:46:57.765830994 CET	49731	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:46:57.887485981 CET	7211	49731	31.13.224.69	192.168.2.4
Nov 20, 2024 17:46:57.889647007 CET	49731	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:46:57.899128914 CET	49731	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:46:58.021431923 CET	7211	49731	31.13.224.69	192.168.2.4
Nov 20, 2024 17:46:58.021502972 CET	49731	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:46:58.141649961 CET	7211	49731	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:00.114799976 CET	7211	49731	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:00.115001917 CET	49731	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:00.115778923 CET	49731	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:00.222997904 CET	49732	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:00.268898964 CET	7211	49731	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:00.342807055 CET	7211	49732	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:00.342890024 CET	49732	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:00.343832016 CET	49732	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:00.463646889 CET	7211	49732	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:00.463893890 CET	49732	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:00.583941936 CET	7211	49732	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:02.582768917 CET	7211	49732	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:02.582892895 CET	49732	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:02.583050013 CET	49732	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:02.690423965 CET	49733	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:02.709664106 CET	7211	49732	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:02.873810053 CET	7211	49733	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:02.873970032 CET	49733	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:02.874852896 CET	49733	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:02.994923115 CET	7211	49733	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:02.995049953 CET	49733	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:03.114960909 CET	7211	49733	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:05.058248043 CET	7211	49733	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:05.058350086 CET	49733	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:05.058533907 CET	49733	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:05.174827099 CET	49734	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:05.182287931 CET	7211	49733	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:05.295300007 CET	7211	49734	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:05.295416117 CET	49734	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:05.296081066 CET	49734	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:05.416507959 CET	7211	49734	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:05.416568995 CET	49734	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:05.542105913 CET	7211	49734	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:07.686113119 CET	7211	49734	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:07.686240911 CET	49734	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:07.686419010 CET	49734	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:07.799925089 CET	49736	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:07.807110071 CET	7211	49734	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:07.919876099 CET	7211	49736	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:07.919946909 CET	49736	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:07.920707941 CET	49736	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:08.044058084 CET	7211	49736	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:08.044130087 CET	49736	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:08.165452003 CET	7211	49736	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:10.243308067 CET	7211	49736	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:10.243503094 CET	49736	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:10.243561029 CET	49736	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:10.347024918 CET	49739	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:10.363244057 CET	7211	49736	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:10.466757059 CET	7211	49739	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:10.466865063 CET	49739	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:10.467653990 CET	49739	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:10.588217020 CET	7211	49739	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:10.588300943 CET	49739	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:10.708987951 CET	7211	49739	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:12.729084969 CET	7211	49739	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:12.729151011 CET	49739	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:12.729350090 CET	49739	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:12.846674919 CET	49742	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:12.854332924 CET	7211	49739	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:12.972589016 CET	7211	49742	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:12.972692013 CET	49742	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:12.973540068 CET	49742	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:13.098000050 CET	7211	49742	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:13.099837065 CET	49742	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:13.219461918 CET	7211	49742	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:15.167870998 CET	7211	49742	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:15.168066025 CET	49742	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:15.168257952 CET	49742	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:15.284214973 CET	49744	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:15.294612885 CET	7211	49742	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:15.403806925 CET	7211	49744	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:15.403898001 CET	49744	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:15.404798031 CET	49744	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:15.524401903 CET	7211	49744	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:15.524499893 CET	49744	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:15.644339085 CET	7211	49744	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:17.595118046 CET	7211	49744	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:17.595204115 CET	49744	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:17.595364094 CET	49744	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:17.706648111 CET	49745	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:17.714903116 CET	7211	49744	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:17.826364040 CET	7211	49745	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:17.826513052 CET	49745	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:17.827326059 CET	49745	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:17.947060108 CET	7211	49745	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:17.947133064 CET	49745	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:18.066843987 CET	7211	49745	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:20.134558916 CET	7211	49745	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:20.134783983 CET	49745	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:20.134891033 CET	49745	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:20.237472057 CET	49746	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:20.254416943 CET	7211	49745	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:20.358197927 CET	7211	49746	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:20.358386040 CET	49746	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:20.359627962 CET	49746	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:20.485379934 CET	7211	49746	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:20.485449076 CET	49746	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:20.605230093 CET	7211	49746	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:22.620373964 CET	7211	49746	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:22.620465994 CET	49746	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:22.620625019 CET	49746	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:22.737307072 CET	49747	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:22.745507956 CET	7211	49746	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:22.859185934 CET	7211	49747	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:22.859338045 CET	49747	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:22.860101938 CET	49747	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:22.986645937 CET	7211	49747	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:22.986728907 CET	49747	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:23.106317997 CET	7211	49747	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:25.105577946 CET	7211	49747	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:25.105815887 CET	49747	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:25.105815887 CET	49747	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:25.221648932 CET	49748	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:25.225945950 CET	7211	49747	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:25.341403961 CET	7211	49748	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:25.341497898 CET	49748	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:25.342175007 CET	49748	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:25.463200092 CET	7211	49748	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:25.463284016 CET	49748	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:25.583230972 CET	7211	49748	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:27.615231037 CET	7211	49748	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:27.615483999 CET	49748	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:27.615606070 CET	49748	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:27.721770048 CET	49749	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:27.770664930 CET	7211	49748	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:27.890898943 CET	7211	49749	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:27.891125917 CET	49749	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:27.892368078 CET	49749	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:28.014851093 CET	7211	49749	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:28.014965057 CET	49749	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:28.135912895 CET	7211	49749	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:30.196027994 CET	7211	49749	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:30.196147919 CET	49749	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:30.196352005 CET	49749	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:30.300045013 CET	49750	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:30.315968990 CET	7211	49749	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:30.419934988 CET	7211	49750	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:30.420226097 CET	49750	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:30.421180964 CET	49750	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:30.544230938 CET	7211	49750	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:30.544425011 CET	49750	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:30.668135881 CET	7211	49750	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:32.600254059 CET	7211	49750	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:32.600347996 CET	49750	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:32.600514889 CET	49750	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:32.706629038 CET	49751	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:32.720089912 CET	7211	49750	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:32.826606989 CET	7211	49751	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:32.826769114 CET	49751	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:32.828763962 CET	49751	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:32.951091051 CET	7211	49751	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:32.951188087 CET	49751	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:33.070724964 CET	7211	49751	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:35.054631948 CET	7211	49751	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:35.054807901 CET	49751	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:35.055013895 CET	49751	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:35.159085989 CET	49752	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:35.174504995 CET	7211	49751	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:35.279494047 CET	7211	49752	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:35.279648066 CET	49752	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:35.280445099 CET	49752	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:35.400966883 CET	7211	49752	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:35.401099920 CET	49752	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:35.522640944 CET	7211	49752	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:37.514566898 CET	7211	49752	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:37.514640093 CET	49752	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:37.514784098 CET	49752	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:37.627906084 CET	49753	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:37.634262085 CET	7211	49752	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:37.747586012 CET	7211	49753	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:37.747716904 CET	49753	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:37.748327017 CET	49753	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:37.869570017 CET	7211	49753	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:37.869643927 CET	49753	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:37.991075993 CET	7211	49753	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:39.947376966 CET	7211	49753	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:39.947789907 CET	49753	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:39.947978020 CET	49753	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:40.065356970 CET	49754	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:40.070440054 CET	7211	49753	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:40.185432911 CET	7211	49754	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:40.185513973 CET	49754	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:40.186162949 CET	49754	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:40.305685043 CET	7211	49754	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:40.305762053 CET	49754	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:40.429447889 CET	7211	49754	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:42.387407064 CET	7211	49754	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:42.387605906 CET	49754	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:42.387758970 CET	49754	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:42.503082991 CET	49755	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:42.507426023 CET	7211	49754	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:42.623173952 CET	7211	49755	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:42.623280048 CET	49755	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:42.623960972 CET	49755	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:42.744113922 CET	7211	49755	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:42.744204998 CET	49755	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:42.872199059 CET	7211	49755	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:44.831257105 CET	7211	49755	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:44.831372023 CET	49755	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:44.831651926 CET	49755	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:44.940650940 CET	49756	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:44.956460953 CET	7211	49755	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:45.067028999 CET	7211	49756	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:45.067266941 CET	49756	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:45.068224907 CET	49756	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:45.187876940 CET	7211	49756	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:45.188000917 CET	49756	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:45.307667971 CET	7211	49756	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:47.262063980 CET	7211	49756	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:47.262209892 CET	49756	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:47.262419939 CET	49756	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:47.377998114 CET	49757	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:47.384277105 CET	7211	49756	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:47.497987986 CET	7211	49757	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:47.498194933 CET	49757	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:47.498830080 CET	49757	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:47.618530035 CET	7211	49757	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:47.618622065 CET	49757	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:47.740993023 CET	7211	49757	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:49.691761017 CET	7211	49757	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:49.692058086 CET	49757	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:49.692312956 CET	49757	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:49.799916029 CET	49760	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:49.812098980 CET	7211	49757	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:49.922894001 CET	7211	49760	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:49.923118114 CET	49760	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:49.924045086 CET	49760	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:50.046225071 CET	7211	49760	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:50.046289921 CET	49760	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:50.166979074 CET	7211	49760	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:52.206331015 CET	7211	49760	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:52.206422091 CET	49760	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:52.206623077 CET	49760	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:52.319766998 CET	49766	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:52.326605082 CET	7211	49760	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:52.443708897 CET	7211	49766	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:52.443839073 CET	49766	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:52.444482088 CET	49766	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:52.570648909 CET	7211	49766	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:52.570744038 CET	49766	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:52.693092108 CET	7211	49766	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:54.658438921 CET	7211	49766	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:54.658596039 CET	49766	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:54.658740997 CET	49766	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:54.768596888 CET	49772	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:54.778295040 CET	7211	49766	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:54.889333010 CET	7211	49772	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:54.889548063 CET	49772	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:54.890543938 CET	49772	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:55.010801077 CET	7211	49772	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:55.010879993 CET	49772	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:55.131362915 CET	7211	49772	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:57.220650911 CET	7211	49772	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:57.220741987 CET	49772	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:57.220901966 CET	49772	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:57.340398073 CET	7211	49772	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:57.564416885 CET	49780	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:57.685694933 CET	7211	49780	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:57.685770988 CET	49780	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:57.686714888 CET	49780	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:57.807754993 CET	7211	49780	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:57.807857037 CET	49780	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:57.927350998 CET	7211	49780	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:59.940310001 CET	7211	49780	31.13.224.69	192.168.2.4
Nov 20, 2024 17:47:59.940768003 CET	49780	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:47:59.940937042 CET	49780	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:00.049962044 CET	49788	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:00.060669899 CET	7211	49780	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:00.171052933 CET	7211	49788	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:00.171327114 CET	49788	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:00.172161102 CET	49788	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:00.292788029 CET	7211	49788	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:00.292959929 CET	49788	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:00.419291973 CET	7211	49788	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:02.431241989 CET	7211	49788	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:02.431653023 CET	49788	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:02.435528040 CET	49788	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:02.549910069 CET	49795	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:02.560239077 CET	7211	49788	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:02.675086021 CET	7211	49795	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:02.675172091 CET	49795	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:02.676110983 CET	49795	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:02.795557022 CET	7211	49795	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:02.795618057 CET	49795	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:02.915209055 CET	7211	49795	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:04.868117094 CET	7211	49795	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:04.868206024 CET	49795	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:04.868479967 CET	49795	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:04.971987963 CET	49801	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:04.994693995 CET	7211	49795	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:05.098772049 CET	7211	49801	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:05.098844051 CET	49801	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:05.099711895 CET	49801	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:05.221750975 CET	7211	49801	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:05.221828938 CET	49801	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:05.341404915 CET	7211	49801	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:07.296133041 CET	7211	49801	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:07.296205997 CET	49801	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:07.296405077 CET	49801	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:07.409133911 CET	49807	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:07.416198969 CET	7211	49801	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:07.529103994 CET	7211	49807	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:07.529323101 CET	49807	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:07.530118942 CET	49807	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:07.655862093 CET	7211	49807	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:07.656090021 CET	49807	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:07.778131962 CET	7211	49807	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:09.784591913 CET	7211	49807	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:09.784683943 CET	49807	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:09.784828901 CET	49807	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:09.893677950 CET	49813	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:09.904407978 CET	7211	49807	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:10.013297081 CET	7211	49813	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:10.013478041 CET	49813	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:10.014208078 CET	49813	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:10.134002924 CET	7211	49813	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:10.134085894 CET	49813	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:10.253613949 CET	7211	49813	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:12.178145885 CET	7211	49813	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:12.178353071 CET	49813	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:12.178561926 CET	49813	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:12.284759045 CET	49819	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:12.298274040 CET	7211	49813	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:12.404726028 CET	7211	49819	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:12.404824972 CET	49819	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:12.405827999 CET	49819	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:12.525352001 CET	7211	49819	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:12.525413036 CET	49819	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:12.644891977 CET	7211	49819	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:14.644778013 CET	7211	49819	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:14.644979954 CET	49819	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:14.645109892 CET	49819	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:14.753273964 CET	49825	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:14.767919064 CET	7211	49819	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:14.873507977 CET	7211	49825	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:14.874095917 CET	49825	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:14.874960899 CET	49825	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:14.996614933 CET	7211	49825	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:14.998543978 CET	49825	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:15.123975039 CET	7211	49825	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:17.079366922 CET	7211	49825	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:17.079443932 CET	49825	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:17.079579115 CET	49825	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:17.190712929 CET	49831	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:17.199106932 CET	7211	49825	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:17.318690062 CET	7211	49831	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:17.318792105 CET	49831	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:17.319456100 CET	49831	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:17.443115950 CET	7211	49831	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:17.443331003 CET	49831	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:17.563129902 CET	7211	49831	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:19.553756952 CET	7211	49831	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:19.553884029 CET	49831	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:19.553982019 CET	49831	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:19.659329891 CET	49837	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:19.673683882 CET	7211	49831	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:19.781790972 CET	7211	49837	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:19.781964064 CET	49837	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:19.782598019 CET	49837	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:19.904927015 CET	7211	49837	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:19.905015945 CET	49837	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:20.027540922 CET	7211	49837	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:21.999982119 CET	7211	49837	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:22.000082016 CET	49837	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:22.000216961 CET	49837	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:22.112816095 CET	49843	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:22.121161938 CET	7211	49837	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:22.238106012 CET	7211	49843	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:22.238336086 CET	49843	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:22.239131927 CET	49843	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:22.360583067 CET	7211	49843	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:22.360861063 CET	49843	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:22.480711937 CET	7211	49843	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:24.485263109 CET	7211	49843	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:24.485356092 CET	49843	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:24.485462904 CET	49843	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:24.596698999 CET	49849	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:24.605035067 CET	7211	49843	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:24.716402054 CET	7211	49849	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:24.716583967 CET	49849	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:24.717112064 CET	49849	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:24.836705923 CET	7211	49849	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:24.838541985 CET	49849	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:24.958425999 CET	7211	49849	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:26.954256058 CET	7211	49849	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:26.954320908 CET	49849	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:26.954456091 CET	49849	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:27.066730022 CET	49855	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:27.079111099 CET	7211	49849	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:27.186877012 CET	7211	49855	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:27.186980963 CET	49855	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:27.187624931 CET	49855	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:27.307053089 CET	7211	49855	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:27.307128906 CET	49855	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:27.426911116 CET	7211	49855	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:29.455360889 CET	7211	49855	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:29.455430984 CET	49855	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:29.455630064 CET	49855	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:29.565490961 CET	49863	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:29.575447083 CET	7211	49855	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:29.687144041 CET	7211	49863	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:29.687258005 CET	49863	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:29.687963963 CET	49863	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:29.807770967 CET	7211	49863	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:29.810094118 CET	49863	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:29.929761887 CET	7211	49863	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:31.890121937 CET	7211	49863	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:31.890348911 CET	49863	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:31.890350103 CET	49863	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:32.003104925 CET	49869	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:32.011656046 CET	7211	49863	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:32.127170086 CET	7211	49869	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:32.127254963 CET	49869	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:32.128281116 CET	49869	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:32.250561953 CET	7211	49869	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:32.250616074 CET	49869	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:32.372265100 CET	7211	49869	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:34.438945055 CET	7211	49869	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:34.439007998 CET	49869	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:34.439172029 CET	49869	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:34.550113916 CET	49877	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:34.558650970 CET	7211	49869	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:34.671984911 CET	7211	49877	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:34.672076941 CET	49877	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:34.672766924 CET	49877	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:34.792530060 CET	7211	49877	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:34.792586088 CET	49877	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:34.915930986 CET	7211	49877	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:36.888001919 CET	7211	49877	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:36.888065100 CET	49877	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:36.888274908 CET	49877	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:37.003067970 CET	49884	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:37.009197950 CET	7211	49877	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:37.129023075 CET	7211	49884	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:37.130837917 CET	49884	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:37.130837917 CET	49884	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:37.257276058 CET	7211	49884	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:37.257880926 CET	49884	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:37.379658937 CET	7211	49884	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:39.393266916 CET	7211	49884	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:39.393385887 CET	49884	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:39.393523932 CET	49884	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:39.503163099 CET	49890	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:39.513024092 CET	7211	49884	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:39.623593092 CET	7211	49890	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:39.624490976 CET	49890	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:39.624491930 CET	49890	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:39.744254112 CET	7211	49890	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:39.745939970 CET	49890	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:39.865513086 CET	7211	49890	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:41.801585913 CET	7211	49890	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:41.801692963 CET	49890	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:41.802227974 CET	49890	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:41.909208059 CET	49896	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:41.922455072 CET	7211	49890	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:42.029187918 CET	7211	49896	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:42.029324055 CET	49896	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:42.030004025 CET	49896	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:42.149723053 CET	7211	49896	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:42.149837971 CET	49896	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:42.273034096 CET	7211	49896	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:44.132602930 CET	49896	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:44.258923054 CET	7211	49896	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:44.258982897 CET	49896	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:44.302184105 CET	7211	49896	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:44.302236080 CET	49896	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:44.302362919 CET	49896	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:44.384881020 CET	7211	49896	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:44.409341097 CET	49902	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:44.426753044 CET	7211	49896	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:44.426851988 CET	7211	49896	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:44.529156923 CET	7211	49902	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:44.529274940 CET	49902	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:44.529954910 CET	49902	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:44.656203032 CET	7211	49902	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:44.656330109 CET	49902	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:44.788938046 CET	7211	49902	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:46.753602028 CET	7211	49902	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:46.753678083 CET	49902	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:46.753777981 CET	49902	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:46.862452030 CET	49908	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:46.878362894 CET	7211	49902	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:46.985152006 CET	7211	49908	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:46.985291004 CET	49908	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:46.986040115 CET	49908	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:47.109174967 CET	7211	49908	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:47.115833998 CET	49908	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:47.235641003 CET	7211	49908	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:49.222062111 CET	7211	49908	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:49.224036932 CET	49908	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:49.224036932 CET	49908	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:49.331290007 CET	49914	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:49.343868017 CET	7211	49908	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:49.452342033 CET	7211	49914	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:49.453406096 CET	49914	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:49.453406096 CET	49914	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:49.573337078 CET	7211	49914	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:49.573430061 CET	49914	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:49.694364071 CET	7211	49914	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:51.687676907 CET	7211	49914	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:51.688268900 CET	49914	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:51.688500881 CET	49914	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:51.800033092 CET	49920	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:51.808088064 CET	7211	49914	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:51.919873953 CET	7211	49920	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:51.920315981 CET	49920	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:51.922038078 CET	49920	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:52.041835070 CET	7211	49920	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:52.041929960 CET	49920	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:52.162214994 CET	7211	49920	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:54.147094011 CET	7211	49920	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:54.147156000 CET	49920	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:54.147330999 CET	49920	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:54.254190922 CET	49926	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:54.269046068 CET	7211	49920	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:54.375164032 CET	7211	49926	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:54.375236034 CET	49926	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:54.376229048 CET	49926	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:54.502568007 CET	7211	49926	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:54.502618074 CET	49926	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:54.622179031 CET	7211	49926	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:56.615143061 CET	7211	49926	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:56.615191936 CET	49926	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:56.615371943 CET	49926	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:56.721999884 CET	49932	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:56.736773014 CET	7211	49926	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:56.841830015 CET	7211	49932	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:56.841912985 CET	49932	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:56.842828035 CET	49932	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:56.962404966 CET	7211	49932	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:56.962496042 CET	49932	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:57.083543062 CET	7211	49932	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:59.119811058 CET	7211	49932	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:59.124056101 CET	49932	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:59.124056101 CET	49932	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:59.246941090 CET	7211	49932	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:59.478002071 CET	49939	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:59.597831011 CET	7211	49939	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:59.598782063 CET	49939	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:59.598782063 CET	49939	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:59.724119902 CET	7211	49939	31.13.224.69	192.168.2.4
Nov 20, 2024 17:48:59.727952957 CET	49939	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:48:59.847556114 CET	7211	49939	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:01.972050905 CET	7211	49939	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:01.972214937 CET	49939	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:01.972333908 CET	49939	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:02.081120014 CET	49948	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:02.098969936 CET	7211	49939	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:02.207247019 CET	7211	49948	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:02.207351923 CET	49948	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:02.208594084 CET	49948	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:02.334213018 CET	7211	49948	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:02.334270000 CET	49948	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:02.453881025 CET	7211	49948	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:04.444169998 CET	7211	49948	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:04.444236994 CET	49948	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:04.444427967 CET	49948	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:04.550132036 CET	49954	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:04.564050913 CET	7211	49948	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:04.669872999 CET	7211	49954	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:04.669950008 CET	49954	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:04.670980930 CET	49954	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:04.790622950 CET	7211	49954	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:04.790755987 CET	49954	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:04.911521912 CET	7211	49954	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:06.889849901 CET	7211	49954	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:06.890002966 CET	49954	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:06.890263081 CET	49954	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:07.003793001 CET	49961	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:07.011342049 CET	7211	49954	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:07.123589039 CET	7211	49961	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:07.123869896 CET	49961	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:07.127367973 CET	49961	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:07.247279882 CET	7211	49961	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:07.251214981 CET	49961	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:07.374126911 CET	7211	49961	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:09.390450954 CET	7211	49961	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:09.394110918 CET	49961	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:09.394229889 CET	49961	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:09.502923012 CET	49967	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:09.514167070 CET	7211	49961	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:09.627927065 CET	7211	49967	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:09.628289938 CET	49967	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:09.628959894 CET	49967	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:09.753222942 CET	7211	49967	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:09.755939960 CET	49967	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:09.880244970 CET	7211	49967	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:11.899280071 CET	7211	49967	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:11.899374962 CET	49967	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:11.899619102 CET	49967	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:12.003166914 CET	49973	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:12.080955029 CET	7211	49967	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:12.123159885 CET	7211	49973	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:12.126106024 CET	49973	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:12.134953022 CET	49973	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:12.254862070 CET	7211	49973	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:12.254972935 CET	49973	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:12.374504089 CET	7211	49973	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:14.321116924 CET	7211	49973	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:14.321276903 CET	49973	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:14.321415901 CET	49973	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:14.425223112 CET	49979	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:14.441019058 CET	7211	49973	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:14.544852972 CET	7211	49979	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:14.544934988 CET	49979	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:14.545871973 CET	49979	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:14.667517900 CET	7211	49979	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:14.667586088 CET	49979	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:14.787771940 CET	7211	49979	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:16.796108007 CET	7211	49979	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:16.796161890 CET	49979	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:16.796325922 CET	49979	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:16.909559965 CET	49985	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:16.915752888 CET	7211	49979	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:17.029201984 CET	7211	49985	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:17.029272079 CET	49985	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:17.030122995 CET	49985	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:17.153381109 CET	7211	49985	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:17.155972004 CET	49985	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:17.276462078 CET	7211	49985	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:19.263637066 CET	7211	49985	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:19.267579079 CET	49985	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:19.267579079 CET	49985	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:19.381925106 CET	49991	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:19.394001961 CET	7211	49985	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:19.502840042 CET	7211	49991	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:19.507069111 CET	49991	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:19.507069111 CET	49991	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:19.626715899 CET	7211	49991	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:19.630158901 CET	49991	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:19.749744892 CET	7211	49991	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:21.754915953 CET	7211	49991	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:21.755006075 CET	49991	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:21.755141973 CET	49991	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:21.862611055 CET	49997	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:21.874871016 CET	7211	49991	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:21.989128113 CET	7211	49997	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:21.989231110 CET	49997	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:21.989913940 CET	49997	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:22.114059925 CET	7211	49997	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:22.114144087 CET	49997	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:22.233717918 CET	7211	49997	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:24.244860888 CET	7211	49997	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:24.244942904 CET	49997	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:24.245297909 CET	49997	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:24.362763882 CET	50003	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:24.371893883 CET	7211	49997	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:24.484667063 CET	7211	50003	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:24.484822035 CET	50003	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:24.485667944 CET	50003	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:24.610146999 CET	7211	50003	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:24.610229015 CET	50003	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:24.731334925 CET	7211	50003	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:26.703792095 CET	7211	50003	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:26.703880072 CET	50003	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:26.704004049 CET	50003	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:26.815809965 CET	50010	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:26.823932886 CET	7211	50003	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:26.936351061 CET	7211	50010	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:26.936438084 CET	50010	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:26.937098980 CET	50010	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:27.058159113 CET	7211	50010	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:27.058231115 CET	50010	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:27.177932024 CET	7211	50010	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:28.268815041 CET	50010	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:28.435287952 CET	7211	50010	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:28.435347080 CET	50010	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:28.554903030 CET	7211	50010	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:29.204456091 CET	7211	50010	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:29.207971096 CET	50010	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:29.210233927 CET	50010	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:29.315567017 CET	50017	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:29.329755068 CET	7211	50010	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:29.438755989 CET	7211	50017	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:29.438941956 CET	50017	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:29.442990065 CET	50017	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:29.568340063 CET	7211	50017	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:29.573925018 CET	50017	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:29.698857069 CET	7211	50017	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:31.765125990 CET	7211	50017	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:31.765523911 CET	50017	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:31.766084909 CET	50017	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:31.878396988 CET	50024	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:31.886933088 CET	7211	50017	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:31.997941017 CET	7211	50024	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:31.998431921 CET	50024	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:31.999089003 CET	50024	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:32.119105101 CET	7211	50024	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:32.119266987 CET	50024	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:32.238810062 CET	7211	50024	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:34.206731081 CET	7211	50024	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:34.206801891 CET	50024	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:34.206974983 CET	50024	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:34.315710068 CET	50030	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:34.326550007 CET	7211	50024	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:34.437660933 CET	7211	50030	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:34.437742949 CET	50030	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:34.438673973 CET	50030	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:34.686682940 CET	7211	50030	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:34.686743021 CET	50030	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:34.806960106 CET	7211	50030	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:35.893624067 CET	50030	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:36.013258934 CET	7211	50030	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:36.013420105 CET	50030	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:36.135772943 CET	7211	50030	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:36.725796938 CET	7211	50030	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:36.725882053 CET	50030	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:36.726054907 CET	50030	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:36.831562996 CET	50037	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:36.845715046 CET	7211	50030	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:36.951518059 CET	7211	50037	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:36.951606035 CET	50037	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:36.952435970 CET	50037	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:37.072171926 CET	7211	50037	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:37.072237968 CET	50037	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:37.192162991 CET	7211	50037	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:38.099937916 CET	50037	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:38.226377964 CET	7211	50037	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:38.226469994 CET	50037	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:38.346609116 CET	7211	50037	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:39.154884100 CET	7211	50037	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:39.154947042 CET	50037	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:39.155162096 CET	50037	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:39.268776894 CET	50043	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:39.275271893 CET	7211	50037	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:39.388936043 CET	7211	50043	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:39.389080048 CET	50043	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:39.391937971 CET	50043	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:39.512070894 CET	7211	50043	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:39.512367010 CET	50043	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:39.632399082 CET	7211	50043	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:39.690624952 CET	50043	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:39.810173035 CET	7211	50043	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:39.810314894 CET	50043	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:39.929833889 CET	7211	50043	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:40.742652893 CET	50043	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:40.869127989 CET	7211	50043	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:40.871954918 CET	50043	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:40.998281002 CET	7211	50043	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:41.622445107 CET	7211	50043	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:41.622540951 CET	50043	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:41.622725964 CET	50043	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:41.737541914 CET	50049	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:41.746773958 CET	7211	50043	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:41.857398033 CET	7211	50049	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:41.857527971 CET	50049	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:41.858310938 CET	50049	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:41.977798939 CET	7211	50049	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:41.977889061 CET	50049	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:42.097628117 CET	7211	50049	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:44.057653904 CET	7211	50049	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:44.057811022 CET	50049	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:44.057897091 CET	50049	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:44.175110102 CET	50056	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:44.177521944 CET	7211	50049	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:44.294707060 CET	7211	50056	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:44.294810057 CET	50056	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:44.295723915 CET	50056	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:44.415397882 CET	7211	50056	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:44.415493011 CET	50056	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:44.542018890 CET	7211	50056	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:46.506531954 CET	7211	50056	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:46.506598949 CET	50056	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:46.506710052 CET	50056	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:46.612700939 CET	50062	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:46.637032032 CET	7211	50056	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:46.732439995 CET	7211	50062	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:46.732573986 CET	50062	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:46.733386993 CET	50062	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:46.853641033 CET	7211	50062	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:46.853734016 CET	50062	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:46.973388910 CET	7211	50062	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:48.906570911 CET	7211	50062	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:48.906637907 CET	50062	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:48.906804085 CET	50062	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:49.019021034 CET	50068	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:49.033209085 CET	7211	50062	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:49.140392065 CET	7211	50068	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:49.140487909 CET	50068	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:49.141380072 CET	50068	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:49.260996103 CET	7211	50068	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:49.261075974 CET	50068	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:49.381084919 CET	7211	50068	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:50.972002029 CET	50068	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:51.098712921 CET	7211	50068	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:51.098768950 CET	50068	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:51.287431955 CET	7211	50068	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:51.287566900 CET	50068	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:51.287786007 CET	50068	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:51.379501104 CET	7211	50068	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:51.393812895 CET	50073	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:51.409107924 CET	7211	50068	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:51.409145117 CET	7211	50068	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:51.409162998 CET	50068	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:51.515789986 CET	7211	50073	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:51.515896082 CET	50073	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:51.518950939 CET	50073	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:51.531347036 CET	7211	50068	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:51.644087076 CET	7211	50073	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:51.644304991 CET	50073	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:51.770766020 CET	7211	50073	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:53.783526897 CET	7211	50073	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:53.783601046 CET	50073	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:53.783802032 CET	50073	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:53.895953894 CET	50074	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:53.906564951 CET	7211	50073	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:54.017807961 CET	7211	50074	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:54.017959118 CET	50074	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:54.018779993 CET	50074	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:54.138298035 CET	7211	50074	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:54.140034914 CET	50074	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:54.263017893 CET	7211	50074	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:56.234666109 CET	7211	50074	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:56.234785080 CET	50074	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:56.234951973 CET	50074	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:56.347100973 CET	50075	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:56.360405922 CET	7211	50074	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:56.471297026 CET	7211	50075	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:56.471374035 CET	50075	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:56.472326994 CET	50075	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:56.592175961 CET	7211	50075	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:56.592227936 CET	50075	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:56.712075949 CET	7211	50075	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:58.743031979 CET	7211	50075	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:58.743097067 CET	50075	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:58.743263960 CET	50075	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:58.847038031 CET	50076	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:58.863801003 CET	7211	50075	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:58.966938019 CET	7211	50076	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:58.967021942 CET	50076	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:58.967905998 CET	50076	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:59.087822914 CET	7211	50076	31.13.224.69	192.168.2.4
Nov 20, 2024 17:49:59.087903023 CET	50076	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:49:59.207787991 CET	7211	50076	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:01.195981979 CET	7211	50076	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:01.196037054 CET	50076	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:01.196199894 CET	50076	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:01.315701008 CET	7211	50076	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:01.546166897 CET	50077	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:01.670051098 CET	7211	50077	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:01.672720909 CET	50077	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:01.672722101 CET	50077	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:01.793657064 CET	7211	50077	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:01.799985886 CET	50077	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:01.920006990 CET	7211	50077	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:03.836894989 CET	7211	50077	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:03.837167025 CET	50077	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:03.837260962 CET	50077	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:03.940886974 CET	50078	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:03.956779957 CET	7211	50077	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:04.061117887 CET	7211	50078	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:04.061322927 CET	50078	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:04.062982082 CET	50078	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:04.183665037 CET	7211	50078	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:04.183744907 CET	50078	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:04.303416014 CET	7211	50078	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:06.065907001 CET	50078	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:06.185482979 CET	7211	50078	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:06.185554981 CET	50078	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:06.254376888 CET	7211	50078	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:06.254442930 CET	50078	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:06.254760981 CET	50078	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:06.305079937 CET	7211	50078	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:06.363109112 CET	50079	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:06.373969078 CET	7211	50078	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:06.374191046 CET	7211	50078	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:06.483388901 CET	7211	50079	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:06.483493090 CET	50079	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:06.484677076 CET	50079	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:06.604409933 CET	7211	50079	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:06.604487896 CET	50079	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:06.723990917 CET	7211	50079	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:08.644102097 CET	50079	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:08.683125019 CET	7211	50079	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:08.683199883 CET	50079	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:08.683372974 CET	50079	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:08.763758898 CET	7211	50079	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:08.800589085 CET	50080	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:08.802804947 CET	7211	50079	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:08.802989006 CET	7211	50079	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:08.920289993 CET	7211	50080	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:08.920388937 CET	50080	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:08.921334028 CET	50080	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:09.044277906 CET	7211	50080	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:09.044348001 CET	50080	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:09.170836926 CET	7211	50080	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:11.226541042 CET	7211	50080	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:11.226612091 CET	50080	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:11.226780891 CET	50080	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:11.331473112 CET	50081	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:11.347809076 CET	7211	50080	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:11.455358028 CET	7211	50081	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:11.455610037 CET	50081	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:11.456320047 CET	50081	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:11.575994015 CET	7211	50081	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:11.576164007 CET	50081	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:11.697254896 CET	7211	50081	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:13.637628078 CET	7211	50081	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:13.638312101 CET	50081	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:13.639507055 CET	50081	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:13.753285885 CET	50082	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:13.762955904 CET	7211	50081	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:13.872915030 CET	7211	50082	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:13.876127005 CET	50082	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:13.879985094 CET	50082	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:13.999594927 CET	7211	50082	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:14.000067949 CET	50082	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:14.119705915 CET	7211	50082	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:14.425283909 CET	50082	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:14.548161030 CET	7211	50082	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:14.548226118 CET	50082	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:14.667768002 CET	7211	50082	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:16.056325912 CET	7211	50082	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:16.056624889 CET	50082	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:16.056772947 CET	50082	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:16.159655094 CET	50083	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:16.176460028 CET	7211	50082	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:16.280306101 CET	7211	50083	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:16.280405045 CET	50083	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:16.281172991 CET	50083	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:16.401653051 CET	7211	50083	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:16.401732922 CET	50083	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:16.521671057 CET	7211	50083	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:18.457196951 CET	7211	50083	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:18.457247972 CET	50083	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:18.457473993 CET	50083	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:18.566188097 CET	50084	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:18.577018023 CET	7211	50083	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:18.685719013 CET	7211	50084	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:18.688095093 CET	50084	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:18.733078003 CET	50084	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:18.853461027 CET	7211	50084	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:18.855916977 CET	50084	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:18.975684881 CET	7211	50084	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:20.176011086 CET	50084	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:20.297400951 CET	7211	50084	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:20.297554970 CET	50084	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:20.420800924 CET	7211	50084	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:20.896141052 CET	7211	50084	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:20.896215916 CET	50084	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:20.896353960 CET	50084	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:21.005110025 CET	50085	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:21.016210079 CET	7211	50084	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:21.124567032 CET	7211	50085	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:21.124650002 CET	50085	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:21.127177000 CET	50085	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:21.248040915 CET	7211	50085	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:21.248200893 CET	50085	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:21.373105049 CET	7211	50085	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:23.395687103 CET	7211	50085	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:23.396106005 CET	50085	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:23.399104118 CET	50085	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:23.503521919 CET	50086	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:23.521181107 CET	7211	50085	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:23.624113083 CET	7211	50086	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:23.627837896 CET	50086	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:23.627837896 CET	50086	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:23.901349068 CET	7211	50086	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:23.901443005 CET	50086	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:24.020983934 CET	7211	50086	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:26.002188921 CET	7211	50086	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:26.002445936 CET	50086	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:26.002604961 CET	50086	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:26.115034103 CET	50087	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:26.123131037 CET	7211	50086	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:26.234730959 CET	7211	50087	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:26.234855890 CET	50087	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:26.236862898 CET	50087	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:26.357897043 CET	7211	50087	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:26.357940912 CET	50087	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:26.478094101 CET	7211	50087	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:28.428227901 CET	7211	50087	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:28.428297997 CET	50087	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:28.428478003 CET	50087	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:28.534957886 CET	50088	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:28.551069975 CET	7211	50087	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:28.657540083 CET	7211	50088	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:28.657627106 CET	50088	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:28.658730030 CET	50088	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:28.795923948 CET	7211	50088	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:28.796060085 CET	50088	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:28.927007914 CET	7211	50088	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:36.325943947 CET	7211	50088	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:36.326011896 CET	50088	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:36.326246023 CET	50088	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:36.445725918 CET	7211	50088	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:36.451894045 CET	50089	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:36.572611094 CET	7211	50089	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:36.572700024 CET	50089	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:36.574038029 CET	50089	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:36.693932056 CET	7211	50089	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:36.694001913 CET	50089	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:36.820744991 CET	7211	50089	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:37.710273027 CET	50089	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:37.834368944 CET	7211	50089	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:37.834628105 CET	50089	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:37.958698034 CET	7211	50089	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:49.834983110 CET	50089	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:49.954668999 CET	7211	50089	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:49.954777956 CET	50089	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:50.074791908 CET	7211	50089	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:50.316096067 CET	50089	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:50.435786963 CET	7211	50089	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:50.435856104 CET	50089	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:50.555831909 CET	7211	50089	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:57.050410032 CET	50089	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:57.174268007 CET	7211	50089	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:57.174345970 CET	50089	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:57.293932915 CET	7211	50089	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:57.380146027 CET	50089	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:57.500003099 CET	7211	50089	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:57.500153065 CET	50089	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:57.620336056 CET	7211	50089	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:57.788052082 CET	50089	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:57.919481993 CET	7211	50089	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:57.919714928 CET	50089	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:58.040777922 CET	7211	50089	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:58.474746943 CET	7211	50089	31.13.224.69	192.168.2.4
Nov 20, 2024 17:50:58.474819899 CET	50089	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:59.558080912 CET	50089	7211	192.168.2.4	31.13.224.69
Nov 20, 2024 17:50:59.677892923 CET	7211	50089	31.13.224.69	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 17:46:54.213382006 CET	65092	53	192.168.2.4	1.1.1.1
Nov 20, 2024 17:46:54.352525949 CET	53	65092	1.1.1.1	192.168.2.4
Nov 20, 2024 17:46:57.533078909 CET	63609	53	192.168.2.4	1.1.1.1
Nov 20, 2024 17:46:57.763339996 CET	53	63609	1.1.1.1	192.168.2.4
Nov 20, 2024 17:47:57.330899000 CET	54797	53	192.168.2.4	1.1.1.1
Nov 20, 2024 17:47:57.563700914 CET	53	54797	1.1.1.1	192.168.2.4
Nov 20, 2024 17:48:59.237184048 CET	61764	53	192.168.2.4	1.1.1.1
Nov 20, 2024 17:48:59.477354050 CET	53	61764	1.1.1.1	192.168.2.4
Nov 20, 2024 17:50:01.299803972 CET	57787	53	192.168.2.4	1.1.1.1
Nov 20, 2024 17:50:01.541945934 CET	53	57787	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 17:46:54.213382006 CET	192.168.2.4	1.1.1.1	0xee02	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 17:46:57.533078909 CET	192.168.2.4	1.1.1.1	0x5859	Standard query (0)	xweb.ddns.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 17:47:57.330899000 CET	192.168.2.4	1.1.1.1	0xbd3c	Standard query (0)	xweb.ddns.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 17:48:59.237184048 CET	192.168.2.4	1.1.1.1	0xa22	Standard query (0)	xweb.ddns.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 17:50:01.299803972 CET	192.168.2.4	1.1.1.1	0x6217	Standard query (0)	xweb.ddns.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 17:46:54.352525949 CET	1.1.1.1	192.168.2.4	0xee02	No error (0)	pastebin.com	172.67.19.24	A (IP address)	IN (0x0001)	false
Nov 20, 2024 17:46:54.352525949 CET	1.1.1.1	192.168.2.4	0xee02	No error (0)	pastebin.com	104.20.4.235	A (IP address)	IN (0x0001)	false
Nov 20, 2024 17:46:54.352525949 CET	1.1.1.1	192.168.2.4	0xee02	No error (0)	pastebin.com	104.20.3.235	A (IP address)	IN (0x0001)	false
Nov 20, 2024 17:46:57.763339996 CET	1.1.1.1	192.168.2.4	0x5859	No error (0)	xweb.ddns.net	31.13.224.69	A (IP address)	IN (0x0001)	false
Nov 20, 2024 17:47:57.563700914 CET	1.1.1.1	192.168.2.4	0xbd3c	No error (0)	xweb.ddns.net	31.13.224.69	A (IP address)	IN (0x0001)	false
Nov 20, 2024 17:48:59.477354050 CET	1.1.1.1	192.168.2.4	0xa22	No error (0)	xweb.ddns.net	31.13.224.69	A (IP address)	IN (0x0001)	false
Nov 20, 2024 17:50:01.541945934 CET	1.1.1.1	192.168.2.4	0x6217	No error (0)	xweb.ddns.net	31.13.224.69	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pastebin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.19.24	443	7548	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 16:46:55 UTC	74	OUT	GET /raw/GF0ptUGb HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-11-20 16:46:56 UTC	397	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 16:46:55 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 884 Last-Modified: Wed, 20 Nov 2024 16:32:11 GMT Server: cloudflare CF-RAY: 8e59eb3fdf10425b-EWR
2024-11-20 16:46:56 UTC	11	IN	Data Raw: 36 0d 0a 66 61 6c 73 65 2c 0d 0a Data Ascii: 6false,
2024-11-20 16:46:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	11:46:50
Start date:	20/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ahmbf.ps1"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:46:50
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	11:46:55
Start date:	20/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xb40000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000002.00000002.4166334815.00000000056C0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000002.00000002.4161705360.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000002.00000002.4156977457.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	14
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9BAA57FF Relevance: 1.8, APIs: 1, Instructions: 338
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 00007FFD9BAA5A7D

Memory Dump Source

Source File: 00000000.00000002.1750507890.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d31a7b7c099419a867a7a736b5a76bfd3b0e6df628c25a3851189c37abfad4fd
Instruction ID: 67eb906f16024701a05ea8b4dd44ff9169079c311d9570c6d4bb415cedbca26a
Opcode Fuzzy Hash: d31a7b7c099419a867a7a736b5a76bfd3b0e6df628c25a3851189c37abfad4fd
Instruction Fuzzy Hash: FBC1E37190CB8C8FDB66DB68CC556E8BBF0EF5A310F0542DBD049D7292CA34A945CB81

Function 00007FFD9BAA5EA4 Relevance: 1.7, APIs: 1, Instructions: 161
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32 ref: 00007FFD9BAA5F80

Memory Dump Source

Source File: 00000000.00000002.1750507890.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 41b11491e198f5be849381f5b2448a2a19e26ebeed938f3d3532207880864f86
Instruction ID: b362298c48ba6f4e9b15c2828c3ee9503037a0b2cd88195bcfbdf4e9b5cbb806
Opcode Fuzzy Hash: 41b11491e198f5be849381f5b2448a2a19e26ebeed938f3d3532207880864f86
Instruction Fuzzy Hash: 4941E63190CB488FDB18DF9CA8466F9BBE1FB95321F00426FE089C3152DB74A446CB95

Function 00007FFD9BAA5B95 Relevance: 1.6, APIs: 1, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32 ref: 00007FFD9BAA5C64

Memory Dump Source

Source File: 00000000.00000002.1750507890.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 338468917e117d6bcf0da03fb0cdf96d591feca6da0bb6f297677f309b4b9b3a
Instruction ID: ccd11500a20a483c415f72e70b7040b661409ad960f12c122f7a97185279ddc8
Opcode Fuzzy Hash: 338468917e117d6bcf0da03fb0cdf96d591feca6da0bb6f297677f309b4b9b3a
Instruction Fuzzy Hash: 5841173190D7888FDB16DFA88C457E97FE1EF56321F08429BD048C71A7DB64A805CB92

Function 00007FFD9BAA5FC5 Relevance: 1.6, APIs: 1, Instructions: 101
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 00007FFD9BAA605C

Memory Dump Source

Source File: 00000000.00000002.1750507890.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c7c68e77bdc5181d01638f827cd22044fc46c19fd570b87a9ee0719da821a615
Instruction ID: cf0ca4b3d935b558af1dc47fb12c7e536c4de9501c87e3ddb99d7aafeb38aac4
Opcode Fuzzy Hash: c7c68e77bdc5181d01638f827cd22044fc46c19fd570b87a9ee0719da821a615
Instruction Fuzzy Hash: E221E33190DA4C8FDB59DF98C845BE9BBE0EF56321F00426ED049C36A2DB70A455CB81

Function 00007FFD9BB714F9 Relevance: .4, Instructions: 418
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1750754364.00007FFD9BB70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bb70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d959e8aa3395c008c2d82dec4a260b1c95ededdd52678e1e98ff6e9d5696f7d
Instruction ID: f33268db87ad197aa2620184621a244365ca280584721cdeacc989b401dc3c84
Opcode Fuzzy Hash: 4d959e8aa3395c008c2d82dec4a260b1c95ededdd52678e1e98ff6e9d5696f7d
Instruction Fuzzy Hash: BFC16B72B0FB890FE7AAD66C58A51B47BD1FF96214B0902FFD08DC74E3D914A9068391

Function 00007FFD9BB70554 Relevance: .2, Instructions: 176
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1750754364.00007FFD9BB70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bb70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8de1784b52551a3185d82551043ed651a9817892bded60f31992715f4d0770
Instruction ID: f0bb5f7ea89284f0153587be82a16970af663b8ea25a7a4f31ade1aa9f5bafa2
Opcode Fuzzy Hash: 6d8de1784b52551a3185d82551043ed651a9817892bded60f31992715f4d0770
Instruction Fuzzy Hash: 67412822B0EE4E0BEBB9D66C58B157576C2FF94B28B8902BFD44DC35D6EE05ED014281

Function 00007FFD9BB70ACE Relevance: .1, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1750754364.00007FFD9BB70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bb70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0605e33911e3fec0d80e562dd485eecf9d0e2123482d5ffe1e6a99a35589d40f
Instruction ID: a9e7dbbbcb8705e4c910be855aca24b40c8e97ac29c9d80c341edee5aa3fc61e
Opcode Fuzzy Hash: 0605e33911e3fec0d80e562dd485eecf9d0e2123482d5ffe1e6a99a35589d40f
Instruction Fuzzy Hash: 5C411B22B1EA5E0FEFB596A818B16B973C2EF54B18B49017BD44DC36D6DD08AE0543C1

Function 00007FFD9BB705A9 Relevance: .1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1750754364.00007FFD9BB70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bb70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3066c90229f6479673c03edff0acc6d0b379b5428111cfec8879564125bb7f
Instruction ID: 7b15c3e58fb4da0d2ffff64b887bc9e5e52f63ca14dc66ed6cce893d48e1b2f1
Opcode Fuzzy Hash: ea3066c90229f6479673c03edff0acc6d0b379b5428111cfec8879564125bb7f
Instruction Fuzzy Hash: 1611F602F1FA1E07FBB8965C68F517465C1EF94A28BCA02BBE40DC35D6ED09ED111281

Analysis Process: RegAsm.exePID: 7752, Parent PID: 7548COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	8.8%
Total number of Nodes:	57
Total number of Limit Nodes:	3

Executed Functions

Function 05720C00 Relevance: 16.2, Strings: 12, Instructions: 1162COMMON

Download Yara Rule

Strings

$^q, xrefs: 05720E93
$^q, xrefs: 0572154A
$^q, xrefs: 05721067
4, xrefs: 057215E5
$^q, xrefs: 0572153A
,bq, xrefs: 057216CA
$^q, xrefs: 05721107
$^q, xrefs: 05720EA3
$^q, xrefs: 05721117
$^q, xrefs: 05721057
$^q, xrefs: 057214F1
$^q, xrefs: 057214E1

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: ,bq$4$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-312445597
Opcode ID: 2544728d48a162c3a61393112c8b204a69c12f4a4a9905c6b43b390c99eff87a
Instruction ID: b692f5b38efcb063ed9ae0b3ea887b80cfd8b68bfeda18f27953728836fe768e
Opcode Fuzzy Hash: 2544728d48a162c3a61393112c8b204a69c12f4a4a9905c6b43b390c99eff87a
Instruction Fuzzy Hash: DEB21A34A002288FDB14DFA9C894BADB7B6FF48700F548599E506AB3A5CB70ED85DF50

Function 05720F37 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 057215E5
$^q, xrefs: 0572153A
,bq, xrefs: 057216CA
$^q, xrefs: 05721107
$^q, xrefs: 05721057
$^q, xrefs: 057214E1

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: ,bq$4$$^q$$^q$$^q$$^q
API String ID: 0-2546334966
Opcode ID: d06926a9ba67d88c4959333de66356cb6e9700f3a784a66420d0472ef9b671ec
Instruction ID: f49d5fed1daa987248480f70a732be5dec1a28f49d7692465f5c619518b6c417
Opcode Fuzzy Hash: d06926a9ba67d88c4959333de66356cb6e9700f3a784a66420d0472ef9b671ec
Instruction Fuzzy Hash: 62220D34A00224CFDB24DF55C994BADB7B6FF48300F5481A9E50AAB3A5DB71AD81DF50

Function 02C84D0F Relevance: 2.7, Strings: 2, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 02C84DB7
4'^q, xrefs: 02C84DE2

Memory Dump Source

Source File: 00000002.00000002.4156447034.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c80000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: c716567fdfd4e7cba48791c94acc655811f802c56936ba69e7e50cb42f105241
Instruction ID: 858a733b86138867e45eab398b0997767283f389ef8d7f77805b0069ae7fa705
Opcode Fuzzy Hash: c716567fdfd4e7cba48791c94acc655811f802c56936ba69e7e50cb42f105241
Instruction Fuzzy Hash: 2F5108B0A156158FD70CEFBBE95569ABBE3BBC8300B14C629C0059B3ACEB3459458B50

Function 02C84D18 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02C84DB7
4'^q, xrefs: 02C84DE2

Memory Dump Source

Source File: 00000002.00000002.4156447034.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c80000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: ac18d04d8857f9714dc78e14ec1872568eb065cf34cf108c7c962eba14e2ef7d
Instruction ID: 4eec8509523bf742eecd491dfb459332627907b26c36ad229410fda5d6e27e6b
Opcode Fuzzy Hash: ac18d04d8857f9714dc78e14ec1872568eb065cf34cf108c7c962eba14e2ef7d
Instruction Fuzzy Hash: C051F9B4A156158FD70CEFBBE95569ABBE3BBC8300B14C629C0049B3ACEB3459458F50

Function 05730F18 Relevance: 2.0, Strings: 1, Instructions: 740COMMON

Download Yara Rule

Strings

(bq, xrefs: 05731208

Memory Dump Source

Source File: 00000002.00000002.4166766868.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5730000_RegAsm.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 79b51dabc67339e74848494461526722727ceb34bac7ddb8814b76a9f8ec627d
Instruction ID: 06a0d1a7368dea3298bb01a2fc22b662fa0efc74f427f78340d2a2d9b8282c3e
Opcode Fuzzy Hash: 79b51dabc67339e74848494461526722727ceb34bac7ddb8814b76a9f8ec627d
Instruction Fuzzy Hash: EA527774B006158FDB14CF69C495A6EFBF2FF88310F648929E55ADB782DB30A901CB90

Function 05733052 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166766868.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5730000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab00ee024ae25509218e85be2f384939867954a74b9374292a3210008cc6643d
Instruction ID: 463fe0eb4780d38614f051cc0a61e20234cf333128b2bc9207d994329c181c32
Opcode Fuzzy Hash: ab00ee024ae25509218e85be2f384939867954a74b9374292a3210008cc6643d
Instruction Fuzzy Hash: A2417F74604106CFDB24DF65E54BBB977B3BB44365F1449A5F0029B2A7DB719880EB00

Function 05735650 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\VSm, xrefs: 0573589B

Memory Dump Source

Source File: 00000002.00000002.4166766868.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5730000_RegAsm.jbxd

Similarity

API ID:
String ID: \VSm
API String ID: 0-1782263414
Opcode ID: f7053fbe36f0d08fd37ba7fab48347db8ef664e03e1f957b464e16c3b355b0d2
Instruction ID: 6fa62b472fceb066a7b321deb48aa740a5d81baffcb7aba4939dccef29e93c9e
Opcode Fuzzy Hash: f7053fbe36f0d08fd37ba7fab48347db8ef664e03e1f957b464e16c3b355b0d2
Instruction Fuzzy Hash: 38914C70E00209DFDF14CFA9C9867EDBBF2BF88324F148129E415AB295EB749845DB81

Function 053C1043 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4164762152.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc8ca7bef943166b623a90d08036bc1f5e79c01bcfcc4d2063d1795713f3e26
Instruction ID: 1f66da490a67e60143f1b2eb71096509b0510e479e8a23bdc0cd0eaed2538519
Opcode Fuzzy Hash: 1cc8ca7bef943166b623a90d08036bc1f5e79c01bcfcc4d2063d1795713f3e26
Instruction Fuzzy Hash: 6BF12A34A14214CFCB25DF28C994AA9BBB6FF88310F5585D9E50AAB365DB30ED81CF40

Function 057381B0 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166766868.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5730000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323a3c7aa4aff37fa4f3d51a1062dee663b65d4e942695d7d11717a22e288f33
Instruction ID: d20e22123e9913e2913f705b74a6eba4be9b62f3e61d3c562af7fb24fe3307ce
Opcode Fuzzy Hash: 323a3c7aa4aff37fa4f3d51a1062dee663b65d4e942695d7d11717a22e288f33
Instruction Fuzzy Hash: 40C15B30A05604CFC748DB69E59ABAE77F3FB88325F158164F0069B796DB309885DF42

Function 0573B903 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166766868.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5730000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f3f967665f189160bbb0d55f1cda725bdde207800b5d61e9a9dc16878ea148c
Instruction ID: d7b0ff9fa436d44abab11c9c61f519af07bc871e21678a4ad60999618e4f1215
Opcode Fuzzy Hash: 5f3f967665f189160bbb0d55f1cda725bdde207800b5d61e9a9dc16878ea148c
Instruction Fuzzy Hash: F6C16D30A08108CFD714CF55E48ABA9BBF3FB88325F148165E50A9B7A6DB74AD81DF44

Function 05736268 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166766868.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5730000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce9af7e84c93b21aaeace55aa6fd77c705416e388f8b61ca04dcae758de55644
Instruction ID: b58d3e8fd221d0474811d373a23b29d105753193f730065e63612db03e04fc71
Opcode Fuzzy Hash: ce9af7e84c93b21aaeace55aa6fd77c705416e388f8b61ca04dcae758de55644
Instruction Fuzzy Hash: 74B170B0E00219AFDF10CFA9D8867EDBBF2BF48724F148129E815E7255EB749845DB81

Function 0573BC7F Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166766868.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5730000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0731b1ca0341ea56af358bf2da1a64af3b24b19786c60ba953f5b9495912b8aa
Instruction ID: 3842fc916eac50693ce0b3e1b3d8e60176c692de1d127329776a90f0cffe6697
Opcode Fuzzy Hash: 0731b1ca0341ea56af358bf2da1a64af3b24b19786c60ba953f5b9495912b8aa
Instruction Fuzzy Hash: 1EB16C30A08104CFD714CF55E48ABA9BBF3FB88325F248165E50A9B7A6DB74AD81DF44

Function 05737650 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166766868.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5730000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99b1b12b26cba514e88503b8884f4883343e7d18d0f4f8086d910fb41830b655
Instruction ID: 0d3ab9db92eebd14c159653eb9a4419c17f01f651d7743eaef6bd67b3b5b37e1
Opcode Fuzzy Hash: 99b1b12b26cba514e88503b8884f4883343e7d18d0f4f8086d910fb41830b655
Instruction Fuzzy Hash: F2918F70A04214CFDB5CDF2AE54BBA977E3FB84325F148175E0069B296EB349A81EB44

Function 056493F8 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db913a8e2d264269512f43d4c0853c7d8b63f62a11166cb02f77f4d841bffb65
Instruction ID: 6864baaaa412774ed0c1ca584486587dac8eeece858e2a5501b6ef1c0e122607
Opcode Fuzzy Hash: db913a8e2d264269512f43d4c0853c7d8b63f62a11166cb02f77f4d841bffb65
Instruction Fuzzy Hash: A8919F34A44255CFEB18DF66E449BABBBF3FB89304F148265D406A7689D7349882CF50

Function 056493E8 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53ea0a5e222476d05b495428879b7f43eee7421a6c5f7729737a42520b1f9186
Instruction ID: 33ac90867721cb76161eed7e672ae566bcb462723462146b36be2247b3338926
Opcode Fuzzy Hash: 53ea0a5e222476d05b495428879b7f43eee7421a6c5f7729737a42520b1f9186
Instruction Fuzzy Hash: C391AF34A44259CFEB18DF66E449BAFBBF3BB89304F148265D406A7685DB349882CF50

Function 05649510 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca1a5884b3be92bcce896e0aadb3d276fb35852c194beef35a00c41ec807d0a0
Instruction ID: ad1d505dafd7dbb0f35d5af63c5f29069607fd213399891181803faa525a8e4e
Opcode Fuzzy Hash: ca1a5884b3be92bcce896e0aadb3d276fb35852c194beef35a00c41ec807d0a0
Instruction Fuzzy Hash: AC819F34A84259CFEB18DF66E449BAFBBF3FB89304F148265D406A7685D7349882CF50

Function 0564962D Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f955ead4931aaed3cd69664ba064d701a41511a38f9a4beded739e8eb168a50d
Instruction ID: 8367b75bfb491f0bbce4311a99cc55408eb65f45716a1c4170abf7515f4ad4de
Opcode Fuzzy Hash: f955ead4931aaed3cd69664ba064d701a41511a38f9a4beded739e8eb168a50d
Instruction Fuzzy Hash: 30819F34A84259CFEB18DF66E449BAFBBF3FB89304F148265D406A7685D7349882CF50

Function 05739AF8 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166766868.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5730000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a1eaf8b730d4195ed3641eb623b220aea839cd29c2333507f498650de90968
Instruction ID: 204a8e1dbacbed1f4f1037bae21362e8d271462e9f2c55109c6a389ba0ba3a42
Opcode Fuzzy Hash: c6a1eaf8b730d4195ed3641eb623b220aea839cd29c2333507f498650de90968
Instruction Fuzzy Hash: 6F816C30A08215CFEB14CF56D486BA9BBF3FB84314F248165D6029B29BE7B49886DF40

Function 05732C36 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166766868.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5730000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75f559620a20ba1cf3286dd8734bd083cf3615d290fc60d18aaf144d97f02d94
Instruction ID: 04d411aba07bed6e017d74e7d073d82150215cdc53f8cfa08e295e504872cf26
Opcode Fuzzy Hash: 75f559620a20ba1cf3286dd8734bd083cf3615d290fc60d18aaf144d97f02d94
Instruction Fuzzy Hash: F1514A347002108FC748EB2AE09BB693BEABB8C355F154169E40BCB39ADF349841CF55

Function 0573792B Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166766868.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5730000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb267631a171302941bde8bc60d7ab2483938298c8ab169a079f3f284f7bef73
Instruction ID: 5251ad11513ed105a936e723d0fecc4e279cd5d242ad9f0fc6fa9608d5436bbd
Opcode Fuzzy Hash: eb267631a171302941bde8bc60d7ab2483938298c8ab169a079f3f284f7bef73
Instruction Fuzzy Hash: 49515EB0A18205CFE75CDF1AD54BBB977E3FB84325F148164D0029B6A7EB749A81EB00

Function 0573C010 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166766868.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5730000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac34bf34ca20ffc39185d3e73df663f75a3231428b8493762d6b2aa41035e5c4
Instruction ID: 671f93583ebd6f4839c0a979ea4b0a25084f48986f0152a589cd3e0bc67d18f5
Opcode Fuzzy Hash: ac34bf34ca20ffc39185d3e73df663f75a3231428b8493762d6b2aa41035e5c4
Instruction Fuzzy Hash: 25419E70728240CFE716CB15D94BB6677EBFF80324F1882A5D40AAB696DB309C81EE45

Function 057283F0 Relevance: 7.7, Strings: 6, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 05728474
(bq, xrefs: 057285BA
4'^q, xrefs: 057284A4
4'^q, xrefs: 0572853A
4'^q, xrefs: 057284C2
pbq, xrefs: 05728547

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: (bq$4'^q$4'^q$4'^q$4'^q$pbq
API String ID: 0-723292480
Opcode ID: 816c204301cdc515dcf31230370704fb528f661c72b291bc9f0dbb88420d3b4d
Instruction ID: d19e48cbc734cd808012f8f61b4fa00b4168441f789cfd3f61f19dd72891ef4f
Opcode Fuzzy Hash: 816c204301cdc515dcf31230370704fb528f661c72b291bc9f0dbb88420d3b4d
Instruction Fuzzy Hash: 42518031A402098FC748DF69C9507AEBBF7BFC8300F14892C85499B359DF75E94A8BA1

Function 05726FB8 Relevance: 4.2, Strings: 3, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 0572750C
Hbq, xrefs: 0572748D
Hbq, xrefs: 057274BC

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$Hbq
API String ID: 0-2297679979
Opcode ID: 268e3a205358f180a76e62ad139ad6dbdce277cc6840450fb8459e5483ec6871
Instruction ID: f7ee1ba21061a88e48988d21da57b9582cfa2d4fe813067322315ef9a6f24326
Opcode Fuzzy Hash: 268e3a205358f180a76e62ad139ad6dbdce277cc6840450fb8459e5483ec6871
Instruction Fuzzy Hash: 2B126E74A002158FCB28DFA9C994AAEBBF6FF88300F14852DE50A9B351DB35ED45CB50

Function 05728DE8 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 057290E1
4'^q, xrefs: 05729161
4'^q, xrefs: 05729002

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q
API String ID: 0-1196845430
Opcode ID: 914dfa004173b1e70b854fd693177f7ba457272b1565c4739402dbd0d8f0ce4c
Instruction ID: b08ef0e9afb43f26d24cfd2dbb25354205d7d3f95c5aecbfeedc832750dd27d4
Opcode Fuzzy Hash: 914dfa004173b1e70b854fd693177f7ba457272b1565c4739402dbd0d8f0ce4c
Instruction Fuzzy Hash: 1FF1C834B10218DFCB08DFA4D998A9DBBB2FF89300F158559E506AB3A5DB71EC42CB51

Function 0572E6E0 Relevance: 4.1, Strings: 3, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 0572E871
(bq, xrefs: 0572E845
(bq, xrefs: 0572E819

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: (bq$(bq$Hbq
API String ID: 0-2835675688
Opcode ID: 3fa4ebc0630c070fa4015de683c94e809eb5312fb8c8139508b0923de4409785
Instruction ID: 7b2c9de4954e6eb1dc258dd4508651ad9e1e344ffd8fa4e3f2cd382880c3313f
Opcode Fuzzy Hash: 3fa4ebc0630c070fa4015de683c94e809eb5312fb8c8139508b0923de4409785
Instruction Fuzzy Hash: CEE12E34B00219DFCB04EF64D4989ADBBB6FF89300F508569E906AB365DB30ED86DB51

Function 05400078 Relevance: 3.1, Strings: 2, Instructions: 597COMMON

Download Yara Rule

Strings

4'^q, xrefs: 054007D4
4'^q, xrefs: 054007E0

Memory Dump Source

Source File: 00000002.00000002.4165030237.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 5bb975a6c42b7f9f9bb5383f2b5c90daf53228971ab9340560463c84563dc7d4
Instruction ID: 68c3bcd76329992527f33bc12837460e126f0432670d3b8b9de39263895d3b96
Opcode Fuzzy Hash: 5bb975a6c42b7f9f9bb5383f2b5c90daf53228971ab9340560463c84563dc7d4
Instruction Fuzzy Hash: 7502F424B042158B9A255629185C7FF6AEBABC8741FF4647BD60FCB7C4DE70CC428792

Function 05400810 Relevance: 2.9, Strings: 2, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 05400C89
4'^q, xrefs: 05400C95

Memory Dump Source

Source File: 00000002.00000002.4165030237.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 3c00c4e6af648065a7e40673fa71c86cd11a3491818898907c9de1f6d5c978c4
Instruction ID: e9615af6991a761fa89feaa2eaf6f3340332c4d18e629a389b10f129fab19f9d
Opcode Fuzzy Hash: 3c00c4e6af648065a7e40673fa71c86cd11a3491818898907c9de1f6d5c978c4
Instruction Fuzzy Hash: 86C16078B145018B9F19AB65905D2BEBBFBBBC5312B68543AE90BCB384DF3489038745

Function 05726A70 Relevance: 2.8, Strings: 2, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 05726A84
d, xrefs: 05726CD1

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: (bq$d
API String ID: 0-3334038649
Opcode ID: 730164d8cc637953a6bddf7035c21ff0c39af518969df8d18d9b6f3b0a8acdb6
Instruction ID: 95ac5ed2ee3daf733f4f4526cdee2b12af1b6b35924da73e20aeaf0af5c9062d
Opcode Fuzzy Hash: 730164d8cc637953a6bddf7035c21ff0c39af518969df8d18d9b6f3b0a8acdb6
Instruction Fuzzy Hash: 4FD168357006268FCB14CF28C58496AB7F6FF88310B65C96AE45A9B365DB30FC42DB90

Function 0572BF18 Relevance: 2.8, Strings: 2, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 0572C1D0
4'^q, xrefs: 0572C1FE

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: a2a4ade2f4b41250a94097729dd962d38379611a52eed02bb348a9e29e6357e3
Instruction ID: df3cd4d80d1ce1f1b5248725d89b546e67f4dd0de6c76802cec1637097485285
Opcode Fuzzy Hash: a2a4ade2f4b41250a94097729dd962d38379611a52eed02bb348a9e29e6357e3
Instruction Fuzzy Hash: 9CC1A674B10228DFCB04DFA8C998AADB7B6FF89700F504559E506AB3A5DB31EC42CB51

Function 0572BF09 Relevance: 2.8, Strings: 2, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 0572C1D0
4'^q, xrefs: 0572C1FE

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: a36f7dcb09a649dc10509d72a07146a5d468e9d3cf2e4a8438e09c81a22a6161
Instruction ID: 2b08a3a6801741cf8ab6a06364781e241c6d18b8f46dd728c1cb9b72fb26b9aa
Opcode Fuzzy Hash: a36f7dcb09a649dc10509d72a07146a5d468e9d3cf2e4a8438e09c81a22a6161
Instruction Fuzzy Hash: EDC1B774B10228DFCB08DFA4C998AADB7B6FF88700F504558E506AB3A5DB31EC42CB50

Function 05724088 Relevance: 2.7, Strings: 2, Instructions: 242
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(_^q, xrefs: 05724843
Pl^q, xrefs: 05724270

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: (_^q$Pl^q
API String ID: 0-1560878243
Opcode ID: 4047753363aa342168d4fd15866a73aba1a3859deba354dae489436cc3690aeb
Instruction ID: a5960086792cd3883ca6816fa7ab076862010deda8361faa61b864f2eadc80ed
Opcode Fuzzy Hash: 4047753363aa342168d4fd15866a73aba1a3859deba354dae489436cc3690aeb
Instruction Fuzzy Hash: 14910430B505288FDB04DF69C884AAA7BF6BF89710B1540A9E506CB3B5DB71ED42CB91

Function 05722300 Relevance: 2.7, Strings: 2, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 05722495
(bq, xrefs: 05722406

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: (bq$Hbq
API String ID: 0-4081012451
Opcode ID: 448907a717e06e51c3c4e012599a2e5e7020dc9b136312121857e884a03558be
Instruction ID: b6f6ccdbae5c61c915ffc22013eaf963f23cee1c8e29935a099ab5be6ea2f4a9
Opcode Fuzzy Hash: 448907a717e06e51c3c4e012599a2e5e7020dc9b136312121857e884a03558be
Instruction Fuzzy Hash: 8C517A347002148FD759AF39C494A6EBBBBBF94341B60446DD60A8B3A1CE35ED06CB51

Function 0572A7C0 Relevance: 2.7, Strings: 2, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 0572A7D0
(bq, xrefs: 0572A828

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: (bq$,bq
API String ID: 0-1616511919
Opcode ID: f652442fca706273f312ab94b2261e7db1c647814e6dad71e4dd455b5e16e5cc
Instruction ID: aa31a5d6f41104e4fddc952df67b95d2d69fd924891425520afa8c009bce839b
Opcode Fuzzy Hash: f652442fca706273f312ab94b2261e7db1c647814e6dad71e4dd455b5e16e5cc
Instruction Fuzzy Hash: 8D41C3327000696FCF029EA99C509FFBFEEFB89211B144066FA55E7241DA35CD259BA0

Function 057283E2 Relevance: 2.6, Strings: 2, Instructions: 114COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05728474
pbq, xrefs: 05728547

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q$pbq
API String ID: 0-3872760177
Opcode ID: 83f0d8fd85a7e5b274f2bd4d5d8d6b8c3ee7326e36718188dc685614c4201cfd
Instruction ID: 5be1436e9e4d75889f97e3b216f6064cbe41459139398c00f39a5de94852429c
Opcode Fuzzy Hash: 83f0d8fd85a7e5b274f2bd4d5d8d6b8c3ee7326e36718188dc685614c4201cfd
Instruction Fuzzy Hash: 36418E31A403059FC704DB69C9907AEBBB6BFC8300F148928D5099B369DB71E94A8BA1

Function 053C0630 Relevance: 1.9, Strings: 1, Instructions: 657COMMON

Download Yara Rule

Strings

2, xrefs: 053C0C00

Memory Dump Source

Source File: 00000002.00000002.4164762152.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53c0000_RegAsm.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: c41f9485deb4fe0f2db830c886a0b4270dd839bd30af8ffd375556aa8da65870
Instruction ID: 49a404328be47d6377c5beb242f01bec7c8fcc66429543dd655d0b2966b714b7
Opcode Fuzzy Hash: c41f9485deb4fe0f2db830c886a0b4270dd839bd30af8ffd375556aa8da65870
Instruction Fuzzy Hash: 50520874A44259CFCB58DF69D984AADBBF2BF88304F1081ADD40A9B369DB309D85CF50

Function 05723900 Relevance: 1.8, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

(_^q, xrefs: 05723B90

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: (_^q
API String ID: 0-538443824
Opcode ID: 49f268547043db3c48346614db6a0c7ff47a1ce0cebd04f37cb9ba6d51378337
Instruction ID: 3731999d237f344444f8947526a7520107cda5acf84952a374a5edb36d322da3
Opcode Fuzzy Hash: 49f268547043db3c48346614db6a0c7ff47a1ce0cebd04f37cb9ba6d51378337
Instruction Fuzzy Hash: CE228C75A102249FDB04DF68D494AADBBB2FF88300F158969E906EF3A1DB75ED40CB50

Function 0572A2CC Relevance: 1.7, Strings: 1, Instructions: 402COMMON

Download Yara Rule

Strings

,bq, xrefs: 0572A039

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: ,bq
API String ID: 0-2474004448
Opcode ID: 59d3199cd7922a4fb48c41c5c22b3f1870abe44684a0696b706ce2a5a348fd1d
Instruction ID: ab0c13607cdb031f36a2458c88157ef1b8fea3fd1a2bb14f5f1e964b4f2cdce9
Opcode Fuzzy Hash: 59d3199cd7922a4fb48c41c5c22b3f1870abe44684a0696b706ce2a5a348fd1d
Instruction Fuzzy Hash: 0D021575A002288FCB64DF69C984BEDBBF2BB88300F1541D9E549AB351DB709E81CF61

Function 02C8D378 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 02C8D3EC

Memory Dump Source

Source File: 00000002.00000002.4156447034.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c80000_RegAsm.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ec268384b3003e624103cd0664455bcd346883a1c41b986a4161027b3921585d
Instruction ID: c3a8a26d93416b3ecf101d07894854d83c7d7ac21e7d2389a28d6231c51caae3
Opcode Fuzzy Hash: ec268384b3003e624103cd0664455bcd346883a1c41b986a4161027b3921585d
Instruction Fuzzy Hash: 131106B1D002499FDB10DFAAC884ADEFBF4EF88324F14842AD559A7250C774A945CFA5

Function 05644E20 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

Deq, xrefs: 05644EBB

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID: Deq
API String ID: 0-948982800
Opcode ID: 04b47eaa3d429eeb59f21ce04228674c01b3d1dc98ab8bf24a23be2b97acd923
Instruction ID: 1e12c673d7c00534d31283f107ede7b1de0ed84318d2248b806a52e9bce9a7db
Opcode Fuzzy Hash: 04b47eaa3d429eeb59f21ce04228674c01b3d1dc98ab8bf24a23be2b97acd923
Instruction Fuzzy Hash: B2A1AE346002159FC718EF6AD584A6ABBF6FF89710F118169E406EB3A5DB31EC41CF90

Function 05728DD9 Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05729002

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: cda0440b49f7d0c2f6047aa4498d52f0108cf253dc8752a95bc5113c6a42f533
Instruction ID: d33af9c0a0282920b58b72faec014eb901c6fbc7c381e233b451d219470a8f9d
Opcode Fuzzy Hash: cda0440b49f7d0c2f6047aa4498d52f0108cf253dc8752a95bc5113c6a42f533
Instruction Fuzzy Hash: E4A10C34B10228DFCB04DFA4D998A9DBBB2FF88300F558559E506AB365DB31EC46CB51

Function 0564F908 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

(bq, xrefs: 0564F97C

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 66390e9740c11267dc7ff43daee797b761a31eab4f23a36e97c99130f3b2cf72
Instruction ID: 998d580a9f414222386254f359ec2e678d36fa98f0adeed39217a51568d062c8
Opcode Fuzzy Hash: 66390e9740c11267dc7ff43daee797b761a31eab4f23a36e97c99130f3b2cf72
Instruction Fuzzy Hash: B651BE35A00216DFCB10CF69C480A6AFBB5FF85320F158669E959AB381DB30F891CBD4

Function 0564E940 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

pbq, xrefs: 0564E9F0

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID: pbq
API String ID: 0-3896149868
Opcode ID: d3e937a574420f45282aac4b186ff5aa7ade6d6ca543f208935909888030f821
Instruction ID: 90e88dabed87559b0c194b707de4481672032ea6367c0b2c8f85010653f400ba
Opcode Fuzzy Hash: d3e937a574420f45282aac4b186ff5aa7ade6d6ca543f208935909888030f821
Instruction Fuzzy Hash: BE516076600104AFCB499FA8C954D69BBF7FF8C3147168494E2098F376DA32DC22DB51

Function 0572DDAF Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0572DDFA

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: d7ea66fdd7f27a09f5f481fe2add891f6a9abd41bd3166bf6ebd161aec946e8b
Instruction ID: caeef6de14d3f68cd3859f0da231875be370b1f6e319fa00160d879742a6d9e7
Opcode Fuzzy Hash: d7ea66fdd7f27a09f5f481fe2add891f6a9abd41bd3166bf6ebd161aec946e8b
Instruction Fuzzy Hash: EA41A570B107248FCB14EB68C4ACAAEB7B7AFC9700F10441DE406AB394CF749C469B96

Function 05649C60 Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

Te^q, xrefs: 05649CCA

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 8251fcb4bd8af980914220aed7eb0c5e575af5c15232fd9c30ac6516e35ee7d2
Instruction ID: 92684472e9855b27aa7a5e2836e0585c8899b52add8e75cc9b04976e1386ca4b
Opcode Fuzzy Hash: 8251fcb4bd8af980914220aed7eb0c5e575af5c15232fd9c30ac6516e35ee7d2
Instruction Fuzzy Hash: 64517C34B44205CFEB28DB1AE44ABBB77E3BB88319F148065E4039B699DB745982CF45

Function 053C1900 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

TJcq, xrefs: 053C193A

Memory Dump Source

Source File: 00000002.00000002.4164762152.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53c0000_RegAsm.jbxd

Similarity

API ID:
String ID: TJcq
API String ID: 0-1911830065
Opcode ID: b576e9207238a59b9dcb11ab7dc06bd35ad2b0738436fe698e2e6043f543e254
Instruction ID: 49592f451ddbb13fb394887c6f72de902d07b899f6d8c36c660b41d160fb0063
Opcode Fuzzy Hash: b576e9207238a59b9dcb11ab7dc06bd35ad2b0738436fe698e2e6043f543e254
Instruction Fuzzy Hash: 8E31C3397442108FEB249B75E45CB3A7BE6BF89201F1500ADE507CB3A2CA65DC45DB91

Function 0564F1F0 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

(bq, xrefs: 0564F240

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 6dd6257d1898638b1281c80ae8e0e3c85a5215f28e30124383203fb5dbbd1872
Instruction ID: 2695b2212060047bfbde9fe7300cf8bcf30c6023287856e950f89134711e48af
Opcode Fuzzy Hash: 6dd6257d1898638b1281c80ae8e0e3c85a5215f28e30124383203fb5dbbd1872
Instruction Fuzzy Hash: 8B31253A7041515FDB159FA9D890AABBBA7FFC9320B14403AEA09CB351CE718C02CB90

Function 05727E49 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05727E91

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: bb6051c921354bc7d2bd4fd08520c14b2e9eb4fec7ca4ae5de7586634f16acb5
Instruction ID: 2b5974d918710c7ed1569212f633af5d8df2d034e8ba713b95330e0ed397b1dc
Opcode Fuzzy Hash: bb6051c921354bc7d2bd4fd08520c14b2e9eb4fec7ca4ae5de7586634f16acb5
Instruction Fuzzy Hash: B9319E36700214AFCF098F64D994E59BBB7FF88310F1544A8F60A9B365DA32EC56CB90

Function 05400012 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

4'^q, xrefs: 054007D4

Memory Dump Source

Source File: 00000002.00000002.4165030237.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 8b8f3df2c0ae63cef092bd705f60606b01ec980530df6eb57983a80a95168d48
Instruction ID: 9e4e7b2b944355924f0deb624c584b5b0bb45ff9f6da0e890141f511e12028be
Opcode Fuzzy Hash: 8b8f3df2c0ae63cef092bd705f60606b01ec980530df6eb57983a80a95168d48
Instruction Fuzzy Hash: E9219F26A0E3C14FD3174674A8297AA7F76AB83251B6E40FBD085CF5E3D5384C4AC752

Function 05722C60 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<^q, xrefs: 05722C9A

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: p<^q
API String ID: 0-1680888324
Opcode ID: 562b5341e3b6e172f9ab0550686f6a727efd523bb430e2b51d7c1b843e6d3747
Instruction ID: 03f7de0b867bc940192cb79228c6711cf4cc76bc6d4bc5aa0e85734c65a1187a
Opcode Fuzzy Hash: 562b5341e3b6e172f9ab0550686f6a727efd523bb430e2b51d7c1b843e6d3747
Instruction Fuzzy Hash: 16213A353041649FDB15CF2AC844AAA7BEABF89340F194495FD4ACB361DA35DC91EB20

Function 05722C4F Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

p<^q, xrefs: 05722C9A

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: p<^q
API String ID: 0-1680888324
Opcode ID: ff49d19a0ea06980b32acfe56e36e10c0d93fc6545a514efedacf40c1f7b7ff6
Instruction ID: 2ca8f0b2f6a0aa4455d4b30b37a99d4d65d7dfb1dc3eb55832a3ab8bd44c35b1
Opcode Fuzzy Hash: ff49d19a0ea06980b32acfe56e36e10c0d93fc6545a514efedacf40c1f7b7ff6
Instruction Fuzzy Hash: 86215B393041649FDB05CE29C884AAA3BEAFF8D210F1544A1F90ACB371DA35DC91DB20

Function 0572EED8 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

(bq, xrefs: 0572EF2C

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: a57191f621fbc024b0cdf8d9cf6bc9c11b73de7e31c2a3f07d4b3c18920b351f
Instruction ID: 837204de88e4bb2d31f4bda61fada70954d21ede460e6b54b029bab169740665
Opcode Fuzzy Hash: a57191f621fbc024b0cdf8d9cf6bc9c11b73de7e31c2a3f07d4b3c18920b351f
Instruction Fuzzy Hash: D111B236604254AFCB069F69D804C597FB6FF8932031680D6E509DB372CB32ED10DB91

Function 02C8D548 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 02C8D5AA

Memory Dump Source

Source File: 00000002.00000002.4156447034.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c80000_RegAsm.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 1e4f627bd8d754698550d4cf292f5ee6b0de13dc91c39da28e0add0dcc436fef
Instruction ID: d9a9d287b4c2e6d4254d33267d26721c005cbab90723f41727b04e527a87d996
Opcode Fuzzy Hash: 1e4f627bd8d754698550d4cf292f5ee6b0de13dc91c39da28e0add0dcc436fef
Instruction Fuzzy Hash: 27113AB59002488FDB10DFAAC4457DEFBF4EB88328F24842AD559A7250CB74A544CF94

Function 0572BC92 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

?, xrefs: 0572BC98

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: bf6916c40761cf06004ffb18057fcb43b581e50b65d3bbc9954dc39718083414
Instruction ID: 0af22ecbc417351bdf2c1133cdd7f9e62209778cd3c62fdb07074f0c54db6ee9
Opcode Fuzzy Hash: bf6916c40761cf06004ffb18057fcb43b581e50b65d3bbc9954dc39718083414
Instruction Fuzzy Hash: EDF0307A3106009FD709DB25D899F3977AAEF88721F1444A9FA46CB7A1CA71DC41CB50

Function 0572E000 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c93896a3da87cab9ab84016207fbb55e2cf855b42e13b59326fab6b90d12eda
Instruction ID: d9dafeaf8c86ebcdc149b17f6167dde8cebd612b1c118a490eaa143711a40bf1
Opcode Fuzzy Hash: 1c93896a3da87cab9ab84016207fbb55e2cf855b42e13b59326fab6b90d12eda
Instruction Fuzzy Hash: CC12FE34B102288FCB14DF64C898AADB7B6BF89300F5085A8D54AAB355DF30ED85DF51

Function 0572DFF0 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e86d6950e288513dbd01bd37193ad371eb748f2f804260ab5b1a266879dd02
Instruction ID: 54f454eba8d32bcd4a0252e13b0336cd55a47ea2a9bbb80e05e062aed0480d08
Opcode Fuzzy Hash: c0e86d6950e288513dbd01bd37193ad371eb748f2f804260ab5b1a266879dd02
Instruction Fuzzy Hash: FCB11A34B102248FDB24DF25C898BA9B7B6BF89300F5485A8E94AAB355DF30DD85DF50

Function 0572EF98 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81f30b20d878cb5ffd5c4c12f3bd7c3d70df5e755408c16d9b333326f0e9409
Instruction ID: c8c6862d6751025139e56fc438ee1ccf12f3dc0f9f919b3756d2d95a4ca74c3a
Opcode Fuzzy Hash: c81f30b20d878cb5ffd5c4c12f3bd7c3d70df5e755408c16d9b333326f0e9409
Instruction Fuzzy Hash: A4813A307102249FCB14DF69D899A6EB7B6FF89700F5480A9E5069B3A5CB34EC42DB90

Function 05724DE8 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c1da0d5fd844c387ac9764b7a81bc93152af5fc90918886ca93a4a6a3bb266
Instruction ID: 92a156dfdd2955a9bf63a8a891aecabfc1b0addacc1d9f14067508aeb9f4bf63
Opcode Fuzzy Hash: 01c1da0d5fd844c387ac9764b7a81bc93152af5fc90918886ca93a4a6a3bb266
Instruction Fuzzy Hash: 8D81D875A00528CFCB14DF68C584D9EB7F6FF88310B158569E9169B361DB31ED42CB90

Function 0572F3E0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b6b77168b1723e31a1370900de938bf6ccaf7477af40f414ef52ede6231be50
Instruction ID: dfed533d2c2f94fa16012377453c16aa40bb80cb39e18091c2a0fe9a9ca8bac7
Opcode Fuzzy Hash: 6b6b77168b1723e31a1370900de938bf6ccaf7477af40f414ef52ede6231be50
Instruction Fuzzy Hash: 51815D34B006289FCB14EF69C058AADB7B2FF89704F10856DE4029B3A1CB75DD86DB91

Function 05400CC8 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4165030237.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aebb233d5bb9ad9013277f8842b5eaf50f520ce4ef400e09df5ab3e50d996a91
Instruction ID: b57a8c2d4d45fae7d646fb1636b3e9b80f0b64f921e7c542bdf4450c48858215
Opcode Fuzzy Hash: aebb233d5bb9ad9013277f8842b5eaf50f520ce4ef400e09df5ab3e50d996a91
Instruction Fuzzy Hash: 445140213542424BDB045A99949C7ABFAEFEBD4700FA4503EA20BCB798DFF1CC454791

Function 05648D58 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb1e78a9467ce6fd3b730526ac26291f16c6a4c8ac2ff37285c5af35278a8ef
Instruction ID: 32cbc8d528152abe3e3f8ab0352fd2947b1923f4d0e20a5bde584c6290e01e7f
Opcode Fuzzy Hash: 7cb1e78a9467ce6fd3b730526ac26291f16c6a4c8ac2ff37285c5af35278a8ef
Instruction Fuzzy Hash: F3618C34A09609CFD768EB75E04C77A77A3FB94301F008528E803AB789EB749886CF51

Function 0572F3D2 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b29b5b2e8ee0b0af31c32d61f1b88eb002ac0e676c9393668a019b6637a5baf1
Instruction ID: 5998d4bf7532088cb27c452b0ae7810d429a50ef66c74176cbe1c4618cf3b730
Opcode Fuzzy Hash: b29b5b2e8ee0b0af31c32d61f1b88eb002ac0e676c9393668a019b6637a5baf1
Instruction Fuzzy Hash: 77617E34B006289FCB14EF69C458AADB7B2FF89700F10856DE402973A0DB75ED86DB91

Function 0572EF88 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21fc2fe68040bb75f962647888fe84ec3cf8a711d212f852808049c304cb5e4e
Instruction ID: dab7a998fbb0b04c1608dc48c617289bdbd792016b85a6349738b72a72773829
Opcode Fuzzy Hash: 21fc2fe68040bb75f962647888fe84ec3cf8a711d212f852808049c304cb5e4e
Instruction Fuzzy Hash: 53512B74710224DFCB04DF69C899AADB7B6FF88710F548169E9069B3A5CB30EC42DB90

Function 053CFD88 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4164762152.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddad58ff2bca15235500d653edf2b937742969f12071a0ebf8d9de3d9126293b
Instruction ID: 6b5cbedba51da1a1b498aeea70ef333f7a7661cd5cb7f704d413d80b35f3d08c
Opcode Fuzzy Hash: ddad58ff2bca15235500d653edf2b937742969f12071a0ebf8d9de3d9126293b
Instruction Fuzzy Hash: EB51CA35B002058FDB14DB68D884AAABFB6FF89310F1485AEE509DB291CB70EC41CB90

Function 057289B8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4619785094c2c4a35b0ffc3631d6d531820d4fc36213d4772b4541c8030c128
Instruction ID: 0b4ca7b2ef1e04c793481bd7eb23ed086f9ce63293b69b156c178d0078d13748
Opcode Fuzzy Hash: d4619785094c2c4a35b0ffc3631d6d531820d4fc36213d4772b4541c8030c128
Instruction Fuzzy Hash: 3A51AF34B106199FCB04EF65E498AAEBBBAFFC8711F008519F5029B364DF349946CB91

Function 05649128 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7776b5dfaead98c1c150bbac7a5de54e51cfcde0fa67404b73e5beaa1953ae3f
Instruction ID: ef78c3b05d0589af95c74c66ce9454237f75e4a07fbca2a45cd872ce3390d46b
Opcode Fuzzy Hash: 7776b5dfaead98c1c150bbac7a5de54e51cfcde0fa67404b73e5beaa1953ae3f
Instruction Fuzzy Hash: B241D9387201108FEB44AB74E45E66EBBAEBB88346F144565FA0BCB784DF344946CF46

Function 05646D60 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac1b4f665adbdf60250c4b37e53bbffb8eb5c0a37b2a54a2257384e57e7a68d
Instruction ID: 215154c01255cbe1f9cb3117415ccc47b225e882f8fb4bd4234a596b46a16c1b
Opcode Fuzzy Hash: dac1b4f665adbdf60250c4b37e53bbffb8eb5c0a37b2a54a2257384e57e7a68d
Instruction Fuzzy Hash: 27412675708A7187DB346A65E41867E76FBAB83652B048129D94BC7B84EB30CC02CFD2

Function 05649138 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d633dd37eb2515d6be599a2d1378ac24fcddd0f589d3f4213f6bd7d6d53eba
Instruction ID: db407369da4aef9891e72e9f08f29b7bfebfa82bba73903c1ae4179a0c9aaefa
Opcode Fuzzy Hash: 84d633dd37eb2515d6be599a2d1378ac24fcddd0f589d3f4213f6bd7d6d53eba
Instruction Fuzzy Hash: 6041C8387201108FEB44AB65E45E66EBBEEBB88306F544525F60BCB784DF344942CF46

Function 0572B4D8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c610814b70f05740282a51d7c7499c167617ff6296d50774938066a352df1e63
Instruction ID: 7d175946710db4cc8e56997ef48fa6e38293fbb348fd17f4790c5c31b92a3105
Opcode Fuzzy Hash: c610814b70f05740282a51d7c7499c167617ff6296d50774938066a352df1e63
Instruction Fuzzy Hash: E031C3366105149FCB05DF6AD898EA9BBB2FF48320B1680A8E5099F372C731ED55DB80

Function 0564FC78 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e26f71ac3dde9d4e4431cd384c3e40afc298a401fc135fa55d1257b2082c37
Instruction ID: ff6da4841852b417bad6a48cf35bc25cc6ed8d95dbea9a84731e175535995b81
Opcode Fuzzy Hash: 19e26f71ac3dde9d4e4431cd384c3e40afc298a401fc135fa55d1257b2082c37
Instruction Fuzzy Hash: 9F41AB31A006168FDB14CFA5C845ABEBBB6FF88344F008529E506E7360EB34E946CF91

Function 0572F290 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6931d230162c52023b95de9678c5af9049878e1bac5a6c3de7f36561cb56cb7
Instruction ID: 6c76d0a1be6db1dd0514ce416c8f989d116f06adf399198d25591d14ffa38dbf
Opcode Fuzzy Hash: b6931d230162c52023b95de9678c5af9049878e1bac5a6c3de7f36561cb56cb7
Instruction Fuzzy Hash: C8314D35A002299BDF14DF64D899AEDB7B6FF88311F148025E806B7394CB71AD01DBA0

Function 057222F0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ea4a39aa66c04045d825cbb16d4f9619e2217db648127be14cc687eaca8115b
Instruction ID: 65a815e8241daa5dd7beb56a96f5acba35e70e0a3a7174dcc8c4116da8a9e7b8
Opcode Fuzzy Hash: 6ea4a39aa66c04045d825cbb16d4f9619e2217db648127be14cc687eaca8115b
Instruction Fuzzy Hash: 90317E34700215CFD728DF25D884AAABBBAFF95301B50442DE9568B3A1DF31EC46DB50

Function 05649F20 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f44b45e8c32dfd66cd41cf07458bd601837af3a2e6367df4c6740f1db6398795
Instruction ID: 9cd9dd6503c2c0b9f93aa2a92bfec410afc2fd6330728c43467936a733fc0bfe
Opcode Fuzzy Hash: f44b45e8c32dfd66cd41cf07458bd601837af3a2e6367df4c6740f1db6398795
Instruction Fuzzy Hash: 8A216B31A193649FC721A76AD8497533BF8EB42350F4980B2E445CB782C734DC86CF92

Function 05729758 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 835ff2a89a2fc474ab61f41c0bcfda7f15b4f5770f7dbdfd9f1bbc1d04962336
Instruction ID: 3c8776ce464b58af9079c281f270adaacec81775767e1306efa357965f55668c
Opcode Fuzzy Hash: 835ff2a89a2fc474ab61f41c0bcfda7f15b4f5770f7dbdfd9f1bbc1d04962336
Instruction Fuzzy Hash: 9021D7313046148FD7249B69E884A6AB7D9EFC0325F1D847AE20EC7651DB31EC82C790

Function 05649A74 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a4e1879d77592854c3e22f42eed866b6890df09fb0e8ef092c769e92f9c310
Instruction ID: c6d422b05e0cc5b5fad78acb511d494dea3265efacd2abbcd09776a261507fd1
Opcode Fuzzy Hash: b4a4e1879d77592854c3e22f42eed866b6890df09fb0e8ef092c769e92f9c310
Instruction Fuzzy Hash: 8C315830A442099FDB08CF69D448BAABBF2BF49344F148169D402A73A1DB719D85CFA0

Function 0572D320 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c90adecb52ea1a0b5f7bcfdbff29697404f6516df94a37518fcd582fb2ef6e9
Instruction ID: 4d5cba98a9c9fd8cdf6d1e5a3ad4d3b61bce230d1ae8f95745a9555927008e52
Opcode Fuzzy Hash: 4c90adecb52ea1a0b5f7bcfdbff29697404f6516df94a37518fcd582fb2ef6e9
Instruction Fuzzy Hash: 49218874B10619CFCB00EF68D5588AEB7B5FF99700B104169E506A7364EF309947CB92

Function 0123D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4155961505.000000000123D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0123D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_123d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 605a9003bcd9923b309940048c6cf6da03fe0d6a686d84d7502bf072cdca42ab
Instruction ID: 56deeca79b6c35a598efdc96918108990945e4802f0c82a880f81973db3acff2
Opcode Fuzzy Hash: 605a9003bcd9923b309940048c6cf6da03fe0d6a686d84d7502bf072cdca42ab
Instruction Fuzzy Hash: 582145B1510209DFDB01DF88E9C0B27BF65FBC4318F60C569EA0A0B256C376D456CBA2

Function 05722160 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97bad68c26e1ec1f6118ab1fb4391c089b81d40ba936574e95a6604c70c4e490
Instruction ID: 3c5ae45be480c2a9502f945673a7ae0e6bf4eaaf0d48145dc0062fe7334b9ba6
Opcode Fuzzy Hash: 97bad68c26e1ec1f6118ab1fb4391c089b81d40ba936574e95a6604c70c4e490
Instruction Fuzzy Hash: 4021AC35E00229DFDB00CFB5C804FAEBBF5AB04340F108066D919DB282E735CA50DB92

Function 05726E88 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 088e6738870d0518aaf65b5a890f0aea6d0712ab330514f4806305cee052873a
Instruction ID: a336151a637990290ddef2ef36d14bae8c31601acef70ff2b675209e8846cc1c
Opcode Fuzzy Hash: 088e6738870d0518aaf65b5a890f0aea6d0712ab330514f4806305cee052873a
Instruction Fuzzy Hash: 9D21D575A001198FDB04DF58C589ADDB7F2FB88300F2041A5E405AB3A5DB75AD45DBA0

Function 0572D310 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5393254d3a523b0350cef27390ad8c4d56dbb7b8fa71985b3a300b0a071c594
Instruction ID: 105c3d234a2e1fd707a770ef262e66f785ac87e4fe511c110e03a2aa6fd36aef
Opcode Fuzzy Hash: e5393254d3a523b0350cef27390ad8c4d56dbb7b8fa71985b3a300b0a071c594
Instruction Fuzzy Hash: 86218474B00A19CFCB01EF68D5949AEB7F5EF99300F10456AD505EB360EB309A46CBA2

Function 057293F0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e2c7fbe3a9edd0a3dfeaf79eb544d1cc18eefe5aa776163839c774fd02b200
Instruction ID: fc5e4ca0e1d983aac9b99536439696a128a2e371c7e9533b27cb17d4b3f0b412
Opcode Fuzzy Hash: 78e2c7fbe3a9edd0a3dfeaf79eb544d1cc18eefe5aa776163839c774fd02b200
Instruction Fuzzy Hash: 60115175B00215CFCB14DF69E5848ABB7F5FF88650B1540A5EA05DB365D731EC82CBA0

Function 0123D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4155961505.000000000123D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0123D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_123d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction ID: 9e263fa5fd4be5cee65276ca873d7bd1d269dfe9f4b57bc10c2fe584086b62a3
Opcode Fuzzy Hash: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction Fuzzy Hash: 1E1106B2504244CFDB12CF44D5C4B16BF71FB84314F24C5A9D9050B257C336D45ACB91

Function 0564DB90 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0478d5fb190eb4c8b4abafbe73943327733c07fc2a30289ae50881ad246455c8
Instruction ID: 6fa0b422b60fee9cd71419e43ffa6150dde80118905d77ed7ba92552caa3515c
Opcode Fuzzy Hash: 0478d5fb190eb4c8b4abafbe73943327733c07fc2a30289ae50881ad246455c8
Instruction Fuzzy Hash: 62019271B081148FE354DA5AD848B67B3F7FBC8754F24C029E10A877A8DA709C42CF40

Function 0564F700 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389e620fb4885123ecde6fc16d50f526d715065860c54a7bd80f9f0e87de5a4a
Instruction ID: c4ff98658ce0a782fc3caf7c5d3045778fc60221aa876b6084ba631955094be8
Opcode Fuzzy Hash: 389e620fb4885123ecde6fc16d50f526d715065860c54a7bd80f9f0e87de5a4a
Instruction Fuzzy Hash: 98014436340215AFDB148E59EC85FAB7BAAFB88721F108066FA15CB391CAB1D8118B50

Function 0572A03A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91b2ad5e506bf60c4862171e27ad6ec65e49b4655d7838bb6c53117bd71e4961
Instruction ID: 67e9a12c120e9db1b58e16ddc4d8fa89bc61f36a70c874916e6468c13c706477
Opcode Fuzzy Hash: 91b2ad5e506bf60c4862171e27ad6ec65e49b4655d7838bb6c53117bd71e4961
Instruction Fuzzy Hash: B7118CB5910229CFCB24DFA4C584AE9BBB3FF49310F110288D609AB261C7719D85DF51

Function 057293E0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 255044aaa561a911dbe9d11da14285b37214ebff1c2e8e38e5fac1afbdb01f7e
Instruction ID: 060127ae5a1a8e641d611bbb225f972e57a2009ac36d1a98e533ceab153839f1
Opcode Fuzzy Hash: 255044aaa561a911dbe9d11da14285b37214ebff1c2e8e38e5fac1afbdb01f7e
Instruction Fuzzy Hash: 371180B9B01221CFCB14CF68D585AA6BBF6FF44651F1980A9EA05CB365D731DC81CB90

Function 0572FD18 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c00681b2ed6a3e62ca34a0c3bfd9809557a4d7462209b157f23560579ab43f79
Instruction ID: 1cba1cf85526959bbad8d3876dec457a46c70d7664a5764eec12d1d4c67542ad
Opcode Fuzzy Hash: c00681b2ed6a3e62ca34a0c3bfd9809557a4d7462209b157f23560579ab43f79
Instruction Fuzzy Hash: 9F01B135700724AFD3259A34C499B3A77B6EBC9320F048968E51A8B790CB75EC42EB80

Function 0572C834 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b72ea30c0ffb48e6121ef54e82f9b7856e3904912145d78cecf8cd3503cae9
Instruction ID: 567c81677117112f720937fadedb64cf239d5c81ad26e58ee5e43c42e2ef4c28
Opcode Fuzzy Hash: f0b72ea30c0ffb48e6121ef54e82f9b7856e3904912145d78cecf8cd3503cae9
Instruction Fuzzy Hash: A001D2793006119FC30A9B34D054B5ABBA2AF89711F108669E50ACB391CF36EC03CB91

Function 05644720 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f3b24dfbb93646864cef21ffc23670875eceea614c8727297d4cf69773534a1
Instruction ID: 03143efe7dfb8ded241dde6cf33de7f29ef1d34278e12d7a31852c89a0fe8108
Opcode Fuzzy Hash: 5f3b24dfbb93646864cef21ffc23670875eceea614c8727297d4cf69773534a1
Instruction Fuzzy Hash: 1A114834A00248DFDB54DFA9D45ABAE77F1BB09346F6041A9E4169B385DF309942CF01

Function 0572FD28 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a30e549e5694ff375901e97d667021ce9b3229f03fadfb9dc299001398ff59a9
Instruction ID: 6dbc74089de0a2c6e8858864720cc106814874c6478c439ef9237572b87ff96c
Opcode Fuzzy Hash: a30e549e5694ff375901e97d667021ce9b3229f03fadfb9dc299001398ff59a9
Instruction Fuzzy Hash: 7A0171303006249FD325AB24D459A3A77B7EBC9310F148668E5564B794CB75EC42EB80

Function 05726E7A Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5df8135d2680b25c0e6fd553372d52df0fcc1cbeacc31481c9001de2191f05e5
Instruction ID: 24a9662331a2b2fadadf6951dc8c37cb39f231c86ae975bf606afbc3275f39bd
Opcode Fuzzy Hash: 5df8135d2680b25c0e6fd553372d52df0fcc1cbeacc31481c9001de2191f05e5
Instruction Fuzzy Hash: D0115775A40219CFEB04DF64C989AEDB7B2FF48300F204191E405AB3A6DB32DD41DBA0

Function 0572C850 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a94391275fe4d0d69771b96ae1078796be6a6377ea24c1ff9d176e5e9ec06ff8
Instruction ID: 2388939a6afd686d2adbc5a9be92a949aa4819425563816deb11e64515319bad
Opcode Fuzzy Hash: a94391275fe4d0d69771b96ae1078796be6a6377ea24c1ff9d176e5e9ec06ff8
Instruction Fuzzy Hash: 010131393006149FC709AB25D45892ABBA6EBCC711B208569E90A8B794CF36ED03CB95

Function 053C2B91 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4164762152.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af5d69ae93022f3c659e9b324f2b58fb541934bdc975f69eabb3b0735ccf09b8
Instruction ID: 238273e3b3cc7b15883a59fbba38205a6e584eee4cdea9fca0b5c8a3191f1862
Opcode Fuzzy Hash: af5d69ae93022f3c659e9b324f2b58fb541934bdc975f69eabb3b0735ccf09b8
Instruction Fuzzy Hash: 50F0963AD0851097C720DFA5A40876FBB6AEB44711F0584F9F45DD3204DE744D424B81

Function 0564EB30 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513eff6111f002ebbb4bcc2c9563a14503aad1aa93ee515b39cce05c4d07475f
Instruction ID: 27ccadd9c7f91d38b00705735cd73845dc2bee7cc44c7d5d8484a38c02374ddc
Opcode Fuzzy Hash: 513eff6111f002ebbb4bcc2c9563a14503aad1aa93ee515b39cce05c4d07475f
Instruction Fuzzy Hash: 9CF0E971B482216FE71486199810B2BF7AEFBC8710F144469E50B9B394CA72AC42CBD5

Function 05727C22 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6080d55a20e289f8e85dab7a35bd97adb4674c394eec9b07500c2a3c050a4de1
Instruction ID: f23e61a389fbd8fb49111eca6fabc296edfa879c208aa4f2f56e72336350fa35
Opcode Fuzzy Hash: 6080d55a20e289f8e85dab7a35bd97adb4674c394eec9b07500c2a3c050a4de1
Instruction Fuzzy Hash: C8F097973092608BC326443C6CC0B679EA8DBEB700F98007EF88ECB340C4108D824360

Function 057289AE Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6ecbb5fc832b0adeb3dfb6718765e2373552a502f7f21aab06edd4222a1be0
Instruction ID: 876a745d7b0d6ac0620b1328ed30df1cfce159c3f57da42a8d9746b1f993fc1c
Opcode Fuzzy Hash: 5b6ecbb5fc832b0adeb3dfb6718765e2373552a502f7f21aab06edd4222a1be0
Instruction Fuzzy Hash: 40F0E9367101186BDB149A19D898EAAF7BAEFC8320F048066F919D7361EE31DC178791

Function 05728B77 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b514c8a9321b881ba80f3c24f22ec77a6b34555a76094b37af925f70c715dc27
Instruction ID: ef78ad94c4d604c38aee8668b3990cba25f125aa3ac98452f903b649dd47f179
Opcode Fuzzy Hash: b514c8a9321b881ba80f3c24f22ec77a6b34555a76094b37af925f70c715dc27
Instruction Fuzzy Hash: 88012839A00509CFCB00DF65E889A9CB7B5FF89301F00815AE5029B320DB30A906CB51

Function 0572AE8A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 277148085b620406cd461cdb896a90e9c2614f6ab3067c9b448315f35afecff4
Instruction ID: cf1778ccc11aba7443dba468dfc7e9b9dd1e3bcf31c77394b1090c458374f0d3
Opcode Fuzzy Hash: 277148085b620406cd461cdb896a90e9c2614f6ab3067c9b448315f35afecff4
Instruction Fuzzy Hash: 1EF04F712002059FC710CF54DA81F8AF7AAEF84310F008A3AA5168B764DAB0E9498750

Function 05645168 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 548af032e9adcf25da244efc3f762514549ef0b973fb32fb73841d405b0ed345
Instruction ID: 83452d429a6de130d349f86d87dd8adca8543fb8144c111d261c5f87a7d9cbc6
Opcode Fuzzy Hash: 548af032e9adcf25da244efc3f762514549ef0b973fb32fb73841d405b0ed345
Instruction Fuzzy Hash: 89F0A071B003185FD70C6A7D5864B7FAA9AEBC1750F26883FE009DB3A5CC668C0643A1

Function 05727C88 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d96cd3d1539714b90c0d53bf9b09db4f9c0e6163b948a751ec38ab2a5aa1037
Instruction ID: 9690f0397f7a07784c39975bacd24a5841bc8598b0d450b74396de6dd2b9cddb
Opcode Fuzzy Hash: 0d96cd3d1539714b90c0d53bf9b09db4f9c0e6163b948a751ec38ab2a5aa1037
Instruction Fuzzy Hash: 8EF0AB5BB0D2318BD32A463C3CD123AABA6EBD6341B9484BEE54ACB358D505CCC76380

Function 053C2BA0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4164762152.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22f8d2714ad476df33299a8f4e09c2c203b4656dd77f8b73b7a4b67f1ae9d882
Instruction ID: 7377e0740d7b3e819823537e7527d822c5f707258ea3d819328c26b70a1c5df9
Opcode Fuzzy Hash: 22f8d2714ad476df33299a8f4e09c2c203b4656dd77f8b73b7a4b67f1ae9d882
Instruction Fuzzy Hash: 27F0893AE0452497C720DEA6A80866FBFAAEB84711F0584FAF84DD3104DE744C414B81

Function 05649F10 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4654bacc8f8749883d3363c034c6415abcdf0f4e26684da55132dd84a3500c06
Instruction ID: ba72bb77debc11f7d34bf8db352b6ef876656b7d66de70ac55f7dba3eaaa0909
Opcode Fuzzy Hash: 4654bacc8f8749883d3363c034c6415abcdf0f4e26684da55132dd84a3500c06
Instruction Fuzzy Hash: 48F090719443209FCBB4AB96E548B7737E5BB847A5F06815AD406C7B94C720D8C2CF82

Function 0572AE98 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9541481d756cf7c1a9590c8091e352628a072e2bc7c9db7b48f7952993443b5
Instruction ID: b5d6dd049c4e94efa2834f935a4fc8ce913e1300ae4cf9d48dd47ffe9cae9387
Opcode Fuzzy Hash: a9541481d756cf7c1a9590c8091e352628a072e2bc7c9db7b48f7952993443b5
Instruction Fuzzy Hash: 2FF030312403059FCB10DF19D980E8BFBAEEFC4310F008A3AB5168B665DBB0E94D8790

Function 053C62E6 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4164762152.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89d8cbaa1c9ca39ca358055ae8058610700a377e79726a25d8f941156ac0f7f7
Instruction ID: 5b6aa3cc96c4f574aa6ab1dea4ef10d101215fe49904540b593fec369163a5ff
Opcode Fuzzy Hash: 89d8cbaa1c9ca39ca358055ae8058610700a377e79726a25d8f941156ac0f7f7
Instruction Fuzzy Hash: B201E434E04214CBCB18DF69D488A697FA5FB49320F0549A9D85AAB394DB30AC41CF41

Function 0572BCA0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be8fd83256116e4e49224c147a3f1077f5f0ce8ff6e31275986067ab6eba002
Instruction ID: f340667dac8355deebf18e04b0b05815a000bd7667e926c923d168d428e77aa8
Opcode Fuzzy Hash: 2be8fd83256116e4e49224c147a3f1077f5f0ce8ff6e31275986067ab6eba002
Instruction Fuzzy Hash: 84F05E353102009FC704DB29D458D2A7BAAEFC8721B1044A9F946CB770CA32EC42CB90

Function 05645178 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a65ba109e86794ae5bcb457a3814e710f432b8ea00e38b5e2ad63119f960d8
Instruction ID: 08d865dcf1d6816d40348a251ba0b8069bce7c76b40e92003f0b559e4381d35a
Opcode Fuzzy Hash: a7a65ba109e86794ae5bcb457a3814e710f432b8ea00e38b5e2ad63119f960d8
Instruction Fuzzy Hash: 7BE04F717442286BD30C667E5C94B7BA98FEBC5B60F24883EA10DDB399CC66CC4503E4

Function 05720B00 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39c643782389dc6dda53edf350d45196588e1ad188cfe2d9b74d8208d48849af
Instruction ID: f6c21cf9b18b7165622842511cbad2cecfe84079802971aec8f333574ed6fa36
Opcode Fuzzy Hash: 39c643782389dc6dda53edf350d45196588e1ad188cfe2d9b74d8208d48849af
Instruction Fuzzy Hash: EDF089729042189BDB15CB58D4997CDBFB9EB80315F188059E14ADB240EB741781C745

Function 05727DF8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00212cece8ba5f52c25639d4de00252e827a05065a6636063f203aed6348203c
Instruction ID: aa0928e6447b4fbcc8f6c611ce3ff64a91335fc5a08e4f271303f9bdf4c59214
Opcode Fuzzy Hash: 00212cece8ba5f52c25639d4de00252e827a05065a6636063f203aed6348203c
Instruction Fuzzy Hash: EEE09B723002014FC711D629F985A8AFB9AEFC0325F14CE3AE0198B325DE74DD8E8790

Function 053C6404 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4164762152.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513dd170f44809bf2cbfeeff6f048202c1f8e703147b6b946ad7fbd6d82279ac
Instruction ID: 584f1a8b70a5ff3fee40ab583c64ff8c8834025bfda41d066280b087f2864e50
Opcode Fuzzy Hash: 513dd170f44809bf2cbfeeff6f048202c1f8e703147b6b946ad7fbd6d82279ac
Instruction Fuzzy Hash: C6F03738E05258CFCB64DF64C888AD8BBB1FB49312F0045E9D80AAB380DB74AD81CF41

Function 053C7F33 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4164762152.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 411dc8c9af3bd68b2000c043e3b75cb5d6a89d5e9d8f2351f79196bc60b9d015
Instruction ID: 617fc4e99979f85e521ba2e3699b753e74759ae77143ca5816155ac28a8077cd
Opcode Fuzzy Hash: 411dc8c9af3bd68b2000c043e3b75cb5d6a89d5e9d8f2351f79196bc60b9d015
Instruction Fuzzy Hash: 49F01D34E112158FDB14CF18C498A9DBBB1FB89310F2545D9D84ABB354CB30AD41CF10

Function 05720B10 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e08ae44cda118cb32092a88ec1a809130ec18707f1c3d461e752118c2fbbdb
Instruction ID: 1566084e8d7e6263b188dc7200310eaf705fb9502aa15965fbf73dedcec1de63
Opcode Fuzzy Hash: 65e08ae44cda118cb32092a88ec1a809130ec18707f1c3d461e752118c2fbbdb
Instruction Fuzzy Hash: 93F06531A04218AFDB19DB58D49D7DDFFBAEB84315F148095E10ADB240DF701A81C784

Function 053C686E Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4164762152.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21eef444a2001af76d634233c660a708024ae253c9babf8929b5ddb0c0676902
Instruction ID: 591605f70d453f288effd4627772c8b4e1cd22cb49410a2080eec8236698edd1
Opcode Fuzzy Hash: 21eef444a2001af76d634233c660a708024ae253c9babf8929b5ddb0c0676902
Instruction Fuzzy Hash: 78F0F975A01658CFDB64CF14C884BA5B7B2BF4A312F0145E9E809AB791C7319E81CF52

Function 05727E08 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a97855bd448974d6302ac7518830b619e41604ba1339ae31125be1085951a895
Instruction ID: 6419c49f9bbde559fce96cbaff738a2b60e4bf099b3ad46cc35f5c4e82b32ae0
Opcode Fuzzy Hash: a97855bd448974d6302ac7518830b619e41604ba1339ae31125be1085951a895
Instruction Fuzzy Hash: A9E012312002055FC7119A1AE88484BFB9EEEC0364710C939E11A8B225DE74ED498790

Function 057224F0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c7b160a74f3ae1b93c2103667d1691c86a92c711427a0f359cb083e94d22e8
Instruction ID: 73b9c6f4a9fd64b4355b55523b53ddcb619fed4a526d5ec4949f741299015137
Opcode Fuzzy Hash: 79c7b160a74f3ae1b93c2103667d1691c86a92c711427a0f359cb083e94d22e8
Instruction Fuzzy Hash: 6BE07D3D3443208FEB249562CC44B9033ABBB00312F5044EDC6098F3C0C671D840DB01

Function 05729860 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 589f60c360760aaef6020a0eebdc5513e30bfcea5c1d4013796bc8fdaa9b48c2
Instruction ID: ac681a9f976b483c9c9c079b028d7f99c7c0f457c3278f81c0d33c05a25d9fc8
Opcode Fuzzy Hash: 589f60c360760aaef6020a0eebdc5513e30bfcea5c1d4013796bc8fdaa9b48c2
Instruction Fuzzy Hash: 62E048322482914FD702D724EC927857FB1FF45310F495A65D4C5CB957D720D44B9B51

Function 05649C20 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b55ef91f6302adfd9c9ee92f0d3c1459ea7753239821e8d6a70340a102ecd2b
Instruction ID: fe5224bba7c7ec75fa35e6ff7613e0108fac1a8ae02d2d364bac59c429546bad
Opcode Fuzzy Hash: 8b55ef91f6302adfd9c9ee92f0d3c1459ea7753239821e8d6a70340a102ecd2b
Instruction Fuzzy Hash: C3E0EC76904209EBCF64CFB4D9856AEB7F8EB44305F2145BAD80AD7241EA32CA52CB51

Function 05649C30 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a3aad3b20d238eb137b9696186668ec28ac75ce1d7992f7853f71d0252e3d9
Instruction ID: 262f541e46d6386e5c7f81ba480d1fe2d4b7e9c912424f597fc51d321e50af47
Opcode Fuzzy Hash: 89a3aad3b20d238eb137b9696186668ec28ac75ce1d7992f7853f71d0252e3d9
Instruction Fuzzy Hash: 1ED01736A0520DEBCB10DEB4A9054AAB7ECEB09215B1005EA9C0EC3200EA32DE11DB91

Function 05722500 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df6f3d079aecf1a32ce1b440ef6c73e6ec336ab4186f9f0123252884342ebee0
Instruction ID: 8391bc6c1b03d4da832859f42aa1afce3df8ec7228de69f72690b0d3cd2fc5cd
Opcode Fuzzy Hash: df6f3d079aecf1a32ce1b440ef6c73e6ec336ab4186f9f0123252884342ebee0
Instruction Fuzzy Hash: 20D02B3834833497DA2465639C14BA1739FBF00721F5080EDD6094F2C1C5B1E840D750

Function 053C2CDB Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4164762152.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45c886ffb2190f681c8af243d152b0eea91045e0175a6d197a9e15e006f0686c
Instruction ID: 3e9603f0f615761a13516070b147451912c275852466bf6e3efae3c363edb0b7
Opcode Fuzzy Hash: 45c886ffb2190f681c8af243d152b0eea91045e0175a6d197a9e15e006f0686c
Instruction Fuzzy Hash: AFE0EC3AA04120CBDF149B94D888ABE7FB6BB45305B0588DDFC86A7208DFB0DC11CB41

Function 053C5A8E Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4164762152.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72067ad09f0d96e8b6415ea049b38b2bd4d24a7366f3763195cbf6a6bd62f64c
Instruction ID: 05e3ecfe8a527ed79bf94cd689fa9ee4f8bc9bcabad9fd2b151137b11a4725fe
Opcode Fuzzy Hash: 72067ad09f0d96e8b6415ea049b38b2bd4d24a7366f3763195cbf6a6bd62f64c
Instruction Fuzzy Hash: 09F09878A106148FDB24DF24EC5469EBBB1BF89312F0091E5D809A7390DB705E80CF00

Function 0564E610 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6381df42024770841acb73281b5b252c2ac971e388ee7101b15d2fe6ca3d33b
Instruction ID: 25a9b96d87bd9c4d65b6b677a26f27d579503877147dbcbf3346985617d8c5c1
Opcode Fuzzy Hash: a6381df42024770841acb73281b5b252c2ac971e388ee7101b15d2fe6ca3d33b
Instruction Fuzzy Hash: 2CE01270B1020CEFEB04DFB5D99266DF7B9EF84200F5045A9D508DB244DE716F049B90

Function 053C558B Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4164762152.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d82839e232d5ecdcd2b099e76688168e6a75f3941651e4535134c2da518eb95b
Instruction ID: a12aa629c932fb553391a1c9552f91c15bc4f8553574dfc53a21e63e4f0fe9a2
Opcode Fuzzy Hash: d82839e232d5ecdcd2b099e76688168e6a75f3941651e4535134c2da518eb95b
Instruction Fuzzy Hash: 1AE09270D19219CBDB65CB25C5842987BA6AB4A311F1044EE944AAA780DB3AAE818F51

Function 0564E1C0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27134f0d07a2275b962f2c3b0e48594857702215df6039252678ce2b9a073fc0
Instruction ID: ed560e3e2610f5e79ac4a5fc18f298a48a59797d7e2f3f13c30bdd310282f9f8
Opcode Fuzzy Hash: 27134f0d07a2275b962f2c3b0e48594857702215df6039252678ce2b9a073fc0
Instruction Fuzzy Hash: 53E01270A00108EFDB00DFA9DA4169DB7F9EB85301F1041A8950CDB745DE716F049B95

Function 053C55D0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4164762152.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a399c567ab748aa0afbd56554bfa08c9839a2da1d44d5f2789ada7575e5964
Instruction ID: 988b47ece01fb33207c0526bcfa835481eceb294384f15d905b6a0dbcb7055a2
Opcode Fuzzy Hash: f9a399c567ab748aa0afbd56554bfa08c9839a2da1d44d5f2789ada7575e5964
Instruction Fuzzy Hash: 6FF09278E053288FCB24CF18D988698BBB2FF49310F1044E9E409A7784CB75AE80CF51

Function 05646B20 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81ad4a5fae920c6dd081d4df309cd3735eccb2b618a4dda3afb97693711d607
Instruction ID: 841e93af678e26aec86b2ad294bd9cc218400a1d127549231e9f54c9ca6adceb
Opcode Fuzzy Hash: b81ad4a5fae920c6dd081d4df309cd3735eccb2b618a4dda3afb97693711d607
Instruction Fuzzy Hash: 29D05EB5580200BFD3108A94DC92FA93BA0AF11741F225496F2019E1F2C262D801CB00

Function 057293A8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c091aeecae38a40d5c76be53155d1ebd2509629d265057413a793e3deb661c
Instruction ID: f9153b822598c358022e33e2426378599bd1325d9abaf05a815d2a0f87780ae7
Opcode Fuzzy Hash: a5c091aeecae38a40d5c76be53155d1ebd2509629d265057413a793e3deb661c
Instruction Fuzzy Hash: F8D0EC311096129FC715DA18D94098BBBA1AF80310B04CE39A0464A638DB70ED8A8780

Function 056460BD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca17071fcc36415ed2e55d5d22572e24cc718500548040232459a29990eb4dd
Instruction ID: a69dd547675a47e68d717e6bb0bd3931ebbf46d4e889009b74a34b9d0a720c44
Opcode Fuzzy Hash: bca17071fcc36415ed2e55d5d22572e24cc718500548040232459a29990eb4dd
Instruction Fuzzy Hash: EAE0673AD05128EFEB10DBA4D985AAEBB72BB18311F154474DC4763244DB306D52DF91

Function 05647F70 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba7b383d90ecfdbfb165a2105713f6e1451aecca5d9c4e61bdd58ed27d94bc44
Instruction ID: 8777b5a4302e618e4b584c6b094b0a1a23a9cb44fe17e4ba076a9071d46d67ee
Opcode Fuzzy Hash: ba7b383d90ecfdbfb165a2105713f6e1451aecca5d9c4e61bdd58ed27d94bc44
Instruction Fuzzy Hash: DAD012F15445409FD7049678D8899597BBCAF5A245B120499E04AD7171D211C840CA10

Function 05644DF0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b625e5b8c14f26d6323dac85f6fb008522a9419a7095502cc04248e2ae5e8ef
Instruction ID: 050411e2eb6e70c56de53c1b697abd16061f085a6d15d0b5e034ceddfdef5bd5
Opcode Fuzzy Hash: 8b625e5b8c14f26d6323dac85f6fb008522a9419a7095502cc04248e2ae5e8ef
Instruction Fuzzy Hash: 2CC02B3133482C03910932DCB8040FB328DD7C4771F00002AE30983344CE654D0003D9

Function 05643460 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b173c8f3e90cb459e42b5ee52c2d63a1ec53f03369f4734f939f290d0288eff9
Instruction ID: c742b489ac69dc5dc1fb5a43263814d3a4b665fcda12776a68d79c86653149a1
Opcode Fuzzy Hash: b173c8f3e90cb459e42b5ee52c2d63a1ec53f03369f4734f939f290d0288eff9
Instruction Fuzzy Hash: 36C08C321187049FC700EEA8DCD2ED0BBACFB04615B4B08D1E104C7A62D212F8208A40

Function 05642FB0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4b92780e9b7ad5af6940e490537934c62cac7fb7430ad89d7354098f7e24346
Instruction ID: 987105f830fa7e4b534e60e1a2708d70ebb27459f2332acd55e1a2b8095a1b67
Opcode Fuzzy Hash: b4b92780e9b7ad5af6940e490537934c62cac7fb7430ad89d7354098f7e24346
Instruction Fuzzy Hash: AEC08CBB4140408FDB000FA4E58F3AE3F24C721356F260F5BF288DA200C91640434632

Function 0572BC6A Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed0f0294d6e321fb2ada6fb17eb1014bbd1ddc0ea747e578d838a6b5b5c8e4a
Instruction ID: 74bd90e3f8df2fd07c5c3a1a60c4275620511777e54442f0cda945170125f038
Opcode Fuzzy Hash: 0ed0f0294d6e321fb2ada6fb17eb1014bbd1ddc0ea747e578d838a6b5b5c8e4a
Instruction Fuzzy Hash: F3C0127A040108AFC3008B68D88AF40BBB8EF18221F158060FA098B732C222F8208A44

Function 053C9006 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4164762152.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d838c6a033914cf627c34694012a279ab8556c6afda67ef6cbc92f9b1221617
Instruction ID: 90fdcf5ba63d85591a5c1d30f86f4850e7f5dc303d43bbc529e49d55d3152c58
Opcode Fuzzy Hash: 6d838c6a033914cf627c34694012a279ab8556c6afda67ef6cbc92f9b1221617
Instruction Fuzzy Hash: 38E04275D412288FCB60DF15E848798BBB5FB49300F0085EAC84EA3694DB301E818F41

Function 05642760 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa78829aac16ff71e3fd87c6d01611966e1c8a5cd6e1cb8b0ffb60a19035349
Instruction ID: 14e23ff7ad15ed695d3ac70273a2a9e0374d070a92d61b2fa7d7313b24ed3e66
Opcode Fuzzy Hash: 2aa78829aac16ff71e3fd87c6d01611966e1c8a5cd6e1cb8b0ffb60a19035349
Instruction Fuzzy Hash: 25C08C727283858FC382872CE88A8403BB8FF1B60532400D6F088CB232C212BC04DB92

Function 05649EF0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15485d6915e7e1d9361cb55cb792c6c88701b7fd5a07c2ccb3714f0b17178fec
Instruction ID: 64eab7c394817638b704d74ccaf35aa15e2daef9ea01f29e03c46b4a75645911
Opcode Fuzzy Hash: 15485d6915e7e1d9361cb55cb792c6c88701b7fd5a07c2ccb3714f0b17178fec
Instruction Fuzzy Hash: 97C08CB1890600DFC740CEA4D0C598937F8FF2934AB2310A6E008C7272D322C8028E00

Function 0564DB40 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3cf73ecc0437b7ba418ab1aa0e16a313d668e98a5c47dae4f63aedb3a58e83
Instruction ID: 1559b7bb1d66cdfc4324202593fed40f7269f97be06a62174427e62a94373c76
Opcode Fuzzy Hash: 6b3cf73ecc0437b7ba418ab1aa0e16a313d668e98a5c47dae4f63aedb3a58e83
Instruction Fuzzy Hash: 8DC00235280208AFD7109A55DC46F457B68AB15B50F554091F7045F6A1C6A2E8109A98

Function 05646B30 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3cf73ecc0437b7ba418ab1aa0e16a313d668e98a5c47dae4f63aedb3a58e83
Instruction ID: 1559b7bb1d66cdfc4324202593fed40f7269f97be06a62174427e62a94373c76
Opcode Fuzzy Hash: 6b3cf73ecc0437b7ba418ab1aa0e16a313d668e98a5c47dae4f63aedb3a58e83
Instruction Fuzzy Hash: 8DC00235280208AFD7109A55DC46F457B68AB15B50F554091F7045F6A1C6A2E8109A98

Function 0572EF62 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a325aee887d0d1ae3a0cf65b1c5efd1d6da9ca28d70a267186794c85a8614c9e
Instruction ID: 26df56f49fd22481af11580e364c7481b2b4379e5f073390baeaec0182b97489
Opcode Fuzzy Hash: a325aee887d0d1ae3a0cf65b1c5efd1d6da9ca28d70a267186794c85a8614c9e
Instruction Fuzzy Hash: 7BC0123A000208AFC3008E18D845F4A7B78EB08720F0540A0F6088B322C622E9108A84

Function 057220F1 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0d6cfd41d40046ef5d0c8a5ad469b5451d7483446a65981ef3268b996f2f18d
Instruction ID: 654be8f53189b10392f98c4408a86305e6ac6d7fabae19940d4566c71470fa65
Opcode Fuzzy Hash: d0d6cfd41d40046ef5d0c8a5ad469b5451d7483446a65981ef3268b996f2f18d
Instruction Fuzzy Hash: 60C08CBB4200004BFA00CA09D8CAF857BA4E310301F1C4950F205C9240CA24F052EA29

Function 05646717 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd37b89d5aab077247e9ca6c261333b6d482a96efc2d162c4755b1429ce4a516
Instruction ID: b6a2c9da50a421057357a48bd646d8d20e240b95bf103ed846c29865627b9619
Opcode Fuzzy Hash: bd37b89d5aab077247e9ca6c261333b6d482a96efc2d162c4755b1429ce4a516
Instruction Fuzzy Hash: 0BD00276D0421CCBDB10DAE0C594BAEB3B3AB54355F15407BC81B6B694C6751C46CF91

Function 05646FC0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 887ea6d6a89c439c5d0935c2bf305b673725f06c1e1267f1bdbc82eb8ba2043c
Instruction ID: 078d831ed246c5674df926a28d22449b7b580be9279dfedc67ca1e0f1b70b738
Opcode Fuzzy Hash: 887ea6d6a89c439c5d0935c2bf305b673725f06c1e1267f1bdbc82eb8ba2043c
Instruction Fuzzy Hash: FDC080F18493549FC7350B68A45815D7765D751359B53546FC445C0495C53380528A01

Function 056490B1 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c756b05c374ce867550067ffa1ec858aaebef3a2f1a2367288cda7aeb9b8d9dd
Instruction ID: f56e2ba5cffe59d8363ebafed27224cbac0b3f063584f6709e3bfe2009041f1c
Opcode Fuzzy Hash: c756b05c374ce867550067ffa1ec858aaebef3a2f1a2367288cda7aeb9b8d9dd
Instruction Fuzzy Hash: 1EC09BFB8703149FDB5405E4A0C52DD7B589754BA7F32151BE40DD00C1A921C4854D00

Function 053C1B63 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4164762152.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4ecc170e56cad0af8a502e18371472d76669a3fed97f4439633f9f996cec2b
Instruction ID: 12955dbfbe23c35acb2577e74837e8dde5deaa0878f78be6c2093050e63e1876
Opcode Fuzzy Hash: ee4ecc170e56cad0af8a502e18371472d76669a3fed97f4439633f9f996cec2b
Instruction Fuzzy Hash: C9C04C3808D2C59FE71207A968B81953FF56D0601170D04C69C89CB562811591169355

Function 05641BCE Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7dc530b26c41f56b80a1b7f3b25ac7fa9803df00972488b9197040e5017f865
Instruction ID: d158f734323e189737826f17c710efbe317827133a28a3becda91b145689b987
Opcode Fuzzy Hash: e7dc530b26c41f56b80a1b7f3b25ac7fa9803df00972488b9197040e5017f865
Instruction Fuzzy Hash: 4DC09B1605E7C48FD30323E0781D25C7F3CCD46425FAA00C3D2DCC6157E616485483B6

Function 05646039 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f637af48666f0bfbb5fc983c98de8f40454c14a39dcbb9c924057c5daa3f44ae
Instruction ID: db16aa4547bf9f2d8df035cb47982071b7c174b460c42d92dd04e9e1996426ed
Opcode Fuzzy Hash: f637af48666f0bfbb5fc983c98de8f40454c14a39dcbb9c924057c5daa3f44ae
Instruction Fuzzy Hash: 5CC0923AD1531CCBC700FBA4C48824FB7E3AB54690FA48335C40EAB2A0DA716C02CF88

Function 0572BC78 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 05722130 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa3fbe70d3d558da4166abfa2970b00cf74fd731a058567ef0707808dac912c
Instruction ID: 1fa3f4e85271e300b56c2e9e69a6b4923c990aa56bbab792200207c056517f16
Opcode Fuzzy Hash: afa3fbe70d3d558da4166abfa2970b00cf74fd731a058567ef0707808dac912c
Instruction Fuzzy Hash: 0AC09BB74100C14BF701CB64E556B857F68D715346F154415D1C3C9180CA246661DB3D

Function 05643470 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba36aef03bc27f84ab667d144efac4fccdcd93af6e34ac239b6cc8976010b3de
Instruction ID: a086de6630c9c25d0d1ef151d61145ab0e9105ca671659dc64f504c3d7f1862d
Opcode Fuzzy Hash: ba36aef03bc27f84ab667d144efac4fccdcd93af6e34ac239b6cc8976010b3de
Instruction Fuzzy Hash: DBB092301402088FC300DA58D445C5077A8AB08A0430500D0E2088B232D622F8008A40

Function 05642770 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ab4bbdd17a120ddc1ef3c4cf224515beb75f8373d4b4482147fda78e6e90976
Instruction ID: 20159973dc6c4478fa717a34ac84a2881d4813b9dc5cbab7339b5de6a68ee492
Opcode Fuzzy Hash: 8ab4bbdd17a120ddc1ef3c4cf224515beb75f8373d4b4482147fda78e6e90976
Instruction Fuzzy Hash: 0DB01231250208CFC300DB6CE444C0033FCAF4DA1431000D0F10C8B331C721FC008A40

Function 05649F00 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e2839fb080d70fd9d5ab266c8ff45246f4c7246a28781672dbb782ec4b6ef3
Instruction ID: cfd3c94acb28e12ede7e7a80c62375d018fe088f1f186957f4485c32e65079b3
Opcode Fuzzy Hash: f4e2839fb080d70fd9d5ab266c8ff45246f4c7246a28781672dbb782ec4b6ef3
Instruction Fuzzy Hash: 6CB092301602088F82009A59E448C0137ACAF08A0434100D0E1088B632C621F8008A51

Function 05642FC0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3e1ca7d46ba1842b712aea538dadd1f6dd1c82c437a8bfaff8415f7eddf92e
Instruction ID: b718ab2c249d452cbf5d6cc2682dc991bc342612adfdb0e128e7c8559ac10a4c
Opcode Fuzzy Hash: ea3e1ca7d46ba1842b712aea538dadd1f6dd1c82c437a8bfaff8415f7eddf92e
Instruction Fuzzy Hash: 60B01238050108CFD7003BA0B40F04E3F2C9900326BC14211F30D481004E5154005D61

Function 05647F80 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35b94a68f7c4b7567d5f91d172f55421f9e29921dd73c803e995a2f03265d01
Instruction ID: a136d31b4648f218486bf5cb1ad07de9ef31e8686db64e34b659b88132c01c59
Opcode Fuzzy Hash: a35b94a68f7c4b7567d5f91d172f55421f9e29921dd73c803e995a2f03265d01
Instruction Fuzzy Hash: 91B01230240608CFC300DB5CD445C0477FCAF49A0430000D0F1088B331C721FC009A40

Function 0564FF88 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72501201617008b986c6ecdf217939323aeef6e057a262a66a9af83cf13f23bc
Instruction ID: 27310be44d3b7abb115361948b54caf2e33d09dec135f28ea5f58cfa2d955dfc
Opcode Fuzzy Hash: 72501201617008b986c6ecdf217939323aeef6e057a262a66a9af83cf13f23bc
Instruction Fuzzy Hash: CCB09232000308AB87009A88E848855BB69AB59700700C029B609061128B32A822DB99

Function 05649BDC Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebdfdb249b58218153963e37b2a5a61368744e76cb26e0baeb64348f9d28c3c1
Instruction ID: e3035e1df7ffdbc822d593d919369507016f68dfc9301ef73b291b06a96b9eaf
Opcode Fuzzy Hash: ebdfdb249b58218153963e37b2a5a61368744e76cb26e0baeb64348f9d28c3c1
Instruction Fuzzy Hash: 27B0123BB400199ACB00D6C8F4504ECFB30EBD4332F004033C300620008B31157AC760

Function 0564AD57 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbfe652a467b3316fb3eb32d4fcab1a329bcf6802272ea165067c8cb0d7deaee
Instruction ID: 934735e9c965bed55aca95eb7e945d8b9b50a9500379e263ef9d00c95a788ab4
Opcode Fuzzy Hash: dbfe652a467b3316fb3eb32d4fcab1a329bcf6802272ea165067c8cb0d7deaee
Instruction Fuzzy Hash: 86C09B315451168FDB14D711F945B557732BB45305F044171400516269C7705DC6CF81

Function 053C1B70 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4164762152.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f686124c0930a9a697251fef41440bb7e53d3155c42ef20ddd22ca5f01fbac6
Instruction ID: 2143d6c2bf8451430958fdaf006559ef95daaf8596ec427c6689aad084d8afe5
Opcode Fuzzy Hash: 9f686124c0930a9a697251fef41440bb7e53d3155c42ef20ddd22ca5f01fbac6
Instruction Fuzzy Hash: 7390223C08820C8B02002388380C000330CAA008003800000A00E020000A0020000280

Function 053CF250 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4164762152.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 167bf57d3b95ca4bced5215c1d7daa32db56ecf6ba07f677d1e8d65c9637d6a0
Instruction ID: e06c14907c314bac0852272fd33941c5cb116f40a1bf9958394b8dd196c07563
Opcode Fuzzy Hash: 167bf57d3b95ca4bced5215c1d7daa32db56ecf6ba07f677d1e8d65c9637d6a0
Instruction Fuzzy Hash: 49900235145B0C8B86507799B90D555775C9544D157800051A50D415056A5564205A9A

Function 0564D9E0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8725485302f654bc7a317d69c6bd3f933832ed05017eec76a116d57fce6fd6ed
Instruction ID: 30a0b5d883e969e7c4a695a2fadb6a6c4a0f024cf44a64f2d22146c361b9972e
Opcode Fuzzy Hash: 8725485302f654bc7a317d69c6bd3f933832ed05017eec76a116d57fce6fd6ed
Instruction Fuzzy Hash: 9190027205460C9B56402799780A595FB5CA544626B840051F60D859015E6564504A95

Function 05641BE0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c88d2d6935814cd207dd7110ed3d8c3677cedefff03c69cbe07a37361c15b2d3
Instruction ID: eac0ee706d5446e37af2d4f9657db0370958ab5ce435cd9a82a318b9f3450274
Opcode Fuzzy Hash: c88d2d6935814cd207dd7110ed3d8c3677cedefff03c69cbe07a37361c15b2d3
Instruction Fuzzy Hash: 9190023508564C8B875027D9740D595775C964452A7800451A54D425056A56646056D5

Function 056401F4 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb93bc8a10585c7a286cf3e49c5276371687e97e9494679c1868c082b83a4988
Instruction ID: 1828058fe7079f7dd9ec593329ac2bf0522b210f11b2550214923c9ca3f78fa5
Opcode Fuzzy Hash: fb93bc8a10585c7a286cf3e49c5276371687e97e9494679c1868c082b83a4988
Instruction Fuzzy Hash: 65900222804020C6E3409064400976402C24354674F1A4571CD099B240E5195C035641

Non-executed Functions

Function 05721CA8 Relevance: 2.8, Strings: 2, Instructions: 331COMMON

Download Yara Rule

Strings

(bq, xrefs: 0572204C
,bq, xrefs: 05721D9E

Memory Dump Source

Source File: 00000002.00000002.4166667016.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5720000_RegAsm.jbxd

Similarity

API ID:
String ID: (bq$,bq
API String ID: 0-1616511919
Opcode ID: 80405f53a13a0dd0b08e84e78e569d0359ba917a44bbc3d3fe153ffeca099c5f
Instruction ID: 71fce47f736b969ab1620481564420b695bf4e1f8f04cb60d6eb2923bdf5df0a
Opcode Fuzzy Hash: 80405f53a13a0dd0b08e84e78e569d0359ba917a44bbc3d3fe153ffeca099c5f
Instruction Fuzzy Hash: C5D11A34A00614CFCB14DF69C584AAAB7F2FF88311F65C5A9E9169B362CB35EC81DB50

Function 02C81618 Relevance: 2.7, Strings: 2, Instructions: 155COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02C816C6
4'^q, xrefs: 02C816F1

Memory Dump Source

Source File: 00000002.00000002.4156447034.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c80000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 48cabd88e10ecd3e4407f6f5739fbe7abd9c20b275823618194553f548db76d4
Instruction ID: 52e6458b6955f9982470637ddf4c0349723f3f9fc1a6fbdfd5131f14c2015ddf
Opcode Fuzzy Hash: 48cabd88e10ecd3e4407f6f5739fbe7abd9c20b275823618194553f548db76d4
Instruction Fuzzy Hash: 6C511C75A006548FDB1EEF7BF54479ABBE3BBD8204F14D529C0089B26CEB715909CB90

Function 02C81628 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02C816C6
4'^q, xrefs: 02C816F1

Memory Dump Source

Source File: 00000002.00000002.4156447034.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c80000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: bfccb5b0d810eb47c32eb210492947a2baafea59250ba8f9e861400697f032c9
Instruction ID: 1a83c28e0d1eeb9d7b3f5005979522c628278f91c180b1a56667a5bd1051f1bf
Opcode Fuzzy Hash: bfccb5b0d810eb47c32eb210492947a2baafea59250ba8f9e861400697f032c9
Instruction Fuzzy Hash: 24511B75A006548FDB1EEF6BF54479ABBE3BBD8200F14D639C0089B26CEB745909CB90

Function 056484E8 Relevance: 1.6, Strings: 1, Instructions: 313COMMON

Download Yara Rule

Strings

C^(, xrefs: 05648878

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID: C^(
API String ID: 0-1208937167
Opcode ID: 109e3efd675d58b692b3c0ec3759099bc04877012d5c6856dfce0a4f71f7209f
Instruction ID: c69ae70629bad5c482524d3846a80697ccfc231523522056cedde5f1174dc593
Opcode Fuzzy Hash: 109e3efd675d58b692b3c0ec3759099bc04877012d5c6856dfce0a4f71f7209f
Instruction Fuzzy Hash: 4FC19E71E001298FCB55CBA9C880AAEFBF2FB89304F248669D455E7646D734ED42CF90

Function 05735998 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\VSm, xrefs: 05735C4F

Memory Dump Source

Source File: 00000002.00000002.4166766868.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5730000_RegAsm.jbxd

Similarity

API ID:
String ID: \VSm
API String ID: 0-1782263414
Opcode ID: 15d9dfe3fa45c13bd78804ee1fd2c69a34f27da9e37ab9f23644653248709cc4
Instruction ID: aa554623a8fd225c9274a045c534a5a546ff3369c9d17037cef693b913d406b5
Opcode Fuzzy Hash: 15d9dfe3fa45c13bd78804ee1fd2c69a34f27da9e37ab9f23644653248709cc4
Instruction Fuzzy Hash: 0BB15E70E002198FDF14CFA9C8867ADBBF2BF88324F148529D815E7295EB749846DF81

Function 02C81BF0 Relevance: .7, Instructions: 688COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4156447034.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdbf4938ed8a008716f8ac845190b695e8e45106a31507714849a635b259ed07
Instruction ID: dc2c50e0270f5f414b6b67db28794bf79e80e1940db7b3aff0687888e93538c5
Opcode Fuzzy Hash: bdbf4938ed8a008716f8ac845190b695e8e45106a31507714849a635b259ed07
Instruction Fuzzy Hash: B732AB7E60C3554BF717DA58DDD35ADBFA2AB4CA05BC082F5C0E1A6332D3649E828790

Function 02C81CFE Relevance: .6, Instructions: 582COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4156447034.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a120bfc04c4bea95395ed569a20c31c390c9d3b4058840935946157324c2d3
Instruction ID: dbf7f5fb155bf3ca6fef47531bc1e0f9e0f11ac54449e71858ae9d1fc02aa5ec
Opcode Fuzzy Hash: d1a120bfc04c4bea95395ed569a20c31c390c9d3b4058840935946157324c2d3
Instruction Fuzzy Hash: 7922AA7E60C3554BF71BDA18DDE3579BFA2964CA05BC082F1C1E295332D3A85EC28390

Function 02C81CE3 Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4156447034.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1a8d2241301d54eb9a0d96fdeb282d6b606f775577cfe0510da071109e19769
Instruction ID: a80be19fea31134cc4158db679afb90351f808a297711ea2b6fec7d0db071e47
Opcode Fuzzy Hash: c1a8d2241301d54eb9a0d96fdeb282d6b606f775577cfe0510da071109e19769
Instruction Fuzzy Hash: 17129A7E60C3554BF71BDA19DEE3579BFA2964CA05BC082F1C1E295332D3A85EC28391

Function 02C81C98 Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4156447034.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f94a3d9ea0f8d617baae6423ee3c187940aea7fe762469d380e11b5ecc0c5aa
Instruction ID: 0d832b590befd62041524aaa767ca49b220ea9494e1f885f7d86355ada075f2c
Opcode Fuzzy Hash: 9f94a3d9ea0f8d617baae6423ee3c187940aea7fe762469d380e11b5ecc0c5aa
Instruction Fuzzy Hash: 3712AA7E60C3554BF71BDA18DDE3579BFA2964CA05BC082F1C1E295332D3A85EC28391

Function 02C81CB0 Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4156447034.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc44eb4c081f37f6cb1a3bc06c765194be161ca2c2204f9b5b7595b8ac65928f
Instruction ID: d52f1499fc9d2fbf72950a4d520687d82e55679aefaa8947be3f720be3a79b6e
Opcode Fuzzy Hash: dc44eb4c081f37f6cb1a3bc06c765194be161ca2c2204f9b5b7595b8ac65928f
Instruction Fuzzy Hash: 2512AA7E60C3554BF71BDA19DDE3579BFA2964CA05BC082F1C1E2A5332D3A85EC28391

Function 02C81C4C Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4156447034.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4792e20d9fd8bff19d5f6cd4799a00ef41f97f41daa0d022e38837be57ee8fe7
Instruction ID: 5475570ad571a109ec182d17f4bc7535c4a17b9c5ec2634fa888c116935f6cd7
Opcode Fuzzy Hash: 4792e20d9fd8bff19d5f6cd4799a00ef41f97f41daa0d022e38837be57ee8fe7
Instruction Fuzzy Hash: 9712AA7E60C3554BF71BDA58DDE3579BFA2964CA05BC082F1C1E2A5332D3A85EC28391

Function 02C81C6D Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4156447034.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b726528bdc866260af740387fbd8960db99a0cca78caf0868242b1c792ee8eb
Instruction ID: 51a0830e704277b284fa7ed1f0c8ad336d09c3f927bb15150d8edb52f82fa9a5
Opcode Fuzzy Hash: 9b726528bdc866260af740387fbd8960db99a0cca78caf0868242b1c792ee8eb
Instruction Fuzzy Hash: 9B12AA7E60C3554BF71BDA19DDE3579BFA2968CA05BC082F1C1E295332D3A85EC28391

Function 02C81C2C Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4156447034.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a7069ccecd75ec2eb19e81626a6320d954636256005742772ee8faa9e00a76e
Instruction ID: 2261deeefe34440ecab1944752a4aaceec80addc6dcb3f129d0f58be79218565
Opcode Fuzzy Hash: 5a7069ccecd75ec2eb19e81626a6320d954636256005742772ee8faa9e00a76e
Instruction Fuzzy Hash: 9112AA7E60C3554BF71BDA19DDE3579BFA2964CA05BC082F1C1E295332D3A85EC28391

Function 02C81CCD Relevance: .6, Instructions: 580COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4156447034.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3419f3408d15ca7006f09a453cfd616d4809589f7481b5faba2c4f3189bddf6c
Instruction ID: 7909be88e15b1f41b67af0e9b52af4a5c5e59ee06d4fa060470637499afb61e3
Opcode Fuzzy Hash: 3419f3408d15ca7006f09a453cfd616d4809589f7481b5faba2c4f3189bddf6c
Instruction Fuzzy Hash: 7A129A7E60C3554BF71BDA19DDE3579BFA2964CA05BC082F1C1E295332D3A85EC28391

Function 02C81C83 Relevance: .6, Instructions: 580COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4156447034.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1290db63842df81ec855434adecf96aa708f31647134cf63a29b1976b707b1d
Instruction ID: 083c3b53cd1fff0b1fd0da1f39d65e3c0ef1108aca53339e0166961363f2dc72
Opcode Fuzzy Hash: b1290db63842df81ec855434adecf96aa708f31647134cf63a29b1976b707b1d
Instruction Fuzzy Hash: 25129A7E60C3554BF71BDA19DDE3679BFA2964CA05BC082F1C1E295332D3A85EC28391

Function 02C83D84 Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4156447034.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55c61c1e458b6a89be2e291c949cea9ffaae23327f7f886ceaafea5f3a1984c1
Instruction ID: b0ef579099a5618671c60eed0dcb28f3ebe6c10bbf881a13375e4e524ad7a2de
Opcode Fuzzy Hash: 55c61c1e458b6a89be2e291c949cea9ffaae23327f7f886ceaafea5f3a1984c1
Instruction Fuzzy Hash: E712AA7E60C3554BF71BDA19DDE3579BFA2964CA05BC082F1C1E2A5332D3A85EC28390

Function 056484D7 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4166240465.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5640000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c8777a3a431e9d83cf070113cf7ab38e35815b468347123323432213518b0aa
Instruction ID: a59b23ac2ed24425649c906b2fe218de60994f0e126f49be1ca35294a320a3c7
Opcode Fuzzy Hash: 6c8777a3a431e9d83cf070113cf7ab38e35815b468347123323432213518b0aa
Instruction Fuzzy Hash: 72716C71E0452A8FDB54CFA9C881AAEFBF1FB88304F148229D415E7645D734E946CF90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ahmbf.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mt2k4kbw.o2u.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xa2kn2jv.ef2.ps1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FMBUXXLAKACDDLXFEV6C.temp

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Windows Analysis Report
ahmbf.ps1

Function 00007FFD9BAA57FF Relevance: 1.8, APIs: 1, Instructions: 338
processCOMMON

Function 00007FFD9BAA5EA4 Relevance: 1.7, APIs: 1, Instructions: 161
injectionCOMMON

Function 00007FFD9BAA5B95 Relevance: 1.6, APIs: 1, Instructions: 131
threadCOMMON

Function 00007FFD9BAA5FC5 Relevance: 1.6, APIs: 1, Instructions: 101
threadCOMMON

Function 00007FFD9BB714F9 Relevance: .4, Instructions: 418
COMMON

Function 00007FFD9BB70554 Relevance: .2, Instructions: 176
COMMON

Function 00007FFD9BB70ACE Relevance: .1, Instructions: 148
COMMON

Function 00007FFD9BB705A9 Relevance: .1, Instructions: 86
COMMON

Function 02C84D0F Relevance: 2.7, Strings: 2, Instructions: 152
COMMON

Function 057283F0 Relevance: 7.7, Strings: 6, Instructions: 152
COMMON

Function 05726FB8 Relevance: 4.2, Strings: 3, Instructions: 475
COMMON

Function 05728DE8 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Function 0572E6E0 Relevance: 4.1, Strings: 3, Instructions: 362
COMMON